| |
| |||||||
Log-Analyse und Auswertung: Bundespolizei TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
22.09.2012, 15:30
| #16 |
 |  Bundespolizei Trojaner Hallo Cosinus, anbei findest du das gewünschte Log. Liebe Grüße Code:
ATTFilter # AdwCleaner v2.002 - Datei am 09/22/2012 um 16:26:36 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : Basti - SETHOX
# Bootmodus : Normal
# Ausgeführt unter : C:\Dokumente und Einstellungen\Basti\Eigene Dateien\Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Programme\Mozilla FireFox\Components\AskSearch.js
Datei Gelöscht : C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
Ordner Gelöscht : C:\DOKUME~1\Basti\LOKALE~1\Temp\boost_interprocess
Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\InstallMate
Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Premium
Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint
Ordner Gelöscht : C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\AskToolbar
Ordner Gelöscht : C:\Programme\Ask.com
Ordner Gelöscht : C:\Programme\AskSearch
Ordner Gelöscht : C:\Programme\Viewpoint
Ordner Gelöscht : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\AppDataLow\AskSA
Schlüssel Gelöscht : HKCU\Software\Ask.com.tmp
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C94E154B-1459-4A47-966B-4B843BEFC7DB}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskBarDis
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C94E154B-1459-4A47-966B-4B843BEFC7DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\Software\MetaStream
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Schlüssel Gelöscht : HKLM\Software\Viewpoint
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{C94E154B-1459-4A47-966B-4B843BEFC7DB}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.18702
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q= --> hxxp://www.google.com
-\\ Opera v12.1.1532.0
Datei : C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [6721 octets] - [21/09/2012 09:37:09]
AdwCleaner[S1].txt - [6927 octets] - [22/09/2012 16:26:36]
########## EOF - C:\AdwCleaner[S1].txt - [6987 octets] ##########
|
|
22.09.2012, 19:37
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Bundespolizei Trojaner Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)
__________________1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
__________________ |
|
23.09.2012, 13:27
| #18 |
| | Bundespolizei Trojaner Hallo Cosinus,
__________________der "normale" Modus läuft perfekt und habe auch über Start alle Programme in den Ordnern. Liebe Grüße und einen schönen Sonntag Nachmittag wünsche Ich. Sethox |
|
23.09.2012, 17:53
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.09.2012, 20:27
| #20 |
| | Bundespolizei Trojaner Ho Cosinus, sorry war die letzten Tage nicht am rechner, anbei findest du / Ihr den Log. Liebe Grüße Sethox Code:
ATTFilter OTL logfile created on: 26.09.2012 20:16:47 - Run 2 OTL by OldTimer - Version 3.2.68.0 Folder = C:\Dokumente und Einstellungen\Basti\Eigene Dateien\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 66,21% Memory free 3,85 Gb Paging File | 3,13 Gb Available in Paging File | 81,49% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 298,08 Gb Total Space | 207,77 Gb Free Space | 69,70% Space Free | Partition Type: NTFS Computer Name: SETHOX | User Name: Basti | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.26 20:14:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Basti\Eigene Dateien\Downloads\OTL.exe PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.08.11 16:43:06 | 000,055,184 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.08.11 10:24:29 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.06.17 14:48:52 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Real\RealPlayer\Update\realsched.exe PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox\bin\Dropbox.exe PRC - [2012.05.13 17:25:32 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2012.05.13 17:25:32 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.13 17:25:32 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.13 17:25:32 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2010.05.14 12:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe PRC - [2010.05.14 12:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2008.12.09 12:12:30 | 000,234,856 | ---- | M] (TomTom) -- C:\Programme\TomTom HOME 2\HOMERunner.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008.01.22 11:13:32 | 001,201,448 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2008.01.22 11:13:26 | 000,275,752 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe PRC - [2008.01.22 11:13:20 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe PRC - [2007.11.16 20:20:26 | 000,091,432 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared files\brs.exe PRC - [2003.12.16 23:39:54 | 000,077,824 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Video\LogiTray.exe PRC - [2003.06.27 04:09:56 | 000,135,214 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\system32\LVComS.exe ========== Modules (No Company Name) ========== MOD - [2012.06.17 14:43:54 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\dbc413807cb7360b3e26ef3ca1d54f9a\System.Web.ni.dll MOD - [2012.06.17 14:42:41 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01abbadafaf265d9f4ac9bbb247acb98\System.Windows.Forms.ni.dll MOD - [2012.06.17 14:42:32 | 001,592,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86f2038209a4cf0d0f5b30f6375c9b2\System.Drawing.ni.dll MOD - [2012.05.14 00:24:16 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\92d58f840f549f9bd880783d43db7e3c\System.Runtime.Remoting.ni.dll MOD - [2012.05.14 00:23:45 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\016444dfc5f7e3d11c776f2fbc7a4594\Accessibility.ni.dll MOD - [2012.05.14 00:23:12 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll MOD - [2012.05.14 00:23:08 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll MOD - [2012.05.14 00:23:05 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll MOD - [2012.05.14 00:22:57 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll MOD - [2012.05.13 17:25:32 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.02.20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2012.02.20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe MOD - [2009.04.11 20:27:51 | 001,728,512 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3363.36806__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll MOD - [2009.04.11 20:27:51 | 000,364,544 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3363.36863__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll MOD - [2009.04.11 20:27:51 | 000,286,720 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3363.36789__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2009.04.11 20:27:51 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3363.36808__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2009.04.11 20:27:51 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3363.36802__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2009.04.11 20:27:51 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3363.36797__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2009.04.11 20:27:51 | 000,011,776 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3363.36893__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll MOD - [2009.04.11 20:27:51 | 000,008,704 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3363.36892__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll MOD - [2009.04.11 20:27:51 | 000,007,680 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3363.36896__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll MOD - [2009.04.11 20:27:51 | 000,007,680 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3363.36892__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll MOD - [2009.04.11 20:27:50 | 000,692,224 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.3363.36850__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll MOD - [2009.04.11 20:27:50 | 000,491,520 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3363.36877__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MOD - [2009.04.11 20:27:50 | 000,139,264 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3363.36878__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:50 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.3363.36807__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:50 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3363.36797__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:50 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3363.36858__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2009.04.11 20:27:50 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3363.36840__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2009.04.11 20:27:50 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3363.36831__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2009.04.11 20:27:50 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.3363.36807__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.dll MOD - [2009.04.11 20:27:49 | 000,364,544 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3363.36845__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:49 | 000,094,208 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3363.36846__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MOD - [2009.04.11 20:27:49 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3363.36845__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MOD - [2009.04.11 20:27:48 | 000,671,744 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3363.36891__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:48 | 000,077,824 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3363.36891__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll MOD - [2009.04.11 20:27:47 | 000,811,008 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3363.36833__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,794,624 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3363.36859__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,712,704 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3363.36798__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,593,920 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3363.36808__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,405,504 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3363.36853__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MOD - [2009.04.11 20:27:47 | 000,225,280 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3363.36808__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,126,976 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3363.36838__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:47 | 000,081,920 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3363.36833__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MOD - [2009.04.11 20:27:47 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3363.36812__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MOD - [2009.04.11 20:27:47 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3363.36838__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MOD - [2009.04.11 20:27:46 | 000,671,744 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.3363.36841__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:46 | 000,450,560 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3363.36828__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:46 | 000,434,176 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3363.36832__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MOD - [2009.04.11 20:27:46 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3363.36832__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MOD - [2009.04.11 20:27:46 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3363.36832__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MOD - [2009.04.11 20:27:46 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3363.36839__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MOD - [2009.04.11 20:27:45 