| |
| |||||||
Log-Analyse und Auswertung: Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer FestplatteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
24.02.2013, 16:56
| #1 |
| |  Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte Guten Tag zusammen, seit vergangenen Mittwoch hat mich ein Trojanerangriff in Beschlag. Zunächst war Computer A betroffen. Computer A: Auf Computer A wurde Antivir beschädigt und unbrauchbar gemacht. Es wurde der Trojaner Sirefef.AG.9 gemeldet, der nicht mehr entfernbar war. Auch ein Suchlauf mit mbam war nicht mehr möglich, weil es keinen Zugriff auf Dateien mehr gab. Angeschlossen am PC waren USB-Stick und externe Festplatte. Daraufhin wurden die allerwichtigsten Daten auf der externen Festplatte gesichert und der Computer neu aufgesetzt. Nach Neuinstallation von windows wurden die geretteten Daten wieder von einem zweiten installierten Betriebssystem (Linux) aus wieder auf windows verschoben. In diesem Datenrettungsordner liegen sensible geschäftliche Daten (Onlineshop) sowie meine Diplomarbeit, die kurz vor der Abgabe steht. Die Daten der externen Festplatte müssten unbedingt gerettet werden, weil dort auch meine Backups (Shop) liegen. (Die Diplomarbeit wäre zur Not auch auf dem USB-Stick) Bei einem ersten Suchlauf mit antivier wurde TR/Fakesys def. A.709 und EXP CVE-2013-0422 von Antivir in die Quarantäne geschoben. Diese lagen in dem Ordner App Data/Local/Temp Ein Suchlauf mit mban ergab keine Ergebnisse. Die externe Festplatte wurde seit dem Neuaufsetzen des PC nicht mehr erkannt, so dass ein Befall zunächst nicht festgestellt wurde. Computer B: Die Funktion der externen Festplatte wurde an einem anderen PC überprüft. Am PC B wurde die externe Festplatte ebenfalls nicht erkannt und kurz darauf kam eine Virenmeldung von Antivir. Ein Suchlauf ergab 4 Funde und 2 davon wurden in die Quarantäne verschoben, zweimal Pidief.hck. Ein anschließender Suchlauf mit mban ergab drei Funde: Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.24.03 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 8.0.6001.19088 .... :: .... [Administrator] 24.02.2013 15:17:17 mbam-log-2013-02-24 (15-17-17).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 221077 Laufzeit: 5 Minute(n), 15 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\.....\AppData\Local\Temp\{AA3246D6-AE1E-44B6-97E7-1F4E78E38A3B} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\.....\AppData\Local\Temp\{6349F12E-E1E3-43F2-9CBC-5248416ADB89} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\.....\AppData\Local\Temp\{6EAEA310-381B-469C-B966-B1AEFCE21F2D} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Externe Festplatte: Mittlerweile wurde der Temp Ordner in AppData\Local der externen Festplatte komplett per Hand gelöscht, weil alle bisherigen Virenfunde sich auf diesen Temp-Ordner bezogen, der sowohl auf der externen Festplatte und dem Computer A liegt zur Datenreorganisation. Vom USB-Stick wurde bisher kein Befall gemeldet. Welche nächsten Schritte wären zu unternehmen um wieder stabile Systeme herzustellen? Für Rückfragen bin ich jederzeit erreichbar. Wäre für Unterstützung sehr sehr sehr dankbar. Bis dann Hier kommen noch die Logfiles Computer A: OTL OTL Logfile: Code:
ATTFilter OTL logfile created on: 24.02.2013 17:58:39 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ursula\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 65,47% Memory free 3,98 Gb Paging File | 3,29 Gb Available in Paging File | 82,65% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 97,66 Gb Total Space | 62,14 Gb Free Space | 63,63% Space Free | Partition Type: NTFS Drive D: | 115,38 Gb Total Space | 115,05 Gb Free Space | 99,71% Space Free | Partition Type: NTFS Computer Name: BÜRO-PC | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.24 17:20:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ursula\Downloads\OTL.exe PRC - [2013.02.22 14:48:12 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.02.22 14:43:03 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.02.22 14:42:32 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.02.22 14:42:28 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2009.04.10 23:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2013.02.23 12:22:47 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f042f66c2ad8fd5b8c34fa22cd22079e\System.Management.ni.dll MOD - [2013.02.23 12:21:07 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e64304962098e90f0d3f4c33c1b080a6\System.Windows.Forms.ni.dll MOD - [2013.02.23 12:20:43 | 001,593,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll MOD - [2013.02.23 12:20:41 | 011,820,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\421cb77e6a4c21f94e3c5ddf766de23b\System.Web.ni.dll MOD - [2013.02.23 12:20:32 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll MOD - [2013.02.23 12:20:19 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll MOD - [2013.02.23 12:20:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll MOD - [2013.02.23 12:18:38 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll MOD - [2013.02.23 12:18:32 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll MOD - [2013.02.23 11:22:38 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2758.36900__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 001,675,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2758.36908__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 000,684,032 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2758.37112__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2758.37171__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 000,360,448 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2758.37142__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 000,237,568 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2758.36865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2013.02.23 11:22:37 | 000,184,320 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2758.36922__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2013.02.23 11:22:37 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2758.37134__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2013.02.23 