| |
| |||||||
Log-Analyse und Auswertung: Nach Browsen im Web automatischer Neustart -> Black screen, keine Taskbar, "1.exe"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.09.2012, 18:33
| #1 |
| |  Nach Browsen im Web automatischer Neustart -> Black screen, keine Taskbar, "1.exe" Hallo! Ich war vorhin wohl auf einer nicht ganz so sicheren Seite unterwegs, als die HDD plötzlich wie verrückt anfing zu arbeiten. Dann schlossen sich alle Programme während sich Avira Antivir noch "beschwerte", dass eine Registryänderung verhindert wurde. Dann wurde von alleine neugestartet. Ich ging direkt in den abgesicherten Modus. Auch dort war nur ein schwarzer Bildschirm und meine Maus; der Rechtsklick war jedoch deaktiviert. Bin dann erstmal in Taskmanager und hab msconfig angemacht. Dort war ein Prozess mit dem Namen "Ja" und der Datei "C:\Users\...\AppData\Roaming\1.exe" eingetragen worden, welcher sich aber nicht deaktivieren lies. Hab die Datei erstmal gelöscht und Avira Antivir gestartet, welches aber nichts fand. Ein anderes Malware Programm (Malwarebytes Anti Malware) fand dann den Registry Eintrag, der für den deaktivierten Rechtsklick verantwortlich war. Spybot S&D fand dann nur noch irgendwelche bösen Cookies. Beide Programme hatte ich nach dem Befall dann installiert. Aber das Problem bleibt: Ich mach den PC an, logge mich bei Windows ein und habe nur einen schwarzen Bildschirm ohne Taskbar (welche auch nicht erscheint, wenn ich den Explorer über den TaskManager starte). Ich will garnicht wissen, was noch alles verändert wurde... Dies alles geschah heute um 16:05. Ich hoffe, ich habe den Tathergang Protokoll gerecht wiedergegeben  Bei OTL.exe kommt irgendwann nen Fehler ("List index out of bounds (21)") und es gibt keine Extras.txt. Hier ist dafür die OTL.txt.... Liebe Grüße und Danke im Voraus, Nico Code:
ATTFilter OTL logfile created on: 10.09.2012 19:24:42 - Run 1 OTL by OldTimer - Version 3.2.61.3 Folder = D:\ 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 63,28% Memory free 7,93 Gb Paging File | 6,44 Gb Available in Paging File | 81,21% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 45,00 Gb Total Space | 9,85 Gb Free Space | 21,88% Space Free | Partition Type: NTFS Drive D: | 245,20 Gb Total Space | 0,76 Gb Free Space | 0,31% Space Free | Partition Type: NTFS Drive E: | 6,72 Gb Total Space | 1,03 Gb Free Space | 15,33% Space Free | Partition Type: NTFS Drive I: | 4,99 Gb Total Space | 0,04 Gb Free Space | 0,88% Space Free | Partition Type: FAT32 Computer Name: NICOLAP | User Name: Nico | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.10 19:03:46 | 000,600,064 | ---- | M] (OldTimer Tools) -- D:\OTL.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.05.08 12:24:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.08 12:24:43 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe PRC - [2009.09.04 13:28:16 | 000,242,976 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe PRC - [2009.09.04 13:28:12 | 000,124,192 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe PRC - [2009.08.28 15:09:58 | 001,019,904 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe PRC - [2009.08.07 06:29:36 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2009.07.03 11:47:10 | 000,045,424 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\micmute.exe PRC - [2009.05.21 13:48:18 | 000,062,320 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe PRC - [2009.03.05 10:23:28 | 000,052,600 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tpnumlkd.exe PRC - [2009.03.05 09:28:28 | 000,059,760 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\tpnumlk.exe PRC - [2009.01.26 15:31:12 | 005,365,592 | RHS- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2007.01.04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe ========== Modules (No Company Name) ========== MOD - [2008.06.19 17:35:36 | 000,333,288 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy\sqlite3.dll MOD - [2008.03.05 09:34:32 | 000,795,520 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy\Plugins\Fennel.dll MOD - [2008.03.04 14:52:00 | 000,790,392 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy\Plugins\Chai.dll MOD - [2008.02.26 11:04:40 | 000,717,176 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy\Plugins\Mate.dll MOD - [2007.12.24 01:05:00 | 000,121,344 | ---- | M] () -- C:\Program Files (x86)\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll ========== Services (SafeList) ========== SRV:64bit: - [2011.08.11 