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3363.26478__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MOD - [2009.04.11 20:27:45 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3363.26472__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MOD - [2009.04.11 20:27:45 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3363.26488__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll MOD - [2009.04.11 20:27:45 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3363.26504__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll MOD - [2009.04.11 20:27:45 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3363.26504__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MOD - [2009.04.11 20:27:45 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3363.26486__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MOD - [2009.04.11 20:27:45 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3363.26504__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MOD - [2009.04.11 20:27:45 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MOD - [2009.04.11 20:27:44 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3363.26467__90ba9c70f846762e\CLI.Foundation.dll MOD - [2009.04.11 20:27:44 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2009.04.11 20:27:44 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3363.26465__90ba9c70f846762e\LOG.Foundation.dll MOD - [2009.04.11 20:27:44 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3363.26466__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2009.04.11 20:27:44 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3363.26525__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2009.04.11 20:27:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3363.26488__90ba9c70f846762e\DEM.OS.I0602.dll MOD - [2009.04.11 20:27:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll MOD - [2009.04.11 20:27:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3363.26482__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2009.04.11 20:27:44 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3363.26479__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3363.26485__90ba9c70f846762e\MOM.Foundation.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3363.26502__90ba9c70f846762e\DEM.OS.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3363.26489__90ba9c70f846762e\DEM.Graphics.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll MOD - [2009.04.11 20:27:44 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3363.26477__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MOD - [2009.04.11 20:27:43 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3363.26480__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2009.04.11 20:27:43 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3363.26505__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll MOD - [2009.04.11 20:27:43 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3363.26494__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MOD - [2009.04.11 20:27:43 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3363.26501__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MOD - [2009.04.11 20:27:43 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3363.26472__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2009.04.11 20:27:43 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.3363.26491__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.dll MOD - [2009.04.11 20:27:43 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3363.26491__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2009.04.11 20:27:43 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3363.26489__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MOD - [2009.04.11 20:27:42 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3363.26495__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3363.26493__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3363.26492__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,049,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3363.26492__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3363.26494__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3363.26484__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3363.26491__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3363.26490__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3363.26493__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MOD - [2009.04.11 20:27:42 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3363.26490__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2009.04.11 20:27:41 | 000,503,808 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3363.36904__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll MOD - [2009.04.11 20:27:41 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3363.36872__90ba9c70f846762e\MOM.Implementation.dll MOD - [2009.04.11 20:27:41 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3363.36886__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MOD - [2009.04.11 20:27:41 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3363.26474__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2009.04.11 20:27:41 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3363.26487__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2009.04.11 20:27:41 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll MOD - [2009.04.11 20:27:41 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3363.26476__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll MOD - [2009.04.11 20:27:41 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3363.26486__90ba9c70f846762e\APM.Foundation.dll MOD - [2009.04.11 20:27:41 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3363.26478__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2009.04.11 20:27:41 | 000,014,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll MOD - [2009.04.11 20:27:41 | 000,013,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll MOD - [2009.04.11 20:27:41 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3363.36785__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MOD - [2009.04.11 20:27:40 | 001,142,784 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3363.36793__90ba9c70f846762e\CLI.Component.Dashboard.dll MOD - [2009.04.11 20:27:40 | 000,544,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3363.36867__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2009.04.11 20:27:40 | 000,405,504 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3363.36802__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2009.04.11 20:27:40 | 000,081,920 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3363.36787__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2009.04.11 20:27:40 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3363.36870__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2009.04.11 20:27:40 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3363.36788__90ba9c70f846762e\CLI.Component.SkinFactory.dll MOD - [2009.04.11 20:27:40 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3363.26487__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2009.04.11 20:27:40 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3363.26470__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2009.04.11 20:27:40 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3363.26482__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2009.04.11 20:27:40 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3363.26486__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2009.04.11 20:27:40 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3363.26485__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2009.04.11 20:27:40 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3363.26484__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MOD - [2009.04.11 20:27:39 | 000,081,920 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3363.36787__90ba9c70f846762e\ATIDEMOS.dll MOD - [2009.04.11 20:27:39 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3363.36786__90ba9c70f846762e\APM.Server.dll MOD - [2009.04.11 20:27:39 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3363.36785__90ba9c70f846762e\AEM.Server.dll MOD - [2009.04.11 20:27:39 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2009.04.11 20:27:39 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3363.26495__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2009.04.11 20:27:39 | 000,019,456 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3363.36872__90ba9c70f846762e\CCC.Implementation.dll MOD - [2009.04.11 20:00:23 | 000,434,176 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2008.10.30 14:39:12 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2007.01.31 20:55:30 | 000,102,400 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\ATI Technologies\Multimedia\atixcode.dll ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2012.09.22 16:02:35 | 000,250,288 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.21 17:59:42 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.08.11 16:43:06 | 000,055,184 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.13 17:25:32 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2012.05.13 17:25:32 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.13 17:25:32 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.06.02 10:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008.10.03 17:03:37 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service) SRV - [2008.01.22 11:13:26 | 000,275,752 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.05.13 17:25:33 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.13 17:25:33 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.03.16 23:33:02 | 003,597,312 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007.11.03 01:12:32 | 000,041,456 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) DRV - [2007.03.26 21:21:06 | 004,395,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2007.03.24 13:20:24 | 000,046,208 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\jraid.sys -- (JRAID) DRV - [2007.03.15 16:12:02 | 000,038,656 | R--- | M] (Attansic Technology corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atl01_xp.sys -- (AtcL001) DRV - [2006.12.28 18:44:44 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdAud.sys -- (HdAudAddService) DRV - [2006.02.07 21:52:58 | 000,006,912 | R--- | M] (JMicron ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\JGOGO.sys -- (JGOGO) DRV - [2004.08.13 20:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2003.06.27 04:05:38 | 000,472,332 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvcm.sys -- (QCMerced) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = about:blank IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = about:blank IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.agando.de IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.agando.de IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3320916697-846211390-61098624-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.order.1: "Ask" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Programme\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\programme\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll File not found FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.23 12:38:55 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.06.17 14:49:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.22 16:26:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.06.19 21:56:26 | 000,000,000 | ---D | M] [2008.12.23 16:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Extensions [2008.12.23 16:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com [2012.05.05 10:37:09 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\extensions [2012.04.13 15:48:58 | 000,000,000 | ---D | M] (Codecv) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\extensions\4f874996d7c16@4f874996d7c18.info [2010.01.29 21:03:28 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\extensions\moveplayer@movenetworks.com [2012.03.27 10:59:08 | 000,020,591 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2008.10.25 