| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.09.2012, 18:42
| #1 |
| |  tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Hallo, ich habe hier ein kleines Problem. Ich habe laut "AntiVir" 2 bösewichte mit dem Namen: - tr/sirefef.16896 - tr/atraps.gen2 Leider bekomme ich die nicht so ohne weiteres entfernt. Selbst in quarantäne lassen die sich nicht schieben. Ich hoffe ihr könnt mir helfen. HAbe hier noch das Log von Malwarebytes wenn das helfen sollte. Code:
ATTFilter Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.09.03.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Sebastian :: ADMIN-PC [limited] Protection: Enabled 03.09.2012 19:31:16 mbam-log-2012-09-03 (19-15-32).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 149142 Time elapsed: 39 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@ (Rootkit.0Access.64) -> No action taken. C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@ (RootKit.0Access.H) -> No action taken. (end) |
|
04.09.2012, 22:01
| #2 |
| /// Selecta Jahrusso   | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Bitte folge den Anweisungen hier und poste die geforderten Logfiles. http://www.trojaner-board.de/69886-a...-beachten.html
__________________ |
|
07.09.2012, 03:12
| #3 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Hallo,
__________________hier die files [CODE]OTL Logfile: Code:
ATTFilter OTL logfile created on: 07.09.2012 04:01:24 - Run 1 OTL by OldTimer - Version 3.2.61.1 Folder = C:\Users\Sebastian\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 15,98 Gb Total Physical Memory | 13,91 Gb Available Physical Memory | 87,01% Memory free 31,96 Gb Paging File | 29,77 Gb Available in Paging File | 93,14% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 89,33 Gb Total Space | 24,31 Gb Free Space | 27,21% Space Free | Partition Type: NTFS Drive D: | 298,05 Gb Total Space | 233,84 Gb Free Space | 78,46% Space Free | Partition Type: NTFS Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.07 04:00:48 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe PRC - [2012.08.21 08:17:22 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe PRC - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.07.18 18:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.14 02:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.06.26 16:42:46 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2011.03.03 16:48:28 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.03.03 16:48:28 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010.08.11 16:18:06 | 000,487,561 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe ========== Modules (No Company Name) ========== MOD - [2012.08.21 08:17:22 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll MOD - [2012.07.14 02:14:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012.05.30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.05.30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.06.26 16:42:30 | 000,237,160 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ========== Services (SafeList) ========== SRV - [2012.08.21 08:17:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.07.14 02:17:12 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.06.26 16:42:46 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011.03.03 16:48:28 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.03.03 16:48:28 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2011.01.05 13:41:38 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2011.01.05 13:28:50 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV - [2011.01.05 13:26:56 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.18 18:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.07.18 18:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.07.18 18:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.04.25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.07.05 13:53:46 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011.03.30 15:12:14 | 001,395,760 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2011.03.03 17:23:42 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler) DRV:64bit: - [2011.03.03 17:07:44 | 000,335,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV:64bit: - [2011.03.03 17:02:38 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2011.01.04 11:29:46 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.11.21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.10.19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.09.30 21:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.09.30 21:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.08.20 11:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn) DRV:64bit: - [2010.06.07 16:45:00 | 000,174,848 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=112555&tt=3412_8&babsrc=HP_ss&mntrId=dca16f640000000000005c260a6b8f85 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 42 31 23 12 44 7F CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&tt=3412_8&babsrc=SP_ss&mntrId=dca16f640000000000005c260a6b8f85 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.21 07:34:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.08.21 07:38:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.08.21 07:34:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2012.08.21 07:34:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Integrated Webcam Live! Central] C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [DriverMax] C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions) O4 - HKCU..\Run: [DriverMax_RESTART] File not found O4 - HKCU..\Run: [Personal ID] C:\PROGRA~2\COOLSP~1\PERSON~1\PID.EXE (coolspot AG, Düsseldorf) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab (Launcher Class) O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5865820E-726C-4286-B22B-2CEBFBF19153}: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.05 00:05:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT [2012.09.05 00:05:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UseNeXT [2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR [2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.09.04 23:51:42 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2012.09.04 23:14:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software [2012.09.04 23:13:23 | 014,662,576 | ---- | C] (Foxit Corporation ) -- C:\Users\Admin\Desktop\FoxitReader531.0606_enu_Setup.exe [2012.09.03 22:09:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EAGLE Layout Editor 6.2.0 [2012.09.03 22:09:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EAGLE-6.2.0 [2012.09.03 22:09:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\CadSoft [2012.09.03 21:28:37 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Dropbox [2012.09.03 19:03:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2012.09.03 19:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.03 19:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.03 19:03:36 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.03 19:03:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.28 03:53:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Resource Hacker [2012.08.28 03:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Resource Hacker [2012.08.24 22:52:57 | 000,000,000 | ---D | C] -- C:\ProgramData\VOWSoft [2012.08.24 22:52:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPodRobot [2012.08.24 22:52:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iPodRobot [2012.08.22 20:21:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment [2012.08.21 22:10:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\libimobiledevice [2012.08.21 19:54:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Personal ID [2012.08.21 19:54:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\coolspot AG [2012.08.21 19:53:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Utherverse [2012.08.21 19:51:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Secret City [2012.08.21 19:46:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SecretCity 3DChat [2012.08.21 19:46:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Utherverse Digital Inc [2012.08.21 10:17:29 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\OEM [2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Hotfix [2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Drivers [2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer [2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE [2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\de-DE [2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de [2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407 [2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE [2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de [2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407 [2012.08.21 10:14:43 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2012.08.21 10:14:28 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2012.08.21 10:14:27 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2012.08.21 10:14:27 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2012.08.21 08:17:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2012.08.21 07:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net [2012.08.21 07:38:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird [2012.08.21 07:38:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Avira [2012.08.21 07:37:56 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4 [2012.08.21 07:37:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3 [2012.08.21 07:36:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Apple Computer [2012.08.21 07:36:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple Computer [2012.08.21 07:35:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} [2012.08.21 07:35:36 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple [2012.08.21 07:35:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2012.08.21 07:35:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2012.08.21 07:35:26 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2012.08.21 07:35:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2012.08.21 07:35:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2012.08.21 07:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple [2012.08.21 07:33:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mozilla [2012.08.21 07:33:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Mozilla [2012.08.21 07:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.08.21 07:33:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.08.21 07:32:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.08.21 07:32:35 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.08.21 07:32:35 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012.08.21 07:32:35 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.08.21 07:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.08.21 07:32:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2012.08.21 07:21:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Innovative Solutions [2012.08.21 07:21:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax [2012.08.21 07:21:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Innovative Solutions [2012.08.21 07:19:14 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA% [2012.08.21 07:18:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Macromedia [2012.08.21 07:17:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe [2012.08.21 07:16:39 | 000,000,000 | ---D | C] -- C:\temp [2012.08.21 07:16:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2012.08.21 07:16:01 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2012.08.21 07:08:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.08.21 07:08:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Babylon [2012.08.21 07:08:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2012.08.21 07:08:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\YourFileDownloader [2012.08.21 07:04:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Easeware [2012.08.21 06:51:09 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll [2012.08.21 04:43:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Dell [2012.08.21 04:43:22 | 000,000,000 | ---D | C] -- C:\ProgramData\PCDr [2012.08.21 04:43:20 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AlienAutopsy [2012.08.21 04:43:18 | 000,000,000 | ---D | C] -- C:\Program Files\AlienAutopsy [2012.08.21 04:42:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\PCDr [2012.08.21 04:40:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.08.21 04:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2012.08.21 04:38:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2012.08.21 04:38:11 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2012.08.21 04:38:03 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.08.21 04:38:03 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.08.21 04:37:56 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2012.08.21 04:35:03 | 000,021,616 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\drivers\stdcfltn.sys [2012.08.21 04:35:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2012.08.21 04:34:21 | 000,000,000 | ---D | C] -- C:\Program Files\STMicroelectronics [2012.08.21 04:31:32 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics [2012.08.21 04:31:19 | 001,395,760 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys [2012.08.21 04:31:19 | 000,400,168 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll [2012.08.21 04:31:19 | 000,273,704 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll [2012.08.21 04:31:19 | 000,218,408 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll [2012.08.21 04:31:19 | 000,215,336 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll [2012.08.21 04:31:19 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll [2012.08.21 04:31:19 | 000,148,264 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo4.dll [2012.08.21 04:31:19 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll [2012.08.21 04:30:54 | 000,081,008 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\accelernco01.dll [2012.08.21 04:30:54 | 000,027,760 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\drivers\Accelern.sys [2012.08.21 04:28:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent [2012.08.21 04:28:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2012.08.21 01:43:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2012.08.21 01:15:06 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b} [2012.08.21 01:10:51 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Atheros_L1e [2012.08.21 01:10:29 | 000,076,912 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\L1C62x64.sys [2012.08.21 01:09:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Downloaded Installations [2012.08.21 01:08:24 | 000,000,000 | ---D | C] -- C:\Intel [2012.08.21 01:08:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.08.21 01:08:22 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.08.21 01:08:10 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.08.21 00:46:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Intel [2012.08.21 00:46:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\Roaming [2012.08.21 00:46:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Roaming [2012.08.21 00:45:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless [2012.08.21 00:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel [2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel [2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\Program