12:20:42 | 000,045,928 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:64bit: - [2009.07.29 16:03:42 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.06.29 14:51:04 | 000,047,656 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC) SRV - [2012.08.15 08:42:34 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.05.08 12:24:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.08 12:24:43 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7) SRV - [2011.11.01 14:37:56 | 001,518,352 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2011.11.01 14:22:28 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService) SRV - [2011.04.07 17:37:16 | 005,352,960 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.09.04 13:28:16 | 000,242,976 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc) SRV - [2009.09.04 13:28:12 | 000,124,192 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc) SRV - [2009.08.28 15:09:58 | 001,019,904 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service) SRV - [2009.08.23 20:04:00 | 000,075,040 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE -- (Power Manager DBC Service) SRV - [2009.08.07 06:29:36 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) SRV - [2009.08.04 22:36:56 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10) SRV - [2009.08.04 22:36:46 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10) SRV - [2009.08.04 22:33:46 | 000,309,744 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10) SRV - [2009.08.04 22:33:34 | 000,166,384 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10) SRV - [2009.08.04 22:32:42 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10) SRV - [2009.07.03 11:47:10 | 000,045,424 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV - [2009.07.01 19:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.05.21 13:48:18 | 000,062,320 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC) SRV - [2007.01.04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.06.02 20:40:23 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.05.08 12:24:44 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.08 12:24:44 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.10.31 16:57:50 | 008,615,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.09.16 17:09:16 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.08.11 12:20:42 | 000,039,024 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.29 17:26:38 | 000,040,512 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.04.23 01:17:40 | 000,318,000 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.11.27 18:45:06 | 000,295,424 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.09.15 20:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) DRV:64bit: - [2009.08.23 20:04:00 | 000,013,104 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF) DRV:64bit: - [2009.08.07 06:24:14 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.08.03 03:33:08 | 007,058,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw1v64.sys -- (NETw1v64) DRV:64bit: - [2009.07.30 02:11:24 | 006,038,016 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009.07.09 04:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009.06.29 14:51:02 | 000,133,672 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf) DRV:64bit: - [2009.06.29 14:51:00 | 000,023,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN) DRV:64bit: - [2009.06.24 11:23:24 | 000,205,472 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService) DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92) DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac) DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA) DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 07:23:42 | 000,143,320 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR) DRV:64bit: - [2008.05.12 11:04:26 | 000,015,400 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi) DRV - [2009.08.18 08:06:50 | 000,023,536 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Programme\PC-Doctor\pcdsrvc_x64.pkms -- (PCDSRVC{184E4FA0-DE8C26D4-06000000}_0) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9AF1CCF1-4773-45A5-BD19-1A9BF7711941} IE:64bit: - HKLM\..\SearchScopes\{9AF1CCF1-4773-45A5-BD19-1A9BF7711941}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {484E9539-7E80-4EA8-AB26-B369D70D0D03} IE - HKLM\..