| |
| |||||||
Log-Analyse und Auswertung: Link in Email angeklickt. PC mit Malware infiziert?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.11.2012, 19:29
| #1 |
| |  Link in Email angeklickt. PC mit Malware infiziert? Hallo zusammen, ich habe auf meinem gmx-Account eine E-Mail von meinem Bruder bekommen, die außer einem Link nichts enthalten hat. Ich habe unglücklicherweise darauf geklickt und es hat sich eine Internetseite mit dem Hinweis „der gesuchte Link konnte nicht gefunden werden“ geöffnet. Dummerweise habe ich die Email mit dem Link schon gelöscht. Ich habe auf meinem PC BullGuard laufen. Der durchgeführte Vollscan hat nichts ergeben. Vielleicht könnt ihr mir helfen wie ich herausfinde, ob sich eine Malware auf meinem PC befindet? Habe mich etwas in eurem Forum eingelesen und die aufgeführte Liste abgearbeitet: 1. defogger disabled 2. OTL Quickscan 3. Gmer Scan Ich musste ihn zwei Mal durchführen, da er beim ersten Mal abgestürzt ist. Beim zweiten Mal lief er ohne Probleme durch. Vielen Dank! Grüße c.j. OTL Code: Code:
ATTFilter OTL logfile created on: 04.11.2012 15:54:49 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Chrissi\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1022,07 Mb Total Physical Memory | 627,79 Mb Available Physical Memory | 61,42% Memory free 2,00 Gb Paging File | 1,32 Gb Available in Paging File | 66,04% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 129,51 Gb Total Space | 26,94 Gb Free Space | 20,80% Space Free | Partition Type: NTFS Drive D: | 19,52 Gb Total Space | 13,13 Gb Free Space | 67,26% Space Free | Partition Type: FAT32 Computer Name: USCHI | User Name: Chrissi | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.04 14:31:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Chrissi\Desktop\OTL.exe PRC - [2012.10.02 11:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.09.12 17:30:41 | 001,756,512 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuard.exe PRC - [2012.08.24 13:56:22 | 000,321,376 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe PRC - [2012.08.24 13:56:16 | 000,178,528 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardScanner.exe PRC - [2012.08.24 13:52:53 | 000,304,480 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.07.12 17:11:40 | 000,892,928 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2010.05.08 12:48:36 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe PRC - [2010.05.08 12:48:26 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe PRC - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe ========== Modules (No Company Name) ========== MOD - [2012.08.24 13:56:19 | 000,482,656 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\SQLite.dll MOD - [2012.08.24 13:56:19 | 000,450,400 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\LibXml2.dll MOD - [2012.07.12 17:12:16 | 000,880,640 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\fsk.dll MOD - [2012.07.12 17:11:40 | 000,143,360 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\readerAppHelper.dll MOD - [2012.07.12 17:11:06 | 000,172,032 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\USBDetector.dll MOD - [2012.07.12 17:10:48 | 000,018,432 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskNetInterface.dll MOD - [2012.07.12 17:10:46 | 000,009,728 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskPower.dll MOD - [2012.07.12 17:10:44 | 000,020,480 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskinLocalize.dll MOD - [2012.07.12 17:10:44 | 000,008,704 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll MOD - [2012.07.12 17:10:42 | 000,028,160 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\ticket.dll MOD - [2012.07.12 17:10:42 | 000,012,288 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll MOD - [2012.07.12 17:09:54 | 000,118,784 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll MOD - [2012.07.12 17:09:52 | 000,010,752 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll MOD - [2012.07.12 17:09:50 | 000,233,472 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\Fskin.dll MOD - [2012.07.12 17:09:34 | 000,033,792 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll MOD - [2012.06.23 08:26:53 | 000,073,568 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\zlib1.dll MOD - [2012.05.23 13:50:18 | 000,798,720 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\FskSecurity.dll MOD - [2012.05.23 13:09:32 | 000,086,016 | ---- | M] () -- C:\Programme\Sony\ReaderDesktop\appHelper\ebookUsb.dll MOD - [2012.01.12 10:33:46 | 000,030,848 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\res\de\BpMainRes.dll MOD - [2011.10.12 11:44:44 | 000,072,320 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\res\de\BpBackupRes.dll MOD - [2011.10.10 08:53:20 | 000,014,976 | ---- | M] () -- C:\Programme\BullGuard Ltd\BullGuard\res\de\BpInspectorRes.dll MOD - [2011.09.27 06:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 06:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.05.28 21:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Services (SafeList) ========== SRV - [2012.10.29 17:56:36 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.10.09 19:18:52 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.10.02 11:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.08.24 13:56:25 | 000,227,168 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsFileScan.dll -- (BsFileScan) SRV - [2012.08.24 13:56:24 | 000,457,056 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsFire.dll -- (BsFire) SRV - [2012.08.24 13:56:22 | 000,321,376 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe -- (BsBhvScan) SRV - [2012.08.24 