Files\Intel [2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco [2012.08.21 00:45:00 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.08.21 00:44:56 | 000,000,000 | ---D | C] -- C:\dell [2012.08.21 00:27:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Creative [2012.08.21 00:26:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Integrated Webcam [2012.08.21 00:25:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative [2012.08.21 00:24:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Integrated Webcam [2012.08.21 00:24:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative Live! Cam [2012.08.21 00:23:57 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2012.08.21 00:23:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches [2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.21 00:21:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities [2012.08.21 00:21:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts [2012.08.21 00:21:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\VirtualStore [2012.08.21 00:21:27 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Pictures [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop [2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten [2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten [2012.08.21 00:21:27 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData [2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Temp [2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft [2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Programme [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2012.08.21 00:21:20 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.08.21 00:18:03 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2012.08.21 00:17:53 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2012.09.07 04:00:26 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable [2012.09.07 03:44:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.06 19:53:21 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.06 19:53:21 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.06 19:52:20 | 001,498,332 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.09.06 19:52:20 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.09.06 19:52:20 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.09.06 19:52:20 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.09.06 19:52:20 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.09.06 19:46:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.06 19:46:08 | 4280,672,254 | -HS- | M] () -- C:\hiberfil.sys [2012.09.05 00:05:52 | 000,001,857 | ---- | M] () -- C:\Users\Admin\Desktop\UseNeXT.lnk [2012.09.04 23:13:37 | 014,662,576 | ---- | M] (Foxit Corporation ) -- C:\Users\Admin\Desktop\FoxitReader531.0606_enu_Setup.exe [2012.08.24 22:52:57 | 000,001,228 | ---- | M] () -- C:\Users\Public\Desktop\plist Editor for Windows.lnk [2012.08.21 19:51:55 | 000,002,463 | ---- | M] () -- C:\Users\Admin\Desktop\Secret City.lnk [2012.08.21 10:16:01 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat [2012.08.21 10:16:01 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat [2012.08.21 07:43:46 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.08.21 07:40:15 | 000,293,448 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.21 07:38:40 | 000,002,086 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012.08.21 07:35:59 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.08.21 07:21:08 | 000,001,234 | ---- | M] () -- C:\Users\Admin\Desktop\DriverMax.lnk [2012.08.21 07:08:40 | 000,000,304 | ---- | M] () -- C:\user.js [2012.08.21 04:31:34 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.08.21 01:22:20 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2012.08.21 01:22:20 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [2012.08.21 00:44:40 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.21 00:19:33 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2012.08.21 00:19:33 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf ========== Files Created - No Company Name ========== [2012.09.07 04:00:26 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable [2012.09.05 00:05:52 | 000,001,857 | ---- | C] () -- C:\Users\Admin\Desktop\UseNeXT.lnk [2012.09.03 19:24:56 | 000,023,552 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@ [2012.09.03 19:24:55 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@ [2012.08.24 22:52:57 | 000,001,228 | ---- | C] () -- C:\Users\Public\Desktop\plist Editor for Windows.lnk [2012.08.21 19:51:55 | 000,002,463 | ---- | C] () -- C:\Users\Admin\Desktop\Secret City.lnk [2012.08.21 10:17:09 | 000,000,028 | RH-- | C] () -- C:\Windows\version [2012.08.21 10:16:18 | 000,654,166 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat [2012.08.21 10:16:18 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat [2012.08.21 10:16:18 | 000,130,006 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat [2012.08.21 10:16:18 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat [2012.08.21 07:43:46 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.08.21 07:38:40 | 000,002,098 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk [2012.08.21 07:38:40 | 000,002,086 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012.08.21 07:35:59 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.08.21 07:35:36 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2012.08.21 07:21:08 | 000,001,234 | ---- | C] () -- C:\Users\Admin\Desktop\DriverMax.lnk [2012.08.21 07:16:03 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.21 07:15:53 | 000,001,792 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\00000001.@ [2012.08.21 07:08:40 | 000,000,304 | ---- | C] () -- C:\user.js [2012.08.21 04:38:03 | 000,007,621 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2012.08.21 04:31:34 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.08.21 04:28:21 | 000,008,192 | ---- | C] () -- C:\Windows\SysNative\drivers\IntelMEFWVer.dll [2012.08.21 01:22:20 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2012.08.21 01:22:20 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2012.08.21 01:15:06 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@ [2012.08.21 01:15:06 | 000,002,048 | -HS- | C] () -- C:\Users\Admin\AppData\Local\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@ [2012.08.21 00:44:40 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.21 00:25:59 | 000,057,656 | ---- | C] () -- C:\Windows\SysNative\drivers\FilterPC.bmp [2012.08.21 00:25:59 | 000,024,995 | ---- | C] () -- C:\Windows\SysNative\drivers\FilterPC.jpg [2012.08.21 00:21:41 | 000,001,405 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2012.08.21 00:21:39 | 000,001,439 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.08.21 00:19:27 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2012.08.21 00:19:25 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.08.21 00:17:53 | 4280,672,254 | -HS- | C] () -- C:\hiberfil.sys [2011.11.01 22:39:16 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.11.01 22:39:04 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll ========== LOP Check ========== [2012.08.21 07:08:31 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon [2012.09.03 22:09:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\CadSoft [2012.09.03 21:28:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Dropbox [2012.08.21 07:04:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Easeware [2012.08.21 04:42:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PCDr [2012.08.21 19:53:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Utherverse [2012.08.21 07:08:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\YourFileDownloader [2009.07.14 07:08:49 | 000,005,670 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > [CODE] OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 07.09.2012 04:01:24 - Run 1