\SearchScopes\{484E9539-7E80-4EA8-AB26-B369D70D0D03}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox; IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {9AF1CCF1-4773-45A5-BD19-1A9BF7711941} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) [2012.09.10 16:40:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions O1 HOSTS File: ([2012.09.10 17:39:59 | 000,250,010 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activation.guitar-pro.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.1001-search.info O1 - Hosts: 127.0.0.1 1001-search.info O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.123topsearch.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 127.0.0.1 136136.net O1 - Hosts: 8710 more lines... O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [LENOVO.TPFNF6R] C:\Programme\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [TPHOTKEY] C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Message Center Plus] C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe () O4 - HKLM..\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor File not found O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe (Sonic Solutions) O4 - HKCU..\Run: [ICQ] D:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Nico\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{261C3D8B-3DC8-49E1-AF6A-40B2D95471DF}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B72E2EA6-CBB5-4C4B-A2F5-6D2FF8CC864F}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (C:\Users\Nico\AppData\Roaming\1.exe) - C:\Users\Nico\AppData\Roaming\1.exe () O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O31 - SafeBoot: AlternateShell - C:\Users\Nico\AppData\Roaming\1.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.06.10 18:32:46 | 000,000,049 | -HS- | M] () - D:\AUTORUN.INF -- [ NTFS ] O32 - AutoRun File - [2008.06.10 18:32:46 | 000,000,049 | -HS- | M] () - E:\AUTORUN.INF -- [ NTFS ] O33 - MountPoints2\{6a236b0b-aa8f-11e1-960c-00269ee4297e}\Shell - "" = AutoRun O33 - MountPoints2\{6a236b0b-aa8f-11e1-960c-00269ee4297e}\Shell\AutoRun\command - "" = G:\start.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.10 17:32:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2012.09.10 17:32:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.09.10 17:32:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2012.09.10 16:52:21 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Malwarebytes [2012.09.10 16:52:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.10 16:52:05 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.09.10 16:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.09.10 16:52:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.09.10 16:40:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Mozilla [2012.09.10 16:40:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\Mozilla [2012.09.10 16:32:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\ATI [2012.09.10 16:32:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\ATI [2012.09.10 16:11:51 | 000,000,000 | ---D | C] -- C:\Windows\pss [2012.09.10 11:08:00 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{54526C4D-6734-44DB-864C-8AFED1CFF2B0} [2012.09.09 17:22:34 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{46090F99-2975-4EDC-B867-47F60509839A} [2012.09.08 14:20:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{08A88612-FE97-426E-845E-8E8B1B7C5724} [2012.09.07 16:48:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{A5CA64DE-A0E4-48DF-ADD0-DF8B3C7BE132} [2012.08.20 02:16:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{BBE962D2-D1CE-4474-86AF-8621C1F808AC} [2012.08.20 00:53:46 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2012.08.20 00:52:57 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Dropbox [2012.08.19 14:15:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B4E75174-3929-4C39-B0DA-26B99BD99E2E} [2012.08.19 01:49:13 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{A0252A25-BDEC-4E7A-9A3D-8C1B7A2D6CA6} [2012.08.19 01:48:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{3D5AB4D4-9EB6-4192-BFBD-C0B3A02FB219} [2012.08.18 12:00:54 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0C109D5F-A6F5-4E6F-946E-FB9C82000F9F} [2012.08.18 12:00:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{CF1EC915-A7B5-4AD6-8FAD-765A99471618} [2012.08.18 00:00:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{A41A41AD-4475-4303-9289-A6D171959BD4} [2012.08.17 23:59:55 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F9B1A94B-8912-44A3-A71D-51BC1893B00E} [2012.08.17 11:59:29 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B60B027D-19B5-4184-9F20-C9647B2D7FAE} [2012.08.17 11:59:06 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{3141FD8C-406C-4FDD-8D9F-74665C3CF2E8} [2012.08.16 23:58:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{77B20142-8591-4111-B523-ABA48F51B71C} [2012.08.16 23:58:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D5F698FB-CAFC-4C66-8E52-07FE2AFA92FC} [2012.08.16 11:58:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B8E4D64E-8F29-4579-9003-8DAC5AD60DEB} [2012.08.16 11:57:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{51F4C585-03B3-4485-A94A-659C63D3C3B6} [2012.08.15 21:24:41 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{55FF6BA8-4914-4BA9-8706-B3A58F170F47} [2012.08.15 21:24:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D7D87990-436C-4F7C-B18B-5A4E2B1E4F64} [2012.08.15 09:23:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B119FAA8-6FEF-4147-82A5-704BDE42037C} [2012.08.15 09:23:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7844F7F7-AD95-45E6-9001-F3C757CE2F64} [2012.08.14 12:12:37 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F7D96B65-F5D9-4567-995E-B8B3A7BE4C02} [2012.08.14 12:12:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E2E19D45-D685-498A-BB45-6D2885CBA736} [2012.08.13 15:40:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{44DAE16B-634D-4ABB-A915-E06CEEC69F4D} [2012.08.13 15:40:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{5FDCB759-F0AD-4593-912F-7A1B4143412B} [2012.08.13 03:07:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{72CD9AE4-3FE9-4F69-97DD-F1CD245E44D8} [2012.08.13 03:06:55 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{3412E83D-C2E4-45AD-8A9F-08F8FE4682D1} [2012.08.12 15:06:15 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EC194284-27DB-45E4-9A32-5C947A087A04} [2012.08.12 15:05:52 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FD7E8791-63AD-40C9-ABCA-89992E02E376} ========== Files - Modified Within 30 Days ========== [2012.09.10 19:10:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.10 19:07:19 | 000,000,168 | ---- | M] () -- C:\Users\Nico\defogger_reenable [2012.09.10 19:01:02 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.10 19:01:02 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.10 18:51:50 | 3193,589,760 | -HS- | M] () -- C:\hiberfil.sys [2012.09.10 17:39:59 | 000,250,010 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2012.09.10 17:32:14 | 000,001,273 | ---- | M] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk [2012.09.10 16:52:06 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.10 01:21:52 | 023,407,420 | ---- | M] () -- C:\Users\Nico\Desktop\Maxim Vengerov plays Tambourin Chinois, Op. 3.flv [2012.08.20 09:56:00 | 006,542,868 | ---- | M] () -- C:\Users\Nico\Desktop\easy1.ogg [2012.08.20 00:54:56 | 000,001,011 | ---- | M] () -- C:\Users\Nico\Desktop\Dropbox.lnk [2012.08.20 00:53:55 | 000,001,021 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012.08.19 23:26:51 | 000,522,855 | ---- | M] () -- C:\Users\Nico\Desktop\tumblr_m8z4gcThN51qf2pkdo1_500.gif [2012.08.19 18:59:58 | 000,049,064 | ---- | M] () -- C:\Users\Nico\Desktop\anim_809dce16-f872-bdf4-852c-dbf1ab80f35f.gif [2012.08.19 18:57:19 | 000,018,044 | ---- | M] () -- C:\Users\Nico\Desktop\mitt-romney-logo2.jpg [2012.08.19 18:50:16 | 000,010,846 | ---- | M] () -- C:\Users\Nico\Desktop\mitt-romney-logo.jpg [2012.08.19 18:49:27 | 000,027,029 | ---- | M] () -- C:\Users\Nico\Desktop\romney20logo.jpg [2012.08.19 16:41:09 | 025,289,343 | ---- | M] () -- C:\Users\Nico\Desktop\Aula de Caixa Samba Carioca parte 1.mp4 [2012.08.18 11:58:48 | 000,475,987 | ---- | M] () -- C:\Users\Nico\Desktop\gerollte teigrolle.jpg [2012.08.18 01:57:41 | 030,410,043 | ---- | M] () -- C:\Users\Nico\Desktop\Maxim Vengerov - Masterclass.3gp [2012.08.18 01:37:57 | 000,091,692 | ---- | M] () -- C:\Users\Nico\Desktop\untermiete nicolai bülow.pdf [2012.08.18 01:37:33 | 000,023,764 | ---- | M] () -- C:\Users\Nico\Desktop\20100312140519_untermiete.odt [2012.08.17 15:47:25 | 000,337,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.15 23:51:43 | 000,011,040 | ---- | M] () -- C:\Users\Nico\Desktop\wg.ods [2012.08.14 01:30:02 | 000,031,143 | ---- | M] () -- C:\Users\Nico\Desktop\smn_73440a.png [2012.08.12 20:00:00 | 000,000,452 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job ========== Files Created - No Company Name ========== [2012.09.10 19:07:19 | 000,000,168 | ---- | C] () -- C:\Users\Nico\defogger_reenable [2012.09.10 18:51:22 | 000,001,021 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012.09.10 18:51:22 | 000,000,890 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2012.09.10 17:32:14 | 000,001,273 | ---- | C] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk [2012.09.10 16:52:06 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.10 01:21:35 | 023,407,420 | ---- | C] () -- C:\Users\Nico\Desktop\Maxim Vengerov plays Tambourin Chinois, Op. 3.flv [2012.08.20 09:55:39 | 006,542,868 | ---- | C] () -- C:\Users\Nico\Desktop\easy1.ogg [2012.08.20 00:54:56 | 000,001,011 | ---- | C] () -- C:\Users\Nico\Desktop\Dropbox.lnk [2012.08.19 23:26:51 | 000,522,855 | ---- | C] () -- C:\Users\Nico\Desktop\tumblr_m8z4gcThN51qf2pkdo1_500.gif [2012.08.19 18:59:58 | 000,049,064 | ---- | C] () -- C:\Users\Nico\Desktop\anim_809dce16-f872-bdf4-852c-dbf1ab80f35f.gif [2012.08.19 18:57:19 | 000,018,044 | ---- | C] () -- C:\Users\Nico\Desktop\mitt-romney-logo2.jpg [2012.08.19 18:49:47 | 000,010,846 | ---- | C] () -- C:\Users\Nico\Desktop\mitt-romney-logo.jpg [2012.08.19 18:49:07 | 000,027,029 | ---- | C] () -- C:\Users\Nico\Desktop\romney20logo.jpg [2012.08.19 16:40:50 | 025,289,343 | ---- | C] () -- C:\Users\Nico\Desktop\Aula de Caixa Samba Carioca parte 1.mp4 [2012.08.18 11:58:02 | 000,475,987 | ---- | C] () -- C:\Users\Nico\Desktop\gerollte teigrolle.jpg [2012.08.18 01:40:48 | 030,410,043 | ---- | C] () -- C:\Users\Nico\Desktop\Maxim Vengerov - Masterclass.3gp [2012.08.18 01:28:50 | 000,091,692 | ---- | C] () -- C:\Users\Nico\Desktop\untermiete nicolai bülow.pdf [2012.08.18 00:09:43 | 000,023,764 | ---- | C] () -- C:\Users\Nico\Desktop\20100312140519_untermiete.odt [2012.08.14 01:30:02 | 000,031,143 | ---- | C] () -- C:\Users\Nico\Desktop\smn_73440a.png [2012.08.12 16:06:08 | 000,011,040 | ---- | C] () -- C:\Users\Nico\Desktop\wg.ods [2012.03.13 14:18:34 | 000,007,486 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\1.exe [2012.03.13 14:18:24 | 000,007,486 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PStrip.bko [2012.03.12 01:40:11 | 000,007,486 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PStrip.bak [2012.03.12 01:38:58 | 000,007,486 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PStrip.ini [2010.11.29 17:07:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin ========== LOP Check ========== [2012.09.10 02:41:29 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Audacity [2012.03.13 14:20:09 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Cycling '74 [2012.06.02 20:42:26 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\DAEMON Tools Lite [2012.09.07 16:44:10 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Dropbox [2012.09.10 16:05:27 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\foobar2000 [2012.08.07 02:14:13 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Guitar Pro 6 [2012.09.10 16:05:43 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\ICQ [2012.03.11 14:06:38 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\myBoard [2012.03.15 20:07:24 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\OpenOffice.org [2012.03.01 01:44:27 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Opera [2012.05.23 16:31:41 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\TeamViewer [2012.09.10 01:51:17 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\uTorrent [2012.03.03 14:57:28 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Windows Live Writer [2012.03.21 16:53:56 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\XnView [2012.08.12 20:00:00 | 000,000,452 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job [2009.07.14 07:08:49 | 000,012,718 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Files - Unicode (All) ========== [2012.07.29 18:04:00 | 093,076,756 | ---- | M] ()(C:\Users\Nico\Desktop\PSY - GANGNAM STYLE (?????) M-V.mp4) -- C:\Users\Nico\Desktop\PSY - GANGNAM STYLE (강남스타일) M-V.mp4 [2012.07.29 17:51:16 | 093,076,756 | ---- | C] ()(C:\Users\Nico\Desktop\PSY - GANGNAM STYLE (?????) M-V.mp4) -- C:\Users\Nico\Desktop\PSY - GANGNAM STYLE (강남스타일) M-V.mp4 < End of report > |
| Themen zu Nach Browsen im Web automatischer Neustart -> Black screen, keine Taskbar, "1.exe" |
| antivir, askbar, automatischer neustart, bho, bildschirm, black, black screen, desktop, fehler, flash player, helper, index, lenovo, logfile, malware, plug-in, problem, prozess, pwmtr64v.dll, realtek, rundll, safer networking, scan, schwarzer bildschirm, senden, server, software, taskmanager, trojan.agent.vgenx, windows |
Baum-Darstellung