19:44:18 | 000,000,681 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\ask.xml [2012.09.22 16:23:46 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-1.xml [2010.01.17 01:25:14 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-10.xml [2010.03.28 13:36:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-11.xml [2010.03.31 14:20:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-12.xml [2010.04.07 21:41:08 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-13.xml [2012.02.29 17:23:24 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-14.xml [2012.02.29 17:50:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-15.xml [2007.11.03 15:15:12 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-2.xml [2007.12.02 16:30:26 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-3.xml [2007.12.02 16:43:32 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-4.xml [2008.02.09 12:51:05 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-5.xml [2008.03.26 21:14:32 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-6.xml [2008.04.17 21:35:24 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-7.xml [2008.07.05 06:28:20 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-8.xml [2008.07.24 18:33:29 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-9.xml [2009.07.13 18:12:02 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin.xml [2012.03.02 17:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.01.17 01:25:06 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.09.21 17:59:43 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.02.23 13:49:42 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2012.06.17 14:48:56 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Programme\mozilla firefox\plugins\nprpplugin.dll [2012.07.01 10:20:48 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.21 17:59:41 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.07.01 10:20:48 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.07.01 10:20:48 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.01 10:20:48 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.01 10:20:48 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}, CHR - homepage: hxxp://www.google.com/ CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\21.0.1180.83\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\21.0.1180.83\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.210.7 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U21 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Programme\Mozilla Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprpjplug.dll CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprjplug.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Programme\DivX\DivX Content Uploader\npUpload.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Programme\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: DivX Plus Web Player (Enabled) = C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: Codecv = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\ajhcekcffkpnaednoeoegnmnjdlnjjmg\1.0_0\ CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\ CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2002.12.31 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. O3 - HKU\S-1-5-21-3320916697-846211390-61098624-1005\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [Arcor Online] File not found O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared files\brs.exe (cyberlink) O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe (Logitech Inc.) O4 - HKLM..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKU\S-1-5-21-3320916697-846211390-61098624-1005..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-3320916697-846211390-61098624-1005..\Run: [EA Core] "C:\Programme\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKU\S-1-5-21-3320916697-846211390-61098624-1005..\Run: [TomTomHOME.exe] C:\Programme\TomTom HOME 2\HOMERunner.exe (TomTom) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech) O4 - Startup: C:\Dokumente und Einstellungen\Basti\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\Basti\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E5D7E19D-F173-4235-8ABA-25842A4B0F00}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.10.23 17:34:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell\AutoRun\command - "" = D:\setup.exe O33 - MountPoints2\{f0a7ce71-d0ff-11dd-a250-001d60235d1b}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: 36X Raid Configurer - hkey= - key= - File not found MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) MsConfig - StartUpReg: JMB36X IDE Setup - hkey= - key= - C:\WINDOWS\RaidTool\xInsIDE.exe () MsConfig - StartUpReg: RTHDCPL - hkey= - key= - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A93B393-F54C-0E8F-973D-14D6F48FA063} - Outlook Express ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {7B637B33-F9D2-E34D-1A58-38F3090BD73E} - Outlook Express ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.enc - C:\WINDOWS\System32\ITIG726.acm (Ingenient Technologies, Inc.) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lhacm - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com) Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.09.26 09:32:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Basti\Startmenü\Programme\CyberLink PowerDVD [2012.09.21 12:04:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes [2012.09.21 12:03:27 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2012.09.21 12:03:22 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2012.09.21 12:03:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.09.21 12:01:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Apple Computer [2012.09.21 12:00:44 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2012.09.20 16:54:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Basti\Desktop\iPhone 4 Pictures [2012.09.19 16:41:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Basti\Desktop\Fotos Berrit Arnold [2012.09.18 18:50:20 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2012.09.18 17:59:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Malwarebytes [2012.09.18 17:59:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.09.18 17:59:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.09.18 17:59:16 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.09.18 17:59:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.09.16 18:15:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Basti\Desktop\Logfiles Sethox [2012.09.15 16:29:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\World of Warcraft [2012.09.06 17:10:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe [2012.09.06 15:58:12 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype [2012.09.06 15:58:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [2012.09.06 15:01:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nbqbjncjmtkpffz [7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.26 20:02:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.09.26 19:33:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.09.26 16:33:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.09.26 09:32:18 | 000,000,270 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3320916697-846211390-61098624-1005.job [2012.09.26 09:32:12 | 000,012,644 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.09.26 09:32:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.09.23 18:46:44 | 000,191,623 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Homepage 2.jpg [2012.09.23 18:46:35 | 000,307,779 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Homepage 1.jpg [2012.09.23 14:50:00 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3320916697-846211390-61098624-1005.job [2012.09.21 12:04:23 | 000,001,522 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2012.09.19 20:16:11 | 000,074,841 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne 19.09.12.JPG [2012.09.19 16:45:23 | 013,063,382 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Fotos Berrit Arnold.rar [2012.09.18 17:59:18 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.17 20:03:00 | 000,051,101 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne.jpg [2012.09.17 20:01:30 | 000,833,622 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne.jpg.bmp [2012.09.16 18:15:58 | 000,009,157 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Logfiles Sethox.rar [2012.09.16 16:36:34 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\ewpf5hfn.exe [2012.09.16 16:33:36 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\defogger_reenable [2012.09.16 16:33:10 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Defogger.exe [2012.09.15 21:59:44 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2012.09.15 21:29:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.09.15 17:15:36 | 000,000,903 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\World of Warcraft.lnk [2012.09.15 16:30:31 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.09.06 15:58:12 | 000,001,872 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.23 18:46:44 | 000,191,623 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Homepage 2.jpg [2012.09.23 18:46:35 | 000,307,779 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Homepage 1.jpg [2012.09.21 12:04:23 | 000,001,522 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2012.09.19 20:13:18 | 000,074,841 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne 19.09.12.JPG [2012.09.19 16:45:19 | 013,063,382 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Fotos Berrit Arnold.rar [2012.09.18 17:59:18 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.09.17 20:03:00 | 000,051,101 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne.jpg [2012.09.16 18:22:09 | 000,833,622 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Antivir Quarantäne.jpg.bmp [2012.09.16 18:15:58 | 000,009,157 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Logfiles Sethox.rar [2012.09.16 16:36:34 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\ewpf5hfn.exe [2012.09.16 16:33:36 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\defogger_reenable [2012.09.16 16:33:10 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Desktop\Defogger.exe [2008.09.21 13:12:53 | 000,031,744 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.12.24 01:55:03 | 000,000,132 | ---- | C] () -- C:\Dokumente und Einstellungen\Basti\default.pls [2007.10.30 21:46:53 | 000,005,508 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2007.10.27 11:28:55 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html ========== ZeroAccess Check ========== [2007.10.23 20:25:28 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.12.22 07:07:57 | 001,509,888 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.09.21 12:04:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.06.17 19:06:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net [2009.12.10 12:34:46 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ [2012.09.19 18:41:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Codecv [2012.08.17 20:53:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite [2012.02.23 13:11:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverBoost [2009.07.15 23:39:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Logs [2012.02.22 19:09:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts [2010.01.17 01:25:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2012.09.06 15:01:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nbqbjncjmtkpffz [2009.09.09 14:01:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaMusic [2009.09.09 15:15:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2009.12.06 13:57:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SafeNet Sentinel [2009.12.06 13:56:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SPSS [2008.12.23 16:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom [2012.08.17 20:53:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\DAEMON Tools Lite [2012.04.22 19:00:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\DDMSettings [2012.09.26 09:32:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox [2010.01.04 20:34:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\FotoWire [2007.10.27 01:25:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\ICQ Toolbar [2012.02.22 19:03:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\MSNInstaller [2009.09.09 14:02:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Nokia [2009.09.09 15:08:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Nseries [2012.08.16 17:27:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Opera [2009.09.09 14:02:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\PC Suite [2008.12.23 16:44:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\TomTom [2012.05.13 22:10:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\TS3Client [2012.06.03 13:46:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\XMedia Recode ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > [2009.12.06 13:57:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\SPSS < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.11.20 12:49:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Adobe [2007.12.24 01:47:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Ahead [2012.09.21 12:10:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Apple Computer [2007.10.23 20:30:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\ATI [2012.02.23 13:51:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Avira [2007.12.14 21:04:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\CyberLink [2012.08.17 20:53:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\DAEMON Tools Lite [2012.04.22 19:00:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\DDMSettings [2010.05.16 04:43:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\DivX [2012.09.26 09:32:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox [2010.01.04 20:34:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\FotoWire [2007.10.27 01:25:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\ICQ Toolbar [2007.10.23 17:39:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Identities [2007.10.27 01:16:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\InstallShield [2007.10.27 01:17:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Macromedia [2012.09.18 17:59:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Malwarebytes [2009.04.11 18:51:02 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Microsoft [2010.01.29 21:03:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Move Networks [2008.08.28 18:03:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla [2012.02.22 19:03:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\MSNInstaller [2009.09.09 14:02:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Nokia [2009.09.09 15:08:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Nseries [2012.08.16 17:27:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Opera [2009.09.09 14:02:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\PC Suite [2012.06.17 14:50:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Real [2007.11.12 21:52:35 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\SecuROM [2012.09.06 16:10:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Skype [2010.06.17 11:28:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\skypePM [2007.12.14 16:12:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Sun [2012.05.13 19:08:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\teamspeak2 [2008.12.23 16:44:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\TomTom [2012.05.13 22:10:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\TS3Client [2007.10.27 13:14:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\WinRAR [2012.06.03 13:46:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\XMedia Recode < %APPDATA%\*.exe /s > [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox\bin\DropboxUpdateHelper.exe [2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Dropbox\bin\Uninstall.exe [2008.04.15 15:00:08 | 001,526,544 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe [2009.06.01 18:30:20 | 001,878,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe [2007.10.23 20:26:49 | 000,009,158 | R--- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Microsoft\Installer\{5399ACAF-7B15-43D5-9233-4E797B184FD2}\ARPPRODUCTICON.exe [2009.06.05 18:56:40 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe [2012.06.09 23:30:15 | 000,317,048 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\9.10\rnupgagent.exe [2012.05.28 17:04:22 | 028,087,744 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\9.10\stub_data\RealPlayer_de.exe [2012.05.28 17:00:56 | 000,693,504 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Real\Update\UpgradeHelper\RealPlayer\9.10\stub_exe\RealPlayer_de.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2002.12.31 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008.12.25 13:56:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2008.12.25 13:56:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2002.12.31 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008.12.25 13:56:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.12.25 13:56:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [2002.12.31 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\system32\DRIVERS\atapi.sys [2002.12.31 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys [2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2002.12.31 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: NETLOGON.DLL > [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2002.12.31 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2002.12.31 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2002.12.31 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll [2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2002.12.31 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2002.12.31 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2002.12.31 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2002.12.31 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2007.10.23 19:24:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2007.10.23 19:24:47 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2007.10.23 19:24:47 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < > [2007.10.23 17:33:19 | 000,000,065 | RH-- | C] () -- C:\WINDOWS\Tasks\desktop.ini [2007.10.23 17:39:09 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\Tasks\SA.DAT [2007.10.30 21:44:29 | 000,000,276 | ---- | C] () -- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job [2010.03.21 13:38:00 | 000,000,278 | ---- | C] () -- C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-3320916697-846211390-61098624-1005.job [2010.03.21 13:38:01 | 000,000,270 | ---- | C] () -- C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-3320916697-846211390-61098624-1005.job [2012.04.13 12:05:26 | 000,000,884 | ---- | C] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job [2012.06.16 14:34:39 | 000,001,084 | ---- | C] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job [2012.06.16 14:34:40 | 000,001,088 | ---- | C] () -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job < End of report > |
|
27.09.2012, 15:40
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
FF - user.js - File not found
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - user.js - File not found
[2008.10.25 19:44:18 | 000,000,681 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\ask.xml
[2012.09.22 16:23:46 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-1.xml
[2010.01.17 01:25:14 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-10.xml
[2010.03.28 13:36:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-11.xml
[2010.03.31 14:20:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-12.xml
[2010.04.07 21:41:08 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-13.xml
[2012.02.29 17:23:24 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-14.xml
[2012.02.29 17:50:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-15.xml
[2007.11.03 15:15:12 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-2.xml
[2007.12.02 16:30:26 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-3.xml
[2007.12.02 16:43:32 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-4.xml
[2008.02.09 12:51:05 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-5.xml
[2008.03.26 21:14:32 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-6.xml
[2008.04.17 21:35:24 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-7.xml
[2008.07.05 06:28:20 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-8.xml
[2008.07.24 18:33:29 | 000,000,949 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-9.xml
[2009.07.13 18:12:02 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin.xml
[2012.03.02 17:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.01.17 01:25:06 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKU\S-1-5-21-3320916697-846211390-61098624-1005\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Arcor Online] File not found
O4 - HKU\S-1-5-21-3320916697-846211390-61098624-1005..\Run: [EA Core] "C:\Programme\Electronic Arts\EADM\Core.exe" -silent File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.10.23 17:34:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{f0a7ce71-d0ff-11dd-a250-001d60235d1b}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
:Files
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nbqbjncjmtkpffz
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ixkssakmyepokqj
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\ICQ Toolbar
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Codecv
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ --> Bundespolizei Trojaner |
|
27.09.2012, 20:49
| #22 |
| | Bundespolizei Trojaner Guten ABend Cosinus, leider bleibt der "Fix" immer hängen.. habe alle Programme beendet udn antivir und malware mit "rechter Maustaste" deaktivieren, deaktiviert - reicht das? Gibt es sonst noch einen Trick wie ich die Programme beenden kann und somit der "Fix" funktioniert? Liebe Grüße Sethox |
|
27.09.2012, 21:13
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Starte Windows neu im abgesicherten Modus (mit Netzwerktreibern nach Möglichkeit), manchmal hakt das Fixen mit OTL im normalen Modus aber sehr oft funktioniert der Fix im abgesicherte Modus.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.09.2012, 19:20
| #24 |
| | Bundespolizei Trojaner Guten Abend Cosinus, anbei der Log vom OTL Fix (abgesicherter Modus war super) Code:
ATTFilter All processes killed
========== OTL ==========
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Ask" removed from browser.search.order.1
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\ask.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\Mozilla\Firefox\Profiles\6fo9qje3.default\searchplugins\icqplugin.xml moved successfully.
C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
C:\Programme\Mozilla Firefox\extensions folder moved successfully.
Folder C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3320916697-846211390-61098624-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Arcor Online deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3320916697-846211390-61098624-1005\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3320916697-846211390-61098624-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552e280-8180-11dc-a06b-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552e280-8180-11dc-a06b-806d6172696f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6552e280-8180-11dc-a06b-806d6172696f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552e280-8180-11dc-a06b-806d6172696f}\ not found.
File D:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f0a7ce71-d0ff-11dd-a250-001d60235d1b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0a7ce71-d0ff-11dd-a250-001d60235d1b}\ not found.
File F:\InstallTomTomHOME.exe not found.
========== FILES ==========
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nbqbjncjmtkpffz folder moved successfully.
File\Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ixkssakmyepokqj not found.
C:\Dokumente und Einstellungen\Basti\Anwendungsdaten\ICQ Toolbar folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Codecv\data folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Codecv folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\Basti\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\Basti\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Basti
->Temp folder emptied: 4368740856 bytes
->Temporary Internet Files folder emptied: 51634335 bytes
->Java cache emptied: 23096191 bytes
->FireFox cache emptied: 471307561 bytes
->Google Chrome cache emptied: 28859065 bytes
->Opera cache emptied: 20646080 bytes
->Flash cache emptied: 3408902 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 389058 bytes
User: LocalService
->Temp folder emptied: 82513 bytes
->Temporary Internet Files folder emptied: 32969 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 69727411 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 3938695 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21680610 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 4.831,00 mb
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.68.0 log created on 09282012_201238
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
28.09.2012, 19:58
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs. Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten! 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.09.2012, 10:04
| #26 |
| | Bundespolizei Trojaner Hallo Cosinus, anbei der Log vom TDSS-Killer Liebe Grüße Sethox Code:
ATTFilter 11:01:17.0046 3192 TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
11:01:19.0046 3192 ============================================================
11:01:19.0046 3192 Current date / time: 2012/09/29 11:01:19.0046
11:01:19.0046 3192 SystemInfo:
11:01:19.0046 3192
11:01:19.0046 3192 OS Version: 5.1.2600 ServicePack: 3.0
11:01:19.0046 3192 Product type: Workstation
11:01:19.0046 3192 ComputerName: SETHOX
11:01:19.0046 3192 UserName: Basti
11:01:19.0046 3192 Windows directory: C:\WINDOWS
11:01:19.0046 3192 System windows directory: C:\WINDOWS
11:01:19.0046 3192 Processor architecture: Intel x86
11:01:19.0046 3192 Number of processors: 2
11:01:19.0046 3192 Page size: 0x1000
11:01:19.0046 3192 Boot type: Normal boot
11:01:19.0046 3192 ============================================================
11:01:20.0203 3192 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
11:01:20.0218 3192 ============================================================
11:01:20.0218 3192 \Device\Harddisk0\DR0:
11:01:20.0218 3192 MBR partitions:
11:01:20.0218 3192 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x254297C1
11:01:20.0218 3192 ============================================================
11:01:20.0265 3192 C: <-> \Device\Harddisk0\DR0\Partition1
11:01:20.0281 3192 ============================================================
11:01:20.0281 3192 Initialize success
11:01:20.0281 3192 ============================================================
11:01:43.0296 3660 ============================================================
11:01:43.0296 3660 Scan started
11:01:43.0296 3660 Mode: Manual; SigCheck; TDLFS;
11:01:43.0296 3660 ============================================================
11:01:44.0796 3660 ================ Scan system memory ========================
11:01:44.0812 3660 System memory - ok
11:01:44.0812 3660 ================ Scan services =============================
11:01:45.0187 3660 Abiosdsk - ok
11:01:45.0203 3660 abp480n5 - ok
11:01:45.0250 3660 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:01:48.0718 3660 ACPI - ok
11:01:48.0765 3660 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
11:01:48.0875 3660 ACPIEC - ok
11:01:48.0937 3660 [ 8B46D5A1D3EF08232C04D0EAFB871FB2 ] Adobe LM Service C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
11:01:48.0937 3660 Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning
11:01:48.0937 3660 Adobe LM Service - detected UnsignedFile.Multi.Generic (1)
11:01:49.0031 3660 [ E12CFCF1DDBFC50948A75E6E38793225 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:01:49.0046 3660 AdobeFlashPlayerUpdateSvc - ok
11:01:49.0046 3660 adpu160m - ok
11:01:49.0093 3660 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
11:01:49.0187 3660 aec - ok
11:01:49.0218 3660 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
11:01:49.0265 3660 AFD - ok
11:01:49.0265 3660 Aha154x - ok
11:01:49.0281 3660 aic78u2 - ok
11:01:49.0281 3660 aic78xx - ok
11:01:49.0312 3660 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll
11:01:49.0421 3660 Alerter - ok
11:01:49.0453 3660 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe
11:01:49.0531 3660 ALG - ok
11:01:49.0546 3660 AliIde - ok
11:01:49.0546 3660 amsint - ok
11:01:49.0609 3660 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Programme\Avira\AntiVir Desktop\sched.exe
11:01:49.0625 3660 AntiVirSchedulerService - ok
11:01:49.0671 3660 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService C:\Programme\Avira\AntiVir Desktop\avguard.exe
11:01:49.0687 3660 AntiVirService - ok
11:01:49.0734 3660 [ 676894FA57B671FEC5C3F05F8929E03B ] AntiVirWebService C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
11:01:49.0765 3660 AntiVirWebService - ok
11:01:49.0843 3660 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
11:01:49.0843 3660 Apple Mobile Device - ok
11:01:49.0859 3660 AppMgmt - ok
11:01:49.0875 3660 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
11:01:49.0953 3660 Arp1394 - ok
11:01:49.0968 3660 asc - ok
11:01:49.0968 3660 asc3350p - ok
11:01:49.0968 3660 asc3550 - ok
11:01:50.0062 3660 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:01:50.0093 3660 aspnet_state - ok
11:01:50.0125 3660 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:01:50.0187 3660 AsyncMac - ok
11:01:50.0203 3660 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
11:01:50.0296 3660 atapi - ok
11:01:50.0328 3660 [ 19F277BC4CE5689F20F347A6B8AA8C42 ] AtcL001 C:\WINDOWS\system32\DRIVERS\atl01_xp.sys
11:01:50.0390 3660 AtcL001 - ok
11:01:50.0390 3660 Atdisk - ok
11:01:50.0453 3660 [ 9902DFEB0943B70B7358C7B598DE377D ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
11:01:50.0609 3660 Ati HotKey Poller - ok
11:01:50.0687 3660 [ 5F90B5A3381F5795E852960FCCEBFF6A ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe
11:01:50.0734 3660 ATI Smart ( UnsignedFile.Multi.Generic ) - warning
11:01:50.0734 3660 ATI Smart - detected UnsignedFile.Multi.Generic (1)
11:01:50.0859 3660 [ 554E45746A2FF688AF87282C4D742255 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
11:01:50.0968 3660 ati2mtag - ok
11:01:51.0000 3660 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:01:51.0062 3660 Atmarpc - ok
11:01:51.0093 3660 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
11:01:51.0171 3660 AudioSrv - ok
11:01:51.0218 3660 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
11:01:51.0296 3660 audstub - ok
11:01:51.0343 3660 [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys
11:01:51.0359 3660 avgntflt - ok
11:01:51.0406 3660 [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys
11:01:51.0421 3660 avipbb - ok
11:01:51.0453 3660 [ 271CFD1A989209B1964E24D969552BF7 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys
11:01:51.0468 3660 avkmgr - ok
11:01:51.0515 3660 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
11:01:51.0609 3660 Beep - ok
11:01:51.0656 3660 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll
11:01:51.0843 3660 BITS - ok
11:01:51.0921 3660 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
11:01:51.0937 3660 Bonjour Service - ok
11:01:51.0968 3660 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll
11:01:52.0015 3660 Browser - ok
11:01:52.0046 3660 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
11:01:52.0125 3660 cbidf2k - ok
11:01:52.0156 3660 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
11:01:52.0234 3660 CCDECODE - ok
11:01:52.0250 3660 cd20xrnt - ok
11:01:52.0281 3660 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
11:01:52.0375 3660 Cdaudio - ok
11:01:52.0406 3660 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
11:01:52.0500 3660 Cdfs - ok
11:01:52.0515 3660 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:01:52.0593 3660 Cdrom - ok
11:01:52.0593 3660 Changer - ok
11:01:52.0625 3660 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe
11:01:52.0718 3660 CiSvc - ok
11:01:52.0734 3660 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
11:01:52.0812 3660 ClipSrv - ok
11:01:52.0843 3660 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:01:52.0937 3660 clr_optimization_v2.0.50727_32 - ok
11:01:52.0937 3660 CmdIde - ok
11:01:52.0937 3660 COMSysApp - ok
11:01:52.0953 3660 Cpqarray - ok
11:01:52.0968 3660 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
11:01:53.0062 3660 CryptSvc - ok
11:01:53.0062 3660 dac2w2k - ok
11:01:53.0078 3660 dac960nt - ok
11:01:53.0109 3660 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
11:01:53.0187 3660 DcomLaunch - ok
11:01:53.0234 3660 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
11:01:53.0328 3660 Dhcp - ok
11:01:53.0390 3660 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
11:01:53.0515 3660 Disk - ok
11:01:53.0515 3660 dmadmin - ok
11:01:53.0562 3660 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
11:01:53.0671 3660 dmboot - ok
11:01:53.0718 3660 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys
11:01:53.0796 3660 dmio - ok
11:01:53.0828 3660 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
11:01:53.0890 3660 dmload - ok
11:01:53.0937 3660 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll
11:01:54.0015 3660 dmserver - ok
11:01:54.0031 3660 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
11:01:54.0109 3660 DMusic - ok
11:01:54.0156 3660 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
11:01:54.0250 3660 Dnscache - ok
11:01:54.0265 3660 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
11:01:54.0343 3660 Dot3svc - ok
11:01:54.0343 3660 dpti2o - ok
11:01:54.0375 3660 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
11:01:54.0437 3660 drmkaud - ok
11:01:54.0468 3660 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll
11:01:54.0546 3660 EapHost - ok
11:01:54.0562 3660 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll
11:01:54.0656 3660 ERSvc - ok
11:01:54.0703 3660 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe
11:01:54.0734 3660 Eventlog - ok
11:01:54.0765 3660 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll
11:01:54.0828 3660 EventSystem - ok
11:01:54.0859 3660 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
11:01:54.0953 3660 Fastfat - ok
11:01:55.0000 3660 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
11:01:55.0046 3660 FastUserSwitchingCompatibility - ok
11:01:55.0078 3660 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
11:01:55.0140 3660 Fdc - ok
11:01:55.0156 3660 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
11:01:55.0234 3660 Fips - ok
11:01:55.0281 3660 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
11:01:55.0359 3660 Flpydisk - ok
11:01:55.0406 3660 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
11:01:55.0500 3660 FltMgr - ok
11:01:55.0609 3660 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:01:55.0625 3660 FontCache3.0.0.0 - ok
11:01:55.0625 3660 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:01:55.0703 3660 Fs_Rec - ok
11:01:55.0734 3660 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:01:55.0812 3660 Ftdisk - ok
11:01:55.0843 3660 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
11:01:55.0843 3660 GEARAspiWDM - ok
11:01:55.0859 3660 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:01:55.0937 3660 Gpc - ok
11:01:56.0031 3660 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe
11:01:56.0046 3660 gupdate - ok
11:01:56.0046 3660 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe
11:01:56.0046 3660 gupdatem - ok
11:01:56.0093 3660 [ 56BF27D7A539F9E6BBC1DE201ABA0EDF ] HdAudAddService C:\WINDOWS\system32\drivers\AtiHdAud.sys
11:01:56.0140 3660 HdAudAddService - ok
11:01:56.0156 3660 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
11:01:56.0250 3660 HDAudBus - ok
11:01:56.0328 3660 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:01:56.0406 3660 helpsvc - ok
11:01:56.0421 3660 [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ C:\WINDOWS\System32\hidserv.dll
11:01:56.0500 3660 HidServ - ok
11:01:56.0515 3660 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:01:56.0609 3660 hidusb - ok
11:01:56.0640 3660 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
11:01:56.0718 3660 hkmsvc - ok
11:01:56.0718 3660 hpn - ok
11:01:56.0765 3660 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
11:01:56.0812 3660 HTTP - ok
11:01:56.0843 3660 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
11:01:56.0937 3660 HTTPFilter - ok
11:01:56.0937 3660 i2omgmt - ok
11:01:56.0937 3660 i2omp - ok
11:01:56.0968 3660 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:01:57.0062 3660 i8042prt - ok
11:01:57.0156 3660 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:01:57.0203 3660 idsvc - ok
11:01:57.0250 3660 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
11:01:57.0343 3660 Imapi - ok
11:01:57.0375 3660 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe
11:01:57.0468 3660 ImapiService - ok
11:01:57.0468 3660 ini910u - ok
11:01:57.0609 3660 [ CBDDAB14249B2F05407FC09AB8FFFB88 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
11:01:57.0781 3660 IntcAzAudAddService - ok
11:01:57.0781 3660 IntelIde - ok
11:01:57.0828 3660 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:01:57.0906 3660 intelppm - ok
11:01:57.0937 3660 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
11:01:58.0015 3660 Ip6Fw - ok
11:01:58.0046 3660 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:01:58.0140 3660 IpFilterDriver - ok
11:01:58.0156 3660 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:01:58.0250 3660 IpInIp - ok
11:01:58.0281 3660 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:01:58.0343 3660 IpNat - ok
11:01:58.0406 3660 [ BC0EA61246F8D940FBC5F652D337D6BD ] iPod Service C:\Programme\iPod\bin\iPodService.exe
11:01:58.0437 3660 iPod Service - ok
11:01:58.0468 3660 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:01:58.0562 3660 IPSec - ok
11:01:58.0578 3660 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
11:01:58.0656 3660 IRENUM - ok
11:01:58.0671 3660 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:01:58.0765 3660 isapnp - ok
11:01:58.0859 3660 [ 126A16F569122AE00AD3D12EF831D651 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
11:01:58.0875 3660 JavaQuickStarterService - ok
11:01:58.0890 3660 [ C995C0E8B4503FAC38793BB0236AD246 ] JGOGO C:\WINDOWS\system32\DRIVERS\JGOGO.sys
11:01:58.0937 3660 JGOGO - ok
11:01:58.0937 3660 [ 8F55EFD8B7D99465C16D06B345D50CA9 ] JRAID C:\WINDOWS\system32\DRIVERS\jraid.sys
11:01:58.0968 3660 JRAID - ok
11:01:58.0984 3660 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:01:59.0062 3660 Kbdclass - ok
11:01:59.0062 3660 [ B6D6C117D771C98130497265F26D1882 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:01:59.0140 3660 kbdhid - ok
11:01:59.0171 3660 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
11:01:59.0265 3660 kmixer - ok
11:01:59.0296 3660 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
11:01:59.0390 3660 KSecDD - ok
11:01:59.0421 3660 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
11:01:59.0484 3660 lanmanserver - ok
11:01:59.0562 3660 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
11:01:59.0625 3660 lanmanworkstation - ok
11:01:59.0640 3660 lbrtfdc - ok
11:01:59.0671 3660 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
11:01:59.0734 3660 LmHosts - ok
11:01:59.0734 3660 [ 65E794E86468B61F2BC79ABC48BC4433 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys
11:01:59.0750 3660 MBAMProtector - ok
11:01:59.0796 3660 [ 0DCF16B1449811EFA47AB52CAC84093C ] MBAMScheduler C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
11:01:59.0812 3660 MBAMScheduler - ok
11:01:59.0859 3660 [ 9EAABA4D601004BEA4DAA6E146E19A96 ] MBAMService C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
11:01:59.0875 3660 MBAMService - ok
11:01:59.0906 3660 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll
11:01:59.0984 3660 Messenger - ok
11:02:00.0015 3660 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
11:02:00.0171 3660 mnmdd - ok
11:02:00.0234 3660 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
11:02:00.0359 3660 mnmsrvc - ok
11:02:00.0375 3660 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
11:02:00.0453 3660 Modem - ok
11:02:00.0484 3660 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:02:00.0578 3660 Mouclass - ok
11:02:00.0609 3660 [ 66A6F73C74E1791464160A7065CE711A ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:02:00.0687 3660 mouhid - ok
11:02:00.0718 3660 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
11:02:00.0781 3660 MountMgr - ok
11:02:00.0828 3660 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
11:02:00.0828 3660 MozillaMaintenance - ok
11:02:00.0843 3660 mraid35x - ok
11:02:00.0843 3660 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:02:00.0906 3660 MRxDAV - ok
11:02:00.0937 3660 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:02:00.0984 3660 MRxSmb - ok
11:02:01.0015 3660 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe
11:02:01.0093 3660 MSDTC - ok
11:02:01.0093 3660 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
11:02:01.0171 3660 Msfs - ok
11:02:01.0187 3660 MSIServer - ok
11:02:01.0218 3660 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:02:01.0281 3660 MSKSSRV - ok
11:02:01.0296 3660 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:02:01.0359 3660 MSPCLOCK - ok
11:02:01.0390 3660 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
11:02:01.0484 3660 MSPQM - ok
11:02:01.0515 3660 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:02:01.0578 3660 mssmbios - ok
11:02:01.0609 3660 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
11:02:01.0687 3660 MSTEE - ok
11:02:01.0718 3660 [ D48659BB24C48345D926ECB45C1EBDF5 ] MTsensor C:\WINDOWS\system32\DRIVERS\ASACPI.sys
11:02:01.0750 3660 MTsensor - ok
11:02:01.0765 3660 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
11:02:01.0781 3660 Mup - ok
11:02:01.0796 3660 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
11:02:01.0875 3660 NABTSFEC - ok
11:02:01.0953 3660 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll
11:02:02.0031 3660 napagent - ok
11:02:02.0171 3660 [ 3BAE2BFCB6D69E19C8373F635DD544DC ] NBService C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
11:02:02.0218 3660 NBService - ok
11:02:02.0265 3660 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
11:02:02.0359 3660 NDIS - ok
11:02:02.0375 3660 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
11:02:02.0468 3660 NdisIP - ok
11:02:02.0500 3660 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:02:02.0546 3660 NdisTapi - ok
11:02:02.0562 3660 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:02:02.0640 3660 Ndisuio - ok
11:02:02.0640 3660 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:02:02.0734 3660 NdisWan - ok
11:02:02.0765 3660 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
11:02:02.0812 3660 NDProxy - ok
11:02:02.0828 3660 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
11:02:02.0890 3660 NetBIOS - ok
11:02:02.0906 3660 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
11:02:02.0968 3660 NetBT - ok
11:02:03.0015 3660 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe
11:02:03.0093 3660 NetDDE - ok
11:02:03.0093 3660 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
11:02:03.0156 3660 NetDDEdsdm - ok
11:02:03.0187 3660 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe
11:02:03.0265 3660 Netlogon - ok
11:02:03.0312 3660 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll
11:02:03.0390 3660 Netman - ok
11:02:03.0437 3660 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:02:03.0437 3660 NetTcpPortSharing - ok
11:02:03.0453 3660 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
11:02:03.0546 3660 NIC1394 - ok
11:02:03.0593 3660 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll
11:02:03.0609 3660 Nla - ok
11:02:03.0687 3660 [ 193FA51DDDD0BFFDED1C340F0434999A ] NMIndexingService C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
11:02:03.0703 3660 NMIndexingService - ok
11:02:03.0750 3660 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
11:02:03.0843 3660 Npfs - ok
11:02:03.0859 3660 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
11:02:03.0984 3660 Ntfs - ok
11:02:04.0000 3660 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
11:02:04.0078 3660 NtLmSsp - ok
11:02:04.0125 3660 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
11:02:04.0234 3660 NtmsSvc - ok
11:02:04.0265 3660 [ CF7E041663119E09D2E118521ADA9300 ] NuidFltr C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
11:02:04.0281 3660 NuidFltr - ok
11:02:04.0281 3660 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
11:02:04.0359 3660 Null - ok
11:02:04.0390 3660 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:02:04.0468 3660 NwlnkFlt - ok
11:02:04.0484 3660 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:02:04.0546 3660 NwlnkFwd - ok
11:02:04.0562 3660 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
11:02:04.0640 3660 ohci1394 - ok
11:02:04.0671 3660 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
11:02:04.0750 3660 Parport - ok
11:02:04.0750 3660 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
11:02:04.0812 3660 PartMgr - ok
11:02:04.0843 3660 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
11:02:04.0921 3660 ParVdm - ok
11:02:04.0953 3660 [ FD2041E9BA03DB7764B2248F02475079 ] pccsmcfd C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
11:02:05.0031 3660 pccsmcfd - ok
11:02:05.0031 3660 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
11:02:05.0109 3660 PCI - ok
11:02:05.0109 3660 PCIDump - ok
11:02:05.0125 3660 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
11:02:05.0218 3660 PCIIde - ok
11:02:05.0234 3660 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
11:02:05.0296 3660 Pcmcia - ok
11:02:05.0312 3660 PDCOMP - ok
11:02:05.0312 3660 PDFRAME - ok
11:02:05.0312 3660 PDRELI - ok
11:02:05.0312 3660 PDRFRAME - ok
11:02:05.0312 3660 perc2 - ok
11:02:05.0328 3660 perc2hib - ok
11:02:05.0390 3660 [ 875E4E0661F3A5994DF9E5E3A0A4F96B ] PLFlash DeviceIoControl Service C:\WINDOWS\system32\IoctlSvc.exe
11:02:05.0421 3660 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - warning
11:02:05.0421 3660 PLFlash DeviceIoControl Service - detected UnsignedFile.Multi.Generic (1)
11:02:05.0578 3660 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe
11:02:05.0687 3660 PlugPlay - ok
11:02:05.0718 3660 [ 3B6973D60BDE757C53BB76842D31318E ] Point32 C:\WINDOWS\system32\DRIVERS\point32.sys
11:02:05.0781 3660 Point32 - ok
11:02:05.0781 3660 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
11:02:05.0843 3660 PolicyAgent - ok
11:02:05.0859 3660 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:02:05.0921 3660 PptpMiniport - ok
11:02:05.0921 3660 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
11:02:05.0984 3660 ProtectedStorage - ok
11:02:06.0000 3660 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
11:02:06.0078 3660 PSched - ok
11:02:06.0093 3660 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:02:06.0156 3660 Ptilink - ok
11:02:06.0187 3660 [ 153D02480A0A2F45785522E814C634B6 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:02:06.0203 3660 PxHelp20 - ok
11:02:06.0250 3660 [ B607F201293E884F36F9A2AC2C960853 ] QCMerced C:\WINDOWS\system32\DRIVERS\LVCM.sys
11:02:06.0468 3660 QCMerced - ok
11:02:06.0468 3660 ql1080 - ok
11:02:06.0468 3660 Ql10wnt - ok
11:02:06.0468 3660 ql12160 - ok
11:02:06.0484 3660 ql1240 - ok
11:02:06.0484 3660 ql1280 - ok
11:02:06.0515 3660 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:02:06.0609 3660 RasAcd - ok
11:02:06.0640 3660 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll
11:02:06.0718 3660 RasAuto - ok
11:02:06.0734 3660 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:02:06.0812 3660 Rasl2tp - ok
11:02:06.0859 3660 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll
11:02:06.0937 3660 RasMan - ok
11:02:06.0968 3660 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:02:07.0046 3660 RasPppoe - ok
11:02:07.0062 3660 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
11:02:07.0156 3660 Raspti - ok
11:02:07.0171 3660 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:02:07.0265 3660 Rdbss - ok
11:02:07.0265 3660 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:02:07.0343 3660 RDPCDD - ok
11:02:07.0375 3660 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
11:02:07.0390 3660 RDPWD - ok
11:02:07.0437 3660 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
11:02:07.0515 3660 RDSessMgr - ok
11:02:07.0546 3660 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
11:02:07.0640 3660 redbook - ok
11:02:07.0671 3660 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
11:02:07.0750 3660 RemoteAccess - ok
11:02:07.0812 3660 [ 2D84428075CE90F1B8882D54960C7000 ] RichVideo C:\Programme\CyberLink\Shared files\RichVideo.exe
11:02:07.0812 3660 RichVideo - ok
11:02:07.0812 3660 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe
11:02:07.0890 3660 RpcLocator - ok
11:02:07.0921 3660 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll
11:02:07.0937 3660 RpcSs - ok
11:02:07.0984 3660 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe
11:02:08.0046 3660 RSVP - ok
11:02:08.0078 3660 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe
11:02:08.0140 3660 SamSs - ok
11:02:08.0140 3660 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
11:02:08.0203 3660 SCardSvr - ok
11:02:08.0250 3660 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll
11:02:08.0343 3660 Schedule - ok
11:02:08.0359 3660 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:02:08.0437 3660 Secdrv - ok
11:02:08.0453 3660 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll
11:02:08.0515 3660 seclogon - ok
11:02:08.0531 3660 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll
11:02:08.0609 3660 SENS - ok
11:02:08.0640 3660 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
11:02:08.0718 3660 serenum - ok
11:02:08.0734 3660 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
11:02:08.0812 3660 Serial - ok
11:02:08.0890 3660 [ 58D5BFDF3ADF49FE9CABD78CC61D92F6 ] ServiceLayer C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
11:02:08.0937 3660 ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
11:02:08.0937 3660 ServiceLayer - detected UnsignedFile.Multi.Generic (1)
11:02:08.0968 3660 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
11:02:09.0062 3660 Sfloppy - ok
11:02:09.0093 3660 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
11:02:09.0187 3660 SharedAccess - ok
11:02:09.0218 3660 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
11:02:09.0218 3660 ShellHWDetection - ok
11:02:09.0218 3660 Simbad - ok
11:02:09.0281 3660 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Programme\Skype\Updater\Updater.exe
11:02:09.0296 3660 SkypeUpdate - ok
11:02:09.0328 3660 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
11:02:09.0390 3660 SLIP - ok
11:02:09.0390 3660 Sparrow - ok
11:02:09.0421 3660 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