11:22:37 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2758.37090__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2013.02.23 11:22:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2758.36922__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll MOD - [2013.02.23 11:22:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2758.37024__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2013.02.23 11:22:37 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2758.36886__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2013.02.23 11:22:34 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2758.37178__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:34 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2758.37104__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MOD - [2013.02.23 11:22:34 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2758.36879__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:33 | 000,331,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2758.37098__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:33 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2758.37097__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MOD - [2013.02.23 11:22:33 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2758.37163__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll MOD - [2013.02.23 11:22:32 | 000,790,528 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2758.37034__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:32 | 000,589,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2758.36936__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:32 | 000,438,272 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2758.36887__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:32 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2758.37119__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MOD - [2013.02.23 11:22:32 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2758.36929__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:32 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2758.37056__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:32 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2758.37033__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MOD - [2013.02.23 11:22:32 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2758.37055__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MOD - [2013.02.23 11:22:31 | 000,897,024 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2758.37135__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:31 | 000,659,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2758.37091__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:31 | 000,475,136 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2758.37026__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:31 | 000,327,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2758.37019__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MOD - [2013.02.23 11:22:31 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2758.37025__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MOD - [2013.02.23 11:22:31 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2758.36942__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MOD - [2013.02.23 11:22:31 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2758.37032__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MOD - [2013.02.23 11:22:31 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2758.37076__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MOD - [2013.02.23 11:22:31 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2729.30202__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MOD - [2013.02.23 11:22:31 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2729.30197__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2729.30224__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2729.30212__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2729.30222__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MOD - [2013.02.23 11:22:30 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2729.30178__90ba9c70f846762e\CLI.Foundation.dll MOD - [2013.02.23 11:22:30 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2013.02.23 11:22:30 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2013.02.23 11:22:30 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2729.30174__90ba9c70f846762e\LOG.Foundation.dll MOD - [2013.02.23 11:22:30 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2729.30313__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2013.02.23 11:22:30 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2729.30184__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2729.30259__90ba9c70f846762e\DEM.OS.I0602.dll MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2729.30211__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2729.30185__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2729.30207__90ba9c70f846762e\MOM.Foundation.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2729.30242__90ba9c70f846762e\DEM.OS.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2729.30256__90ba9c70f846762e\DEM.Graphics.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2729.30203__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2729.30241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MOD - [2013.02.23 11:22:30 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MOD - [2013.02.23 11:22:29 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MOD - [2013.02.23 11:22:29 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2729.30264__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MOD - [2013.02.23 11:22:29 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2729.30262__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2729.30226__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2729.30227__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2729.30225__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2729.30230__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2729.30213__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2729.30259__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2729.30228__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2729.30212__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2729.30176__90ba9c70f846762e\AEM.Foundation.dll MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll MOD - [2013.02.23 11:22:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2013.02.23 11:22:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2729.30208__90ba9c70f846762e\APM.Foundation.dll MOD - [2013.02.23 11:22:28 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2729.30201__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2013.02.23 11:22:27 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2758.37156__90ba9c70f846762e\MOM.Implementation.dll MOD - [2013.02.23 11:22:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2758.37155__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2013.02.23 11:22:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2729.30193__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2013.02.23 11:22:27 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2758.37201__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MOD - [2013.02.23 11:22:27 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2729.30188__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2013.02.23 11:22:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2729.30258__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2013.02.23 11:22:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2758.37148_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll MOD - [2013.02.23 11:22:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2729.30211__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2013.02.23 11:22:27 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2758.36855__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MOD - [2013.02.23 11:22:26 | 001,507,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2758.36873__90ba9c70f846762e\CLI.Component.Dashboard.dll MOD - [2013.02.23 11:22:26 | 000,471,040 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2758.36895__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2013.02.23 11:22:26 | 000,446,464 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2758.37148__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2013.02.23 11:22:26 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2758.36857__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2013.02.23 11:22:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2729.30209__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2013.02.23 11:22:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2729.30205__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2013.02.23 11:22:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2729.30214__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MOD - [2013.02.23 11:22:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2729.30243__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2013.02.23 11:22:25 | 001,175,552 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.VividDesktop.Dashboard\1.2.2784.25450__90ba9c70f846762e\CLI.AIB.VividDesktop.Dashboard.dll MOD - [2013.02.23 11:22:25 | 000,786,432 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.TutorialOverDrive3.Tutorial.Dashboard\1.2.2784.25451__90ba9c70f846762e\CLI.AIB.TutorialOverDrive3.Tutorial.Dashboard.dll MOD - [2013.02.23 11:22:25 | 000,417,792 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.VividVideoPlayback.Dashboard\1.2.2784.25452__90ba9c70f846762e\CLI.AIB.VividVideoPlayback.Dashboard.dll MOD - [2013.02.23 11:22:25 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard\1.2.2784.25452__90ba9c70f846762e\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.dll MOD - [2013.02.23 11:22:25 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2758.36857__90ba9c70f846762e\ATIDEMOS.dll MOD - [2013.02.23 11:22:25 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2758.36856__90ba9c70f846762e\APM.Server.dll MOD - [2013.02.23 11:22:25 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2758.36855__90ba9c70f846762e\AEM.Server.dll MOD - [2013.02.23 11:22:25 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2758.37156__90ba9c70f846762e\CCC.Implementation.dll MOD - [2013.02.23 11:22:25 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2012.11.29 22:59:32 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll MOD - [2009.03.29 21:42:14 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2009.03.29 21:42:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll MOD - [2009.03.29 21:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2007.08.16 15:24:54 | 001,888,256 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll MOD - [2007.07.22 02:55:20 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll MOD - [2007.01.31 20:55:30 | 000,102,400 | ---- | M] () -- C:\Programme\Common Files\ATI Technologies\Multimedia\atixcode.dll ========== Services (SafeList) ========== SRV - [2013.02.22 14:48:12 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.02.22 14:42:32 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.02.16 01:34:06 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTGLM7X.sys -- (SetupNTGLM7X) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTACCESS.sys -- (NTACCESS) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI) DRV - [2013.02.23 20:37:52 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2013.02.22 14:52:13 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2013.02.22 14:52:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.22 14:52:08 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013.02.22 14:52:03 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2007.07.22 03:05:34 | 002,920,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2006.10.30 16:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.geschenke-spiele.