OTL by OldTimer - Version 3.2.61.1 Folder = C:\Users\Sebastian\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
15,98 Gb Total Physical Memory | 13,91 Gb Available Physical Memory | 87,01% Memory free
31,96 Gb Paging File | 29,77 Gb Available in Paging File | 93,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 89,33 Gb Total Space | 24,31 Gb Free Space | 27,21% Space Free | Partition Type: NTFS
Drive D: | 298,05 Gb Total Space | 233,84 Gb Free Space | 78,46% Space Free | Partition Type: NTFS
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = AlienAutopsy
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}" = Intel(R) PROSet/Wireless WiFi-Software
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{83BC740C-46AB-E0AD-4B2D-E11C84B472AC}" = AMD Catalyst Install Manager
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 269.03
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 269.03
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 269.03
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 268.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AlienAutopsy" = AlienAutopsy
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{26AFAD40-2FF3-4C75-8903-8D403822C289}" = NVIDIA PhysX
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F722209B-739E-40E4-ADB1-062BD032A0DB}" = Personal ID
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Avira AntiVir Desktop" = Avira Free Antivirus
"DMX5_is1" = DriverMax 6
"EAGLE 6.2.0" = EAGLE 6.2.0
"Foxit Reader_is1" = Foxit Reader
"Integrated Webcam Live! Central" = Integrated Webcam Live! Central
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"plist Editor for Windows" = plist Editor for Windows 1.0.2
"ResourceHacker_is1" = Resource Hacker Version 3.6.0
"Secret City" = Secret City
"UseNeXT_is1" = UseNeXT
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 05.09.2012 06:22:55 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 999
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2325
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2325
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 24718499
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 24718499
Error - 06.09.2012 13:46:15 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description =
Error - 06.09.2012 17:48:13 | Computer Name = Admin-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\innovative solutions\drivermax\DPInst\ia64\dpinst.exe". Die abhängige Assemblierung
"Microsoft.Windows.Common-Controls,language="*",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.09.2012 21:47:18 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc3c1 Name des fehlerhaften Moduls: mshtml.dll, Version: 9.0.8112.16448,
Zeitstempel: 0x4fed329d Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000d789
ID
des fehlerhaften Prozesses: 0xb00 Startzeit der fehlerhaften Anwendung: 0x01cd8c9aa6cff7f7
Pfad
der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften
Moduls: C:\Windows\system32\mshtml.dll Berichtskennung: f45d8597-f88d-11e1-a604-d0df9a41bd64
[ System Events ]
Error - 20.08.2012 18:31:03 | Computer Name = Admin-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.08.2012 19:05:24 | Computer Name = Admin-PC | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error - 20.08.2012 19:39:56 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description =
Error - 20.08.2012 19:42:54 | Computer Name = Admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80242016 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 8 unter
Windows 7 für x64-basierte Systeme (KB2544521)
Error - 20.08.2012 19:42:54 | Computer Name = Admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80242016 fehlgeschlagen: Update für die Kompatibilitätsansichtsliste für
Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845)
Error - 20.08.2012 20:10:28 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description =
Error - 21.08.2012 01:15:52 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description =
Error - 21.08.2012 21:50:52 | Computer Name = Admin-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error - 21.08.2012 23:59:16 | Computer Name = Admin-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error - 04.09.2012 17:57:34 | Computer Name = Admin-PC | Source = DCOM | ID = 10010
Description =
< End of report >
|
|
07.09.2012, 13:05
| #4 | |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
11.09.2012, 15:16
| #5 |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
11.09.2012, 21:02
| #6 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Hallo, hätte gerne früher geaantwortet, aber der PC hat sich nur noch im abgesicherten Modus sarten lassen. Nach Neustart ging das Fenster von ComboFix mehrmals auf und direkt wieder zu. Ich konnte nichts öffnen oder anklicken. Konnte den PC nur mit der Powertaste ausschalten. Ich bin dann irgendwann über den Adminaccount reingegangen in dem ich sonst nie bin. Code:
ATTFilter ComboFix 12-09-11.02 - Admin 11.09.2012 21:40:21.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16366.14394 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\00000001.@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@
.
Infizierte Kopie von c:\windows\system32\services.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-11 bis 2012-09-11 ))))))))))))))))))))))))))))))
.
.
2012-09-11 19:43 . 2012-09-11 19:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-07 03:29 . 2012-09-07 03:29 -------- d-----w- C:\totalcmd
2012-09-07 03:24 . 2012-09-07 03:24 -------- d-----w- c:\program files (x86)\FileZilla FTP Client
2012-09-04 22:05 . 2012-09-04 22:05 -------- d-----w- c:\program files (x86)\UseNeXT
2012-09-04 21:51 . 2012-09-04 21:51 -------- d-----w- c:\program files\WinRAR
2012-09-04 21:14 . 2012-09-04 21:14 -------- d-----w- c:\program files (x86)\Foxit Software
2012-09-03 20:09 . 2012-09-03 20:09 -------- d-----w- c:\program files (x86)\EAGLE-6.2.0
2012-09-03 17:03 . 2012-09-03 17:03 -------- d-----w- c:\programdata\Malwarebytes
2012-08-28 01:53 . 2012-08-28 01:53 -------- d-----w- c:\program files (x86)\Resource Hacker
2012-08-24 20:52 . 2012-08-24 20:52 -------- d-----w- c:\programdata\VOWSoft
2012-08-24 20:52 . 2012-08-24 20:52 -------- d-----w- c:\program files (x86)\iPodRobot
2012-08-22 18:21 . 2012-08-22 18:21 -------- d-----w- c:\programdata\Blizzard Entertainment
2012-08-21 17:54 . 2012-08-21 17:54 -------- d-----w- c:\program files (x86)\coolspot AG
2012-08-21 17:46 . 2012-08-21 17:46 -------- d-----w- c:\program files (x86)\SecretCity 3DChat
2012-08-21 17:46 . 2012-08-21 17:46 -------- d-----w- c:\program files (x86)\Utherverse Digital Inc
2012-08-21 08:17 . 2012-08-20 22:21 -------- d-----w- c:\windows\Panther
2012-08-21 08:17 . 2012-08-21 08:17 -------- d-----w- C:\Hotfix
2012-08-21 08:17 . 2012-08-21 08:17 -------- d-----w- C:\Drivers
2012-08-21 08:17 . 2012-08-20 22:20 -------- d-----w- c:\windows\system32\OEM
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\XPSViewer
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\de
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\0407
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\de-DE
2012-08-21 08:16 . 2012-08-20 23:38 -------- d-----w- c:\windows\SysWow64\wbem\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\de
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\0407
2012-08-21 08:16 . 2012-08-20 23:38 -------- d-----w- c:\windows\system32\wbem\de-DE
2012-08-21 08:14 . 2009-07-14 03:05 3584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2012-08-21 05:46 . 2012-08-21 05:47 -------- d-----w- c:\programdata\Battle.net
2012-08-21 05:42 . 2012-09-03 19:29 -------- d-----w- c:\users\Sebastian
2012-08-21 05:38 . 2012-08-21 05:38 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2012-08-21 05:37 . 2012-08-21 05:37 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2012-08-21 05:33 . 2012-08-21 05:40 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-08-21 05:32 . 2012-07-18 16:04 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-08-21 05:32 . 2012-07-18 16:04 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-08-21 05:32 . 2012-07-18 16:04 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-08-21 05:32 . 2012-08-21 05:32 -------- d-----w- c:\programdata\Avira
2012-08-21 05:32 . 2012-08-21 05:32 -------- d-----w- c:\program files (x86)\Avira
2012-08-21 05:21 . 2012-08-21 05:21 -------- d-----w- c:\program files (x86)\Innovative Solutions
2012-08-21 05:19 . 2012-08-21 05:19 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-08-21 05:16 . 2012-08-21 06:17 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-21 05:16 . 2012-08-21 06:17 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-21 05:16 . 2012-08-21 05:16 -------- d-----w- c:\windows\SysWow64\Macromed
2012-08-21 05:16 . 2012-08-21 05:16 -------- d-----w- c:\windows\system32\Macromed
2012-08-21 04:51 . 2011-12-06 13:55 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2012-08-21 02:43 . 2012-08-21 02:43 -------- d-----w- c:\programdata\PCDr
2012-08-21 02:43 . 2012-08-21 02:43 -------- d-----w- c:\program files\AlienAutopsy
2012-08-21 02:39 . 2012-09-11 19:56 -------- d-----w- c:\programdata\NVIDIA
2012-08-21 02:35 . 2012-08-21 05:35 -------- dc----w- c:\windows\system32\DRVSTORE
2012-08-21 02:35 . 2010-08-20 09:05 21616 ----a-w- c:\windows\system32\drivers\stdcfltn.sys
2012-08-21 02:34 . 2012-08-21 02:34 -------- d-----w- c:\program files\STMicroelectronics
2012-08-21 02:31 . 2012-08-21 02:31 -------- d-----w- c:\program files\Synaptics
2012-08-21 02:31 . 2011-03-30 13:12 215336 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-08-21 02:31 . 2011-03-30 13:12 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-08-21 02:31 . 2011-03-30 13:12 148264 ----a-w- c:\windows\system32\SynTPCo4.dll
2012-08-21 02:31 . 2011-03-30 13:12 1395760 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-08-21 02:31 . 2011-03-30 13:12 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12 400168 ----a-w- c:\windows\system32\SynCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12 273704 ----a-w- c:\windows\system32\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12 218408 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-08-21 02:30 . 2011-03-03 15:23 81008 ----a-w- c:\windows\system32\accelernco01.dll
2012-08-21 02:30 . 2011-03-03 15:23 27760 ----a-w- c:\windows\system32\drivers\Accelern.sys
2012-08-21 02:28 . 2011-03-03 14:48 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
2012-08-21 02:28 . 2012-08-21 02:28 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2012-08-21 02:28 . 2012-08-21 04:51 -------- d-----w- c:\program files (x86)\Intel
2012-08-21 02:27 . 2011-03-03 15:07 9888360 ----a-w- c:\windows\SysWow64\RtsPStorIcon.dll
2012-08-21 02:27 . 2011-03-03 15:07 335464 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2012-08-20 23:51 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-08-20 23:51 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-08-20 23:51 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-08-20 23:49 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-08-20 23:49 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-08-20 23:43 . 2012-08-20 23:43 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-08-20 23:30 . 2012-07-16 00:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{47679C7B-1F12-4896-8E81-30BF787E5E37}\mpengine.dll
2012-08-20 23:23 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-08-20 23:18 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-08-20 23:18 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-08-20 23:18 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-08-20 23:18 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-08-20 23:18 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-08-20 23:17 . 2012-08-03 02:27 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-08-20 23:15 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-08-20 23:15 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-08-20 23:13 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-08-20 23:13 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-08-20 23:10 . 2012-08-20 23:10 -------- d-----w- c:\windows\SysWow64\Atheros_L1e
2012-08-20 23:10 . 2011-03-03 15:02 76912 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files (x86)\AMD APP
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- C:\Intel
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files\ATI
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files\ATI Technologies
2012-08-20 22:49 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-08-20 22:47 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-08-20 22:47 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-08-20 22:47 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-08-20 22:47 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-08-20 22:47 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-08-20 22:47 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-08-20 22:47 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-08-20 22:47 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-08-20 22:47 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-08-20 22:46 . 2012-08-20 22:46 -------- d-----w- c:\users\Public\Roaming
2012-08-20 22:46 . 2012-08-20 22:46 -------- d-----w- c:\users\Default\Roaming
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files\Common Files\Intel
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files (x86)\Cisco
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\programdata\Intel
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files\Intel
2012-08-20 22:45 . 2012-09-07 03:32 -------- d-sh--w- c:\windows\Installer
2012-08-20 22:44 . 2012-08-20 22:44 -------- d-----w- C:\dell
2012-08-20 22:25 . 2012-08-20 22:25 -------- d-----w- c:\program files (x86)\Creative
2012-08-20 22:24 . 2012-08-20 22:24 -------- d-----w- c:\program files (x86)\Integrated Webcam
2012-08-20 22:24 . 2010-06-07 14:45 174848 ----a-w- c:\windows\system32\drivers\CtClsFlt.sys
2012-08-20 22:24 . 2009-05-28 08:49 224768 ----a-w- c:\windows\system32\drivers\CtAudDrv.sys
2012-08-20 22:24 . 2012-08-20 22:24 -------- d-----w- c:\program files (x86)\Creative Live! Cam
2012-08-20 22:23 . 2012-08-21 02:38 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2012-08-20 22:23 . 2012-08-20 22:23 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2012-07-31 11324352]
"Personal ID"="c:\progra~2\COOLSP~1\PERSON~1\PID.EXE" [2012-08-21 1132984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Integrated Webcam Live! Central"="c:\program files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" [2010-08-11 487561]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-03-03 2656280]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 250056]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-06-07 174848]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-01-05 340240]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-06-26 378472]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2011-03-03 27760]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-03 76912]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-01-04 8507392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-07-05 174184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-03 335464]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 06:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-06-26 315496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fdlo2jvk.default\
.