11:02:09.0515 3660 splitter - ok
11:02:09.0546 3660 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
11:02:09.0593 3660 Spooler - ok
11:02:09.0609 3660 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
11:02:09.0703 3660 sr - ok
11:02:09.0734 3660 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll
11:02:09.0796 3660 srservice - ok
11:02:09.0843 3660 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
11:02:09.0890 3660 Srv - ok
11:02:09.0906 3660 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
11:02:10.0000 3660 SSDPSRV - ok
11:02:10.0015 3660 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
11:02:10.0015 3660 ssmdrv - ok
11:02:10.0046 3660 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll
11:02:10.0156 3660 stisvc - ok
11:02:10.0171 3660 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
11:02:10.0250 3660 streamip - ok
11:02:10.0281 3660 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
11:02:10.0375 3660 swenum - ok
11:02:10.0390 3660 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
11:02:10.0484 3660 swmidi - ok
11:02:10.0484 3660 SwPrv - ok
11:02:10.0500 3660 symc810 - ok
11:02:10.0500 3660 symc8xx - ok
11:02:10.0500 3660 sym_hi - ok
11:02:10.0500 3660 sym_u3 - ok
11:02:10.0531 3660 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
11:02:10.0593 3660 sysaudio - ok
11:02:10.0625 3660 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
11:02:10.0703 3660 SysmonLog - ok
11:02:10.0734 3660 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
11:02:10.0828 3660 TapiSrv - ok
11:02:10.0859 3660 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:02:10.0890 3660 Tcpip - ok
11:02:10.0921 3660 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
11:02:10.0984 3660 TDPIPE - ok
11:02:11.0000 3660 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
11:02:11.0078 3660 TDTCP - ok
11:02:11.0093 3660 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
11:02:11.0156 3660 TermDD - ok
11:02:11.0187 3660 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll
11:02:11.0250 3660 TermService - ok
11:02:11.0281 3660 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll
11:02:11.0281 3660 Themes - ok
11:02:11.0296 3660 TosIde - ok
11:02:11.0343 3660 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll
11:02:11.0437 3660 TrkWks - ok
11:02:11.0468 3660 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
11:02:11.0546 3660 Udfs - ok
11:02:11.0546 3660 ultra - ok
11:02:11.0578 3660 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
11:02:11.0671 3660 Update - ok
11:02:11.0703 3660 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll
11:02:11.0781 3660 upnphost - ok
11:02:11.0781 3660 upperdev - ok
11:02:11.0812 3660 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe
11:02:11.0875 3660 UPS - ok
11:02:11.0906 3660 [ 73B41F4EAD65F355962168D766AF0F2E ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
11:02:11.0937 3660 USBAAPL - ok
11:02:11.0968 3660 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
11:02:12.0031 3660 usbaudio - ok
11:02:12.0046 3660 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:02:12.0140 3660 usbccgp - ok
11:02:12.0156 3660 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:02:12.0218 3660 usbehci - ok
11:02:12.0265 3660 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:02:12.0343 3660 usbhub - ok
11:02:12.0359 3660 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
11:02:12.0421 3660 usbprint - ok
11:02:12.0437 3660 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:02:12.0515 3660 usbscan - ok
11:02:12.0531 3660 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:02:12.0593 3660 USBSTOR - ok
11:02:12.0625 3660 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:02:12.0687 3660 usbuhci - ok
11:02:12.0718 3660 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
11:02:12.0796 3660 VgaSave - ok
11:02:12.0796 3660 ViaIde - ok
11:02:12.0828 3660 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
11:02:12.0906 3660 VolSnap - ok
11:02:12.0921 3660 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe
11:02:13.0000 3660 VSS - ok
11:02:13.0015 3660 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll
11:02:13.0109 3660 W32Time - ok
11:02:13.0109 3660 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:02:13.0171 3660 Wanarp - ok
11:02:13.0250 3660 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
11:02:13.0281 3660 Wdf01000 - ok
11:02:13.0281 3660 WDICA - ok
11:02:13.0312 3660 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
11:02:13.0390 3660 wdmaud - ok
11:02:13.0437 3660 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll
11:02:13.0515 3660 WebClient - ok
11:02:13.0578 3660 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
11:02:13.0656 3660 winmgmt - ok
11:02:13.0687 3660 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
11:02:13.0796 3660 WmdmPmSN - ok
11:02:13.0812 3660 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:02:13.0890 3660 WmiApSrv - ok
11:02:13.0984 3660 [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
11:02:14.0046 3660 WMPNetworkSvc - ok
11:02:14.0078 3660 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
11:02:14.0093 3660 WpdUsb - ok
11:02:14.0140 3660 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
11:02:14.0218 3660 WS2IFSL - ok
11:02:14.0250 3660 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll
11:02:14.0312 3660 wscsvc - ok
11:02:14.0328 3660 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
11:02:14.0421 3660 WSTCODEC - ok
11:02:14.0421 3660 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
11:02:14.0515 3660 wuauserv - ok
11:02:14.0546 3660 [ 6FF66513D372D479EF1810223C8D20CE ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:02:14.0609 3660 WudfPf - ok
11:02:14.0625 3660 [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:02:14.0656 3660 WudfRd - ok
11:02:14.0671 3660 [ 575A4190D989F64732119E4114045A4F ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
11:02:14.0734 3660 WudfSvc - ok
11:02:14.0765 3660 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
11:02:14.0859 3660 WZCSVC - ok
11:02:14.0875 3660 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
11:02:15.0000 3660 xmlprov - ok
11:02:15.0046 3660 [ 5867CE254625645345C833510D24F124 ] {95808DC4-FA4A-4C74-92FE-5B863F82066B} C:\Programme\CyberLink\PowerDVD\000.fcl
11:02:15.0062 3660 {95808DC4-FA4A-4C74-92FE-5B863F82066B} - ok
11:02:15.0062 3660 ================ Scan global ===============================
11:02:15.0093 3660 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
11:02:15.0140 3660 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
11:02:15.0140 3660 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
11:02:15.0156 3660 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
11:02:15.0156 3660 [Global] - ok
11:02:15.0156 3660 ================ Scan MBR ==================================
11:02:15.0171 3660 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
11:02:15.0421 3660 \Device\Harddisk0\DR0 - ok
11:02:15.0421 3660 ================ Scan VBR ==================================
11:02:15.0421 3660 [ 376C785BEEC1D172108DE4FE3FAF5DDA ] \Device\Harddisk0\DR0\Partition1
11:02:15.0421 3660 \Device\Harddisk0\DR0\Partition1 - ok
11:02:15.0421 3660 ============================================================
11:02:15.0421 3660 Scan finished
11:02:15.0421 3660 ============================================================
11:02:15.0531 3652 Detected object count: 4
11:02:15.0531 3652 Actual detected object count: 4
11:03:57.0515 3652 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user
11:03:57.0515 3652 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:03:57.0515 3652 ATI Smart ( UnsignedFile.Multi.Generic ) - skipped by user
11:03:57.0515 3652 ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:03:57.0515 3652 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - skipped by user
11:03:57.0515 3652 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:03:57.0515 3652 ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
11:03:57.0515 3652 ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
|
|
01.10.2012, 11:23
| #27 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten Geändert von cosinus (01.10.2012 um 14:19 Uhr) |
|
01.10.2012, 14:14
| #28 |
| | Bundespolizei Trojaner Hallo Cosinus, bin ich blind? Ich sehe in der "Codebox" nichts Liebe Grüße |
|
01.10.2012, 14:19
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner Sry hab mich mal wieder verklickt  Werd schnell korrigieren
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.10.2012, 14:21
| #30 |
| | Bundespolizei Trojaner Kein PRoblem.. ich verstehe nicht ganz was die confi.exe sein soll. Muss ich irgendwas runterladen?? |
|
| Themen zu Bundespolizei Trojaner |
| adobe, adobe flash player, antivir, avg, avira, avira searchfree toolbar, bho, bonjour, branding, bundespolizei trojaner, downloader, einstellungen, explorer, firefox, flash player, helper, home, icq, microsoft, mozilla, object, opera, plug-in, realtek, registry, scan, software, super, trojaner, winlogon |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