13:56:16 | 000,178,528 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardScanner.exe -- (BsScanner) SRV - [2012.08.24 13:56:12 | 000,218,464 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsMain.dll -- (BsMain) SRV - [2012.08.24 13:56:10 | 000,398,688 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsMailProxy\BsMailProxy.dll -- (BsMailProxy) SRV - [2012.08.24 13:52:53 | 000,304,480 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate.exe -- (BsUpdate) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.06.14 17:19:34 | 000,060,256 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsBackup.dll -- (BsBackup) SRV - [2012.05.23 13:52:58 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service) SRV - [2011.03.18 18:06:54 | 000,204,883 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung\Samsung Networking Wizard\ICM_Service.exe -- (ICM_UpdaterService) SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.05.08 12:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe) SRV - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbfake.sys -- (hwusbfake) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Chrissi\AppData\Local\Temp\bDMusicb.sys -- (bDMusicb) DRV - [2012.06.23 08:27:25 | 000,033,920 | R--- | M] (Agnitum Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\Afw.sys -- (AFW) DRV - [2012.06.23 08:26:48 | 000,339,584 | R--- | M] (Agnitum Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AfwCore.sys -- (afwcore) DRV - [2012.01.09 16:11:14 | 000,216,136 | ---- | M] (NovaShield, Inc.) [File_System | System | Running] -- C:\Windows\System32\drivers\NSKernel.sys -- (NovaShieldFilterDriver) DRV - [2012.01.09 16:11:14 | 000,020,040 | ---- | M] (NovaShield, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\NSNetmon.sys -- (NovaShieldTDIDriver) DRV - [2012.01.09 16:11:04 | 000,308,296 | ---- | M] (BitDefender S.R.L.) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Trufos.sys -- (Trufos) DRV - [2012.01.09 16:10:54 | 000,061,152 | ---- | M] (BullGuard Ltd.) [File_System | System | Running] -- C:\Windows\System32\drivers\BdSpy.sys -- (BdSpy) DRV - [2011.04.12 15:26:18 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2011.04.11 20:26:41 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.04.09 15:24:12 | 000,063,616 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2010.04.07 17:05:00 | 000,204,800 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2010.03.25 10:08:38 | 000,105,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2010.03.20 11:56:04 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2010.03.10 12:36:54 | 000,605,568 | ---- | M] (DiBcom) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dvb7700all.sys -- (PCTV340_801) DRV - [2009.12.22 03:31:26 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009.09.19 06:30:10 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009.09.19 06:30:10 | 000,100,224 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bserd.sys -- (ss_bserd) DRV - [2009.09.19 06:30:10 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) DRV - [2009.09.19 06:30:10 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) DRV - [2009.08.24 08:14:30 | 000,044,544 | ---- | M] (AzureWave Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\azvusb.sys -- (azvusb) DRV - [2009.07.13 23:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) DRV - [2009.04.27 13:15:04 | 000,009,216 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter) DRV - [2008.12.01 21:14:34 | 004,179,968 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.03.07 15:28:42 | 000,167,424 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\aver7700.sys -- (aver7700) DRV - [2006.11.30 14:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF) DRV - [2005.11.14 12:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D0 74 DF E3 A0 F9 CB 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.sueddeutsche.de/" FF - prefs.js..extensions.enabledAddons: toolbar@gmx.net:2.3.1 FF - prefs.js..extensions.enabledItems: ff-bmboc@bytemobile.com:4.2.2 FF - prefs.js..network.proxy.type: 4 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@sony.com/ReaderDesktop: C:\Program Files\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\antiphishing@bullguard: c:\program files\bullguard ltd\bullguard\Antiphishing\FF\antiphishing@bullguard\ [2012.04.11 16:43:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.31 16:58:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.20 15:53:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.29 17:56:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.29 17:56:18 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{380AE6CB-09B9-4373-B360-D01C2462A6E7}: C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin [2012.01.28 11:25:46 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Ltd\BullGuard\Spamfilter\TbSpamfilter [2012.06.05 16:19:09 | 000,000,000 | ---D | M] [2011.04.13 07:33:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chrissi\AppData\Roaming\mozilla\Extensions [2011.04.12 16:32:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chrissi\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.10.26 15:30:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chrissi\AppData\Roaming\mozilla\Firefox\Profiles\zwmtuif6.default\extensions [2012.10.05 14:27:36 | 000,509,739 | ---- | M] () (No name found) -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\extensions\toolbar@gmx.net.xpi [2012.10.05 14:27:41 | 000,000,911 | ---- | M] () -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\searchplugins\11-suche.xml [2012.10.05 14:27:42 | 000,002,273 | ---- | M] () -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\searchplugins\englische-ergebnisse.xml [2012.10.05 14:27:41 | 000,010,563 | ---- | M] () -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\searchplugins\gmx-suche.xml [2012.10.05 14:27:42 | 000,002,432 | ---- | M] () -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\searchplugins\lastminute.xml [2012.10.05 14:27:41 | 000,005,545 | ---- | M] () -- C:\Users\Chrissi\AppData\Roaming\mozilla\firefox\profiles\zwmtuif6.default\searchplugins\webde-suche.xml [2012.10.20 15:52:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.10.20 15:52:54 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.10.20 15:52:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012.10.29 19:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\updated\extensions [2012.10.29 19:17:50 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\updated\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.10.29 19:17:50 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\updated\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2012.10.29 19:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\updated\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012.10.31 16:58:53 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.08.26 13:02:10 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.10.04 19:54:44 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.08.26 13:02:10 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.08.26 13:02:10 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.08.26 13:02:10 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.08.26 13:02:10 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe (BullGuard Ltd.) O4 - HKLM..\Run: [Reader Application Helper] C:\Programme\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe (Sony Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data] O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Report to BullGuard - {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - c:\Programme\BullGuard Ltd\BullGuard\Antiphishing\IE\BgAntiphishingIE.dll (BullGuard Ltd.) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.) O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66EA4156-8C09-493C-B266-B8A99F4A0856}: NameServer = 193.189.244.225 193.189.244.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8A3DDD7B-E7A3-4C78-9893-C4C882551C7B}: NameServer = 193.189.244.206 193.189.244.225 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{953A62B5-B2A8-479E-B063-1E275B323129}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AEC4ADC0-DE91-41B0-9B17-006DA50A7C79}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF841078-523A-403C-8855-C1B56B5EFC9C}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5192299-226A-4431-BB76-1B4851B4C03E}: NameServer = 193.189.244.206 193.189.244.225 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (BgGamingMonitor.dll) - C:\Windows\System32\BgGamingMonitor.dll (BullGuard Ltd.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{0652130c-895e-11e0-b999-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{0652130c-895e-11e0-b999-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{11448e7a-7e4a-11e0-9859-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{11448e7a-7e4a-11e0-9859-0040d0a43bef}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{1ade60c9-8c5c-11e0-bed6-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{1ade60c9-8c5c-11e0-bed6-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{21defe5a-7fe4-11e0-b589-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{21defe5a-7fe4-11e0-b589-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{3599b166-77cc-11e1-88f3-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{3599b166-77cc-11e1-88f3-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{3e4bdeae-7eec-11e0-8e99-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{3e4bdeae-7eec-11e0-8e99-806e6f6e6963}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{4c388b0f-5d7b-11e1-b211-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{4c388b0f-5d7b-11e1-b211-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{60fac952-3da4-11e1-a88c-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{60fac952-3da4-11e1-a88c-0040d0a43bef}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{60fac960-3da4-11e1-a88c-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{60fac960-3da4-11e1-a88c-0040d0a43bef}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{7f4f320b-ca6d-11e1-bdc6-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{7f4f320b-ca6d-11e1-bdc6-0040d0a43bef}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{8947777e-8554-11e0-a3e0-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{8947777e-8554-11e0-a3e0-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{cb6872b5-674f-11e0-9566-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{cb6872b5-674f-11e0-9566-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{f61b871f-6460-11e0-a9ba-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{f61b871f-6460-11e0-a9ba-806e6f6e6963}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{f9771e8b-aee3-11e1-85fc-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{f9771e8b-aee3-11e1-85fc-0040d0a43bef}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{fc2c1d6d-533f-11e1-a0d1-0040d0a43bef}\Shell - "" = AutoRun O33 - MountPoints2\{fc2c1d6d-533f-11e1-a0d1-0040d0a43bef}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.04 14:31:06 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Chrissi\Desktop\OTL.exe [2012.11.02 17:52:58 | 000,000,000 | ---D | C] -- C:\Users\Chrissi\Desktop\Fünf Freunde [2012.10.31 17:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2012.10.31 17:58:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.10.31 17:56:42 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.10.29 17:56:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2012.10.20 15:52:42 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.10.09 20:03:46 | 000,000,000 | ---D | C] -- C:\Users\Chrissi\Documents\My Digital Editions [2012.10.09 11:33:19 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2012.10.06 16:52:28 | 000,000,000 | ---D | C] -- C:\ProgramData\kinoma ========== Files - Modified Within 30 Days ========== [2012.11.04 15:48:42 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.04 15:48:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.04 14:53:07 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.04 14:53:07 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.04 14:47:24 | 000,000,512 | ---- | M] () -- C:\Windows\System32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD [2012.11.04 14:45:15 | 803,786,752 | -HS- | M] () -- C:\hiberfil.sys [2012.11.04 14:31:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Chrissi\Desktop\OTL.exe [2012.11.04 14:28:44 | 000,000,020 | ---- | M] () -- C:\Users\Chrissi\defogger_reenable [2012.11.04 14:26:06 | 000,050,477 | ---- | M] () -- C:\Users\Chrissi\Desktop\Defogger.exe [2012.11.02 17:34:46 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.11.02 17:34:46 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.11.02 17:34:46 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.11.02 17:34:46 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.10.09 18:00:51 | 000,673,165 | ---- | M] () -- C:\Users\Chrissi\Desktop\Eco Physics- Checklist.pdf ========== Files Created - No Company Name ========== [2012.11.04 14:47:24 | 000,000,512 | ---- | C] () -- C:\Windows\System32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD [2012.11.04 14:28:10 | 000,000,020 | ---- | C] () -- C:\Users\Chrissi\defogger_reenable [2012.11.04 14:26:03 | 000,050,477 | ---- | C] () -- C:\Users\Chrissi\Desktop\Defogger.exe [2012.10.09 18:00:39 | 000,673,165 | ---- | C] () -- C:\Users\Chrissi\Desktop\Eco Physics- Checklist.pdf [2012.08.28 17:06:37 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll [2012.08.28 17:06:37 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys [2012.05.04 22:51:06 | 000,000,846 | ---- | C] () -- C:\Users\Chrissi\.recently-used.xbel [2011.10.28 08:22:26 | 021,073,936 | ---- | C] () -- C:\Program Files\vlc-1.1.11-win32.exe [2011.09.24 18:04:10 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2011.06.07 10:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2011.06.07 10:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.06.07 10:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.06.07 10:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2011.05.15 16:37:33 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.04.18 12:32:42 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.04.12 16:36:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.04.12 15:45:39 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.02.26 21:10:08 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Amazon [2012.11.04 13:32:43 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\BullGuard [2011.04.11 19:20:19 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Bytemobile [2011.04.25 12:12:40 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Canneverbe Limited [2011.04.11 20:22:25 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\DAEMON Tools [2011.04.12 15:36:12 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\DAEMON Tools Lite [2012.03.30 14:14:47 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Design Science [2012.06.02 13:34:56 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\EAC [2012.06.24 12:43:51 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\fotobuch.de AG [2011.05.29 09:21:14 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\FreeFLVConverter [2012.03.10 22:08:01 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\gtk-2.0 [2012.08.30 13:06:02 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\ICQ [2011.04.25 12:11:25 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\OpenCandy [2012.08.28 17:21:37 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\PC Suite [2011.09.24 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\PDF reDirect [2011.09.24 18:04:26 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\pdfforge [2012.08.28 17:36:51 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Samsung [2011.04.12 15:27:35 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Software Inspection Library [2012.11.01 22:31:30 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\temp [2011.04.12 16:32:28 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Thunderbird [2011.06.30 19:39:04 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Vodafone [2011.05.16 19:45:48 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Vodafone Mobile Broadband [2011.04.11 19:31:29 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\Vodafone Mobile Connect [2012.07.10 17:18:53 | 000,000,000 | ---D | M] -- C:\Users\Chrissi\AppData\Roaming\XMedia Recode ========== Purity Check ========== < End of report > |
| Themen zu Link in Email angeklickt. PC mit Malware infiziert? |
| adobe, adobe flash player, bho, bonjour, defender, e-mail, email, excel, explorer, firefox, flash player, format, gmx.net, icq, infiziert, infiziert?, logfile, malware, microsoft, mozilla, object, plug-in, programme, registry, software, temp, windows, wmp |
Baum-Darstellung