Supplementary scan did not complete!
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
Wow6432Node-HKCU-Run-DriverMax_RESTART - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-11 21:57:42 - PC wurde neu gestartet
.
Vor Suchlauf: 13 Verzeichnis(se), 25.722.769.408 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 27.402.240.000 Bytes frei
.
- - End Of File - - A4B70E3B952B44FC00FA2C1A41C936B1
Geändert von dalyay (11.09.2012 um 21:10 Uhr) |
|
12.09.2012, 14:46
| #7 | ||
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Zitat:
Zitat:
 Geht der Normalmodus wieder ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
12.09.2012, 16:40
| #8 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Ja, der normal modus geht wieder. habe combofix jetzt nochmal vom Desktop ausgeführt. Code:
ATTFilter ComboFix 12-09-12.02 - Admin 12.09.2012 17:33:18.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16366.14306 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-12 bis 2012-09-12 ))))))))))))))))))))))))))))))
.
.
2012-09-12 15:36 . 2012-09-12 15:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-11 20:23 . 2012-09-11 20:49 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2012-09-07 03:29 . 2012-09-07 03:29 -------- d-----w- C:\totalcmd
2012-09-07 03:24 . 2012-09-07 03:24 -------- d-----w- c:\program files (x86)\FileZilla FTP Client
2012-09-04 22:05 . 2012-09-04 22:05 -------- d-----w- c:\program files (x86)\UseNeXT
2012-09-04 21:51 . 2012-09-04 21:51 -------- d-----w- c:\program files\WinRAR
2012-09-04 21:14 . 2012-09-04 21:14 -------- d-----w- c:\program files (x86)\Foxit Software
2012-09-03 20:09 . 2012-09-03 20:09 -------- d-----w- c:\program files (x86)\EAGLE-6.2.0
2012-09-03 17:03 . 2012-09-03 17:03 -------- d-----w- c:\programdata\Malwarebytes
2012-08-28 01:53 . 2012-08-28 01:53 -------- d-----w- c:\program files (x86)\Resource Hacker
2012-08-24 20:52 . 2012-08-24 20:52 -------- d-----w- c:\programdata\VOWSoft
2012-08-24 20:52 . 2012-08-24 20:52 -------- d-----w- c:\program files (x86)\iPodRobot
2012-08-22 18:21 . 2012-08-22 18:21 -------- d-----w- c:\programdata\Blizzard Entertainment
2012-08-21 17:54 . 2012-08-21 17:54 -------- d-----w- c:\program files (x86)\coolspot AG
2012-08-21 17:46 . 2012-08-21 17:46 -------- d-----w- c:\program files (x86)\SecretCity 3DChat
2012-08-21 17:46 . 2012-08-21 17:46 -------- d-----w- c:\program files (x86)\Utherverse Digital Inc
2012-08-21 08:17 . 2012-08-20 22:21 -------- d-----w- c:\windows\Panther
2012-08-21 08:17 . 2012-08-21 08:17 -------- d-----w- C:\Hotfix
2012-08-21 08:17 . 2012-08-21 08:17 -------- d-----w- C:\Drivers
2012-08-21 08:17 . 2012-08-20 22:20 -------- d-----w- c:\windows\system32\OEM
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\XPSViewer
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\de
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\SysWow64\0407
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\de-DE
2012-08-21 08:16 . 2012-08-20 23:38 -------- d-----w- c:\windows\SysWow64\wbem\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\de
2012-08-21 08:16 . 2012-08-21 08:16 -------- d-----w- c:\windows\system32\0407
2012-08-21 08:16 . 2012-08-20 23:38 -------- d-----w- c:\windows\system32\wbem\de-DE
2012-08-21 08:14 . 2009-07-14 03:05 3584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2012-08-21 05:46 . 2012-08-21 05:47 -------- d-----w- c:\programdata\Battle.net
2012-08-21 05:42 . 2012-09-03 19:29 -------- d-----w- c:\users\Sebastian
2012-08-21 05:38 . 2012-08-21 05:38 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2012-08-21 05:37 . 2012-08-21 05:37 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2012-08-21 05:33 . 2012-08-21 05:40 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-08-21 05:32 . 2012-07-18 16:04 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-08-21 05:32 . 2012-07-18 16:04 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-08-21 05:32 . 2012-07-18 16:04 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-08-21 05:32 . 2012-08-21 05:32 -------- d-----w- c:\programdata\Avira
2012-08-21 05:32 . 2012-08-21 05:32 -------- d-----w- c:\program files (x86)\Avira
2012-08-21 05:21 . 2012-08-21 05:21 -------- d-----w- c:\program files (x86)\Innovative Solutions
2012-08-21 05:19 . 2012-08-21 05:19 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-08-21 05:16 . 2012-08-21 06:17 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-21 05:16 . 2012-08-21 06:17 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-21 05:16 . 2012-08-21 05:16 -------- d-----w- c:\windows\SysWow64\Macromed
2012-08-21 05:16 . 2012-08-21 05:16 -------- d-----w- c:\windows\system32\Macromed
2012-08-21 04:51 . 2011-12-06 13:55 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2012-08-21 02:43 . 2012-08-21 02:43 -------- d-----w- c:\programdata\PCDr
2012-08-21 02:43 . 2012-08-21 02:43 -------- d-----w- c:\program files\AlienAutopsy
2012-08-21 02:39 . 2012-09-12 15:29 -------- d-----w- c:\programdata\NVIDIA
2012-08-21 02:35 . 2012-08-21 05:35 -------- dc----w- c:\windows\system32\DRVSTORE
2012-08-21 02:35 . 2010-08-20 09:05 21616 ----a-w- c:\windows\system32\drivers\stdcfltn.sys
2012-08-21 02:34 . 2012-08-21 02:34 -------- d-----w- c:\program files\STMicroelectronics
2012-08-21 02:31 . 2012-08-21 02:31 -------- d-----w- c:\program files\Synaptics
2012-08-21 02:31 . 2011-03-30 13:12 215336 ----a-w- c:\windows\system32\SynTPAPI.dll
2012-08-21 02:31 . 2011-03-30 13:12 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2012-08-21 02:31 . 2011-03-30 13:12 148264 ----a-w- c:\windows\system32\SynTPCo4.dll
2012-08-21 02:31 . 2011-03-30 13:12 1395760 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-08-21 02:31 . 2011-03-30 13:12 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12 400168 ----a-w- c:\windows\system32\SynCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12 273704 ----a-w- c:\windows\system32\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12 218408 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12 173352 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-08-21 02:30 . 2011-03-03 15:23 81008 ----a-w- c:\windows\system32\accelernco01.dll
2012-08-21 02:30 . 2011-03-03 15:23 27760 ----a-w- c:\windows\system32\drivers\Accelern.sys
2012-08-21 02:28 . 2011-03-03 14:48 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
2012-08-21 02:28 . 2012-08-21 02:28 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2012-08-21 02:28 . 2012-08-21 04:51 -------- d-----w- c:\program files (x86)\Intel
2012-08-21 02:27 . 2011-03-03 15:07 9888360 ----a-w- c:\windows\SysWow64\RtsPStorIcon.dll
2012-08-21 02:27 . 2011-03-03 15:07 335464 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2012-08-20 23:51 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-08-20 23:51 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-08-20 23:51 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-08-20 23:49 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-08-20 23:49 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-08-20 23:43 . 2012-08-20 23:43 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-08-20 23:30 . 2012-07-16 00:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{47679C7B-1F12-4896-8E81-30BF787E5E37}\mpengine.dll
2012-08-20 23:23 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-08-20 23:18 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-08-20 23:18 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-08-20 23:18 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-08-20 23:18 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-08-20 23:18 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-08-20 23:17 . 2012-08-03 02:27 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-08-20 23:15 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-08-20 23:15 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-08-20 23:13 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-08-20 23:13 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-08-20 23:10 . 2012-08-20 23:10 -------- d-----w- c:\windows\SysWow64\Atheros_L1e
2012-08-20 23:10 . 2011-03-03 15:02 76912 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files (x86)\AMD APP
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- C:\Intel
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files\ATI
2012-08-20 23:08 . 2012-08-20 23:08 -------- d-----w- c:\program files\ATI Technologies
2012-08-20 22:49 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-08-20 22:47 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-08-20 22:47 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-08-20 22:47 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-08-20 22:47 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-08-20 22:47 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-08-20 22:47 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-08-20 22:47 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-08-20 22:47 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-08-20 22:47 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-08-20 22:46 . 2012-08-20 22:46 -------- d-----w- c:\users\Public\Roaming
2012-08-20 22:46 . 2012-08-20 22:46 -------- d-----w- c:\users\Default\Roaming
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files\Common Files\Intel
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files (x86)\Cisco
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\programdata\Intel
2012-08-20 22:45 . 2012-08-20 22:45 -------- d-----w- c:\program files\Intel
2012-08-20 22:45 . 2012-09-07 03:32 -------- d-sh--w- c:\windows\Installer
2012-08-20 22:44 . 2012-08-20 22:44 -------- d-----w- C:\dell
2012-08-20 22:25 . 2012-08-20 22:25 -------- d-----w- c:\program files (x86)\Creative
2012-08-20 22:24 . 2012-08-20 22:24 -------- d-----w- c:\program files (x86)\Integrated Webcam
2012-08-20 22:24 . 2010-06-07 14:45 174848 ----a-w- c:\windows\system32\drivers\CtClsFlt.sys
2012-08-20 22:24 . 2009-05-28 08:49 224768 ----a-w- c:\windows\system32\drivers\CtAudDrv.sys
2012-08-20 22:24 . 2012-08-20 22:24 -------- d-----w- c:\program files (x86)\Creative Live! Cam
2012-08-20 22:23 . 2012-08-21 02:38 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2012-07-31 11324352]
"Personal ID"="c:\progra~2\COOLSP~1\PERSON~1\PID.EXE" [2012-08-21 1132984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Integrated Webcam Live! Central"="c:\program files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" [2010-08-11 487561]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 250056]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-06-07 174848]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-01-05 340240]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-06-26 378472]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-03-03 2656280]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2011-03-03 27760]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-03 76912]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-01-04 8507392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-07-05 174184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-03 335464]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 06:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-06-26 315496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fdlo2jvk.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-09-12 17:37:28
ComboFix-quarantined-files.txt 2012-09-12 15:37
ComboFix2.txt 2012-09-11 19:57
.
Vor Suchlauf: 13 Verzeichnis(se), 33.580.015.616 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 33.153.294.336 Bytes frei
.
- - End Of File - - 87FFA5CD75DA4419DFB7454E8DCD866C
|
|
12.09.2012, 21:00
| #9 |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Downloade dir bitte Farbar's Service Scanner Gehe sicher, dass folgende Optionen angehakt sind.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
12.09.2012, 23:37
| #10 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Code:
ATTFilter Farbar Service Scanner Version: 06-08-2012
Ran by Sebastian (ATTENTION: The logged in user is not administrator) on 13-09-2012 at 00:35:20
Running from "C:\Users\Sebastian\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.
Nsi Service is not running. Checking service configuration:
The start type of Nsi service is OK.
The ImagePath of Nsi service is OK.
Checking ServiceDll: ATTENTION!=====> Unable to open Nsi registry key. The service key does not exist.
nsiproxy Service is not running. Checking service configuration:
The start type of nsiproxy service is OK.
The ImagePath of nsiproxy service is OK.
tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx service is OK.
afd Service is not running. Checking service configuration:
The start type of afd service is OK.
The ImagePath of afd service is OK.
Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.
bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.
Firewall Disabled Policy:
==================
System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.
VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.
System Restore Disabled Policy:
========================
Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
winmgmt Service is not running. Checking service configuration:
The start type of winmgmt service is OK.
The ImagePath of winmgmt: "%systemroot%\system32\svchost.exe -k netsvcs".
The ServiceDll of winmgmt service is OK.
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.
EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.
cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
PlugPlay Service is not running. Checking service configuration:
The start type of PlugPlay service is OK.
The ImagePath of PlugPlay service is OK.
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
|
|
13.09.2012, 14:30
| #11 |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Downloade dir bitte ServiceRepair.exe auf deinem Desktop. Doppelklick auf die Datei und bestätige die ersten Nachricht mit Yes. Das Tool wird einen Neustart verlangen, dies bitte zulassen. Bitte lass FSS.exe erneut wie vorher laufen und poste die FSS.txt hier
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
13.09.2012, 19:46
| #12 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Code:
ATTFilter Farbar Service Scanner Version: 06-08-2012
Ran by Sebastian (ATTENTION: The logged in user is not administrator) on 13-09-2012 at 20:40:55
Running from "C:\Users\Sebastian\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.
Nsi Service is not running. Checking service configuration:
The start type of Nsi service is OK.
The ImagePath of Nsi service is OK.
Checking ServiceDll: ATTENTION!=====> Unable to open Nsi registry key. The service key does not exist.
nsiproxy Service is not running. Checking service configuration:
The start type of nsiproxy service is OK.
The ImagePath of nsiproxy service is OK.
tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx service is OK.
afd Service is not running. Checking service configuration:
The start type of afd service is OK.
The ImagePath of afd service is OK.
Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.
bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.
Firewall Disabled Policy:
==================
System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.
VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.
System Restore Disabled Policy:
========================
Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
winmgmt Service is not running. Checking service configuration:
The start type of winmgmt service is OK.
The ImagePath of winmgmt: "%systemroot%\system32\svchost.exe -k netsvcs".
The ServiceDll of winmgmt service is OK.
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.
EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.
cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
PlugPlay Service is not running. Checking service configuration:
The start type of PlugPlay service is OK.
The ImagePath of PlugPlay service is OK.
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2012-09-12 21:14] - [2012-08-22 20:12] - 1913200 ____A (Microsoft Corporation) F782CAD3CEDBB3F9FFE3BF2775D92DDC
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Code:
ATTFilter Log Opened: 2012-09-13 @ 20:41:13
20:41:13 - -----------------
20:41:13 - | Begin Logging |
20:41:13 - -----------------
20:41:13 - Fix started on a WIN_7 X64 computer
20:41:13 - Prep in progress. Please Wait.
20:41:14 - Prep complete
20:41:14 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo\{FA88062C-9A61-4C1E-AC45-7143F8F01AAD}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap\{8AD2FB26-F91E-44F1-9B24-3C0AE56C9CE0}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\IPHTTPS>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\DHCP>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch2>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo\0>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>
SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>
SetACL finished successfully.
20:41:14 - Services Repair Complete.
20:41:48 - Reboot Initiated
Geändert von dalyay (13.09.2012 um 19:54 Uhr) |
|
16.09.2012, 16:39
| #13 |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Hy und sorry für die Verzögerung. Starte bitte die FSS.exe erneut. Gib bitte folgendes in die Search: Textbox ein nsi und klicke auf Export Service. Poste bitte die FSS.txt in deiner nächsten Antwort.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
17.09.2012, 17:51
| #14 |
| | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?Code:
ATTFilter Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\nsi]
"DisplayName"="@%SystemRoot%\\system32\\nsisvc.dll,-200"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,00,00
"Description"="@%SystemRoot%\\system32\\nsisvc.dll,-201"
"ObjectName"="NT Authority\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):6e,00,73,00,69,00,70,00,72,00,6f,00,78,00,79,00,00,00,\
00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\
00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
|
|
17.09.2012, 18:15
| #15 |
| /// Selecta Jahrusso | tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? Downloade dir bitte folgende Datei auf deinem Desktop. http://download.bleepingcomputer.com...ices/7/nsi.reg Doppelklick darauf und erlaube die Änderungen in der Registry. Starte den Rechner neu auf. Erstelle bitte eine neue FSS.txt wie zuvor und poste diese hier.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
| Themen zu tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? |
| action, anti-malware, antivir, code, detected, disabled, explorer, file, hoffe, installer, kleines, limited, log, malicious, malwarebytes, namen, quarantäne, quick, registry, service, startup, system, tr/atraps.gen, version, weiteres |
Linear-Darstellung