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8a8e2065-4e0e-44ed-8710-3ca076ccf19a&apn_sauid=21C76243-122C-4572-A05B-E8657904FB9B IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Google" FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Ask.com" FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.02.23 18:27:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.21 20:34:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.21 20:34:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions [2013.02.22 14:56:36 | 000,002,344 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\2tskom1z.default\searchplugins\askcom.xml [2013.02.21 20:34:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.02.16 01:34:54 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2013.02.16 05:15:47 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.02.16 05:15:47 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2013.02.16 05:15:47 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2013.02.16 05:15:47 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2013.02.16 05:15:47 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2013.02.16 05:15:47 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F5DB648-A1FA-499C-806F-3254BDFCD5BC}: NameServer = 217.0.43.145,217.0.43.129 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{90537d4c-7c4d-11e2-a139-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{90537d4c-7c4d-11e2-a139-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.24 14:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Gibraltar [2013.02.24 10:57:46 | 000,000,000 | ---D | C] -- C:\Users\Admin\Application Data [2013.02.23 20:26:59 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2013.02.23 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes [2013.02.23 20:26:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.02.23 18:28:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe [2013.02.23 18:28:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Adobe [2013.02.23 16:13:15 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\assembly [2013.02.23 15:12:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2013.02.23 15:12:24 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2013.02.23 14:20:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Canon [2013.02.23 14:20:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities [2013.02.23 14:20:40 | 000,000,000 | ---D | C] -- C:\Program Files\Canon [2013.02.23 14:14:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Swiss Academic Software [2013.02.23 14:14:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Citavi 3 [2013.02.23 14:14:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 3 [2013.02.23 14:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Citavi 3 [2013.02.23 13:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Swiss Academic Software [2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\ATI [2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ATI [2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2013.02.23 11:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2013.02.23 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2013.02.23 11:17:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2013.02.23 11:16:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst-Installationsmanager [2013.02.23 11:15:18 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2013.02.22 20:11:09 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices [2013.02.22 18:27:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ [2013.02.22 17:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client [2013.02.22 17:22:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2013.02.22 15:52:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2013.02.22 15:03:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell [2013.02.22 15:02:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Avira [2013.02.22 14:54:12 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2013.02.22 14:54:11 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2013.02.22 14:54:11 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2013.02.22 14:54:11 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys [2013.02.22 14:54:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2013.02.22 14:54:09 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2013.02.22 11:31:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mondo Media [2013.02.22 11:31:12 | 000,000,000 | ---D | C] -- C:\Program Files\Borland [2013.02.22 11:30:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mondo Media [2013.02.22 11:30:28 | 003,355,096 | ---- | C] (Two Pilots) -- C:\Windows\System32\PDFCreatorPilot3.dll [2013.02.22 11:30:25 | 000,552,960 | ---- | C] (netnorm GmbH) -- C:\Windows\System32\WebTRADESSL.dll [2013.02.22 11:30:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mondo Media [2013.02.22 10:26:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache [2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN [2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES [2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES [2013.02.22 10:02:25 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2013.02.22 09:51:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2013.02.21 22:07:11 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Drucker [2013.02.21 22:00:48 | 000,000,000 | ---D | C] -- C:\20_02_2013 [2013.02.21 20:34:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mozilla [2013.02.21 20:34:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Mozilla [2013.02.21 20:34:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2013.02.21 20:34:27 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2013.02.21 20:34:27 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.02.21 19:56:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2013.02.21 19:56:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office [2013.02.21 19:52:16 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2013.02.21 18:51:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\MigWiz [2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches [2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.02.21 18:49:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities [2013.02.21 18:49:55 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts [2013.02.21 18:49:54 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\VirtualStore [2013.02.21 18:49:52 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop [2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten [2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten [2013.02.21 18:49:52 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData [2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Temp [2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft [2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Programme [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\Windows\Debug [2013.02.21 18:41:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2013.02.21 18:39:00 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2013.02.21 18:38:59 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2013.02.21 18:38:07 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2013.02.21 18:37:53 | 000,000,000 | -HSD | C] -- C:\Boot ========== Files - Modified Within 30 Days ========== [2013.02.24 17:56:59 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.24 17:56:59 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.24 17:56:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.24 17:56:45 | 2010,619,904 | -HS- | M] () -- C:\hiberfil.sys [2013.02.24 14:38:25 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.02.24 14:38:25 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.02.24 14:38:25 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.02.24 14:38:25 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.02.24 14:28:30 | 000,318,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.02.23 20:37:52 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2013.02.23 15:12:46 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2013.02.23 14:20:48 | 000,001,876 | ---- | M] () -- C:\Users\Public\Desktop\MP Navigator EX 1.1.lnk [2013.02.23 14:14:11 | 000,001,836 | ---- | M] () -- C:\Users\Public\Desktop\Citavi 3.lnk [2013.02.23 11:03:17 | 000,000,680 | ---- | M] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2013.02.22 20:09:01 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2013.02.22 19:40:22 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2013.02.22 19:40:22 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2013.02.22 19:40:13 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2013.02.22 15:52:03 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2013.02.22 14:52:13 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2013.02.22 14:52:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys [2013.02.22 14:52:08 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys [2013.02.22 14:52:03 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys [2013.02.22 11:30:35 | 000,000,877 | ---- | M] () -- C:\Users\Admin\Desktop\Mondo Shop 4.lnk [2013.02.22 10:05:29 | 000,131,072 | ---- | M] () -- C:\Windows\SPInstall.etl [2013.02.22 08:31:40 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2013.02.21 20:34:29 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.02.21 18:43:14 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf [2013.02.21 18:42:32 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2013.02.21 18:37:54 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK ========== Files Created - No Company Name ========== [2013.02.23 15:12:46 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2013.02.23 15:12:46 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2013.02.23 14:20:48 | 000,001,876 | ---- | C] () -- C:\Users\Public\Desktop\MP Navigator EX 1.1.lnk [2013.02.23 14:14:11 | 000,001,836 | ---- | C] () -- C:\Users\Public\Desktop\Citavi 3.lnk [2013.02.23 11:24:37 | 2010,619,904 | -HS- | C] () -- C:\hiberfil.sys [2013.02.23 11:17:03 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat [2013.02.23 11:17:03 | 000,328,162 | ---- | C] () -- C:\Windows\System32\drivers\ativcaxx.cpa [2013.02.23 11:17:03 | 000,048,736 | ---- | C] () -- C:\Windows\System32\drivers\ativvpxx.vp [2013.02.23 11:17:03 | 000,011,557 | ---- | C] () -- C:\Windows\atiogl.xml [2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativpkxx.vp [2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativokxx.vp [2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativdkxx.vp [2013.02.23 11:17:03 | 000,000,929 | ---- | C] () -- C:\Windows\System32\drivers\ativcaxx.vp [2013.02.22 20:09:01 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2013.02.22 19:40:13 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2013.02.22 19:04:38 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2013.02.22 19:04:38 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2013.02.22 14:56:45 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2013.02.22 13:59:38 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs [2013.02.22 13:59:38 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml [2013.02.22 13:59:38 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl [2013.02.22 12:02:10 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf [2013.02.22 11:31:12 | 000,184,832 | ---- | C] () -- C:\Windows\System32\BDEADMIN.CPL [2013.02.22 11:30:35 | 000,000,877 | ---- | C] () -- C:\Users\Admin\Desktop\Mondo Shop 4.lnk [2013.02.22 11:30:28 | 000,221,184 | ---- | C] () -- C:\Windows\System32\TidyATL.dll [2013.02.22 09:56:03 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf [2013.02.22 09:56:03 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml [2013.02.22 09:56:03 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml [2013.02.22 09:56:00 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf [2013.02.22 09:55:58 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2013.02.22 09:55:57 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf [2013.02.22 09:55:45 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex [2013.02.22 09:55:45 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF [2013.02.22 09:55:41 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2013.02.22 09:55:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2013.02.22 09:55:40 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs [2013.02.22 09:55:40 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man [2013.02.22 09:55:39 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd [2013.02.22 06:48:21 | 000,131,072 | ---- | C] () -- C:\Windows\SPInstall.etl [2013.02.21 22:00:33 | 000,088,025 | ---- | C] () -- C:\Aktivierungscode AviraAntiVirPremium.eml [2013.02.21 20:34:29 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.02.21 20:34:29 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.02.21 19:57:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2013.02.21 18:50:04 | 000,000,949 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.02.21 18:50:03 | 000,000,944 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2013.02.21 18:49:55 | 000,000,915 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2013.02.21 18:49:53 | 000,000,680 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat [2013.02.21 18:42:59 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk [2013.02.21 18:42:32 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2013.02.21 18:37:54 | 000,008,192 | R-S- | C] () -- C:\BOOTSECT.BAK [2013.02.21 18:37:53 | 000,333,257 | RHS- | C] () -- C:\bootmgr ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 23:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 23:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.02.23 14:21:36 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Canon [2013.02.22 11:31:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mondo Media [2013.02.23 14:16:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Swiss Academic Software ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 3 bytes -> C:\Aktivierungscode AviraAntiVirPremium.eml:OECustomProperty < End of report > OTL ExtrasOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 24.02.2013 17:34:53 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ursula\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 66,76% Memory free
3,99 Gb Paging File | 3,17 Gb Available in Paging File | 79,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,66 Gb Total Space | 62,13 Gb Free Space | 63,62% Space Free | Partition Type: NTFS
Drive D: | 115,38 Gb Total Space | 115,05 Gb Free Space | 99,71% Space Free | Partition Type: NTFS
Computer Name: BÜRO-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{057424B3-1AE5-91BF-E9EF-ED506244D448}" = ATI Catalyst Install Manager
"{0C5D411E-37E3-3618-DF2A-4A7E06C4858D}" = ccc-core-static
"{1E98D1B6-4988-EBF6-8028-6BE44FB06381}" = Skins
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{7433F2C1-F40C-DAF1-58A7-717E39058AF8}" = ccc-utility
"{87C6CEBB-7A5A-3FC6-983E-57509F1A76CB}" = Catalyst Control Center Graphics Light
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9F6ED110-AF1C-5166-F4A6-893D7024C8A5}" = CCC Help German
"{A2DA1DBB-C9F6-6404-6D9C-D4F4523ED78B}" = Catalyst Control Center Graphics Previews Vista
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A7EBE707-EF21-3F23-8280-FB67C0FB8893}" = Catalyst Control Center Graphics Full Existing
"{AA632347-755A-032D-DD4A-9F100D3E70FF}" = Catalyst Control Center Graphics Full New
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{C936CE22-9E2E-65D5-949B-0ACD9E76BC16}" = Catalyst Control Center Core Implementation
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFA20EDB-ACEF-409C-9230-2D5AD7D51882}" = Catalyst Control Center - Branding
"{DC248B14-466D-10D3-1F63-606923AF9687}" = Catalyst Control Center Localization German
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Avira AntiVir Desktop" = Avira Free Antivirus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MONDOSHOP4_is1" = MONDO SHOP 4 deinstallieren
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.1" = Canon MP Navigator EX 1.1
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.6.0.2
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.02.2013 09:11:43 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description =
Error - 24.02.2013 09:11:44 | Computer Name = Büro-PC | Source = Perflib | ID = 1010
Description =
Error - 24.02.2013 09:11:45 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description =
Error - 24.02.2013 09:11:45 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description =
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description =
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description =
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1005
Description =
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1018
Description =
Error - 24.02.2013 09:29:40 | Computer Name = Büro-PC | Source = WinMgmt | ID = 10
Description =
Error - 24.02.2013 09:31:53 | Computer Name = Büro-PC | Source = EventSystem | ID = 4621
Description =
Error - 24.02.2013 09:34:32 | Computer Name = Büro-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 24.02.2013 12:10:46 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:10:50 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:10:54 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:10:58 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:11:02 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:11:06 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:21:44 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:22:59 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:33:49 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
Error - 24.02.2013 12:34:53 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "F:" aus.
< End of report >
GMER Logfile: Code:
ATTFilter GMER 2.1.19081 - hxxp://www.gmer.net
Rootkit scan 2013-02-24 18:45:51
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD321KJ rev.CP100-12 298,09GB
Running: gmer_2.1.19081.exe; Driver: C:\Users\Admin\AppData\Local\Temp\kxldqpog.sys
---- System - GMER 2.1 ----
SSDT 8981F3CE ZwCreateSection
SSDT 8981F3D8 ZwRequestWaitReplyPort
SSDT 8981F3D3 ZwSetContextThread
SSDT 8981F3DD ZwSetSecurityObject
SSDT 8981F3E2 ZwSystemDebugControl
SSDT 8981F36F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 81CF78D8 4 Bytes [CE, F3, 81, 89]
.text ntkrnlpa.exe!KeSetEvent + 539 81CF7BFC 4 Bytes [D8, F3, 81, 89]
.text ntkrnlpa.exe!KeSetEvent + 56D 81CF7C30 4 Bytes [D3, F3, 81, 89]
.text ntkrnlpa.exe!KeSetEvent + 5D1 81CF7C94 4 Bytes [DD, F3, 81, 89]
.text ntkrnlpa.exe!KeSetEvent + 619 81CF7CDC 4 Bytes [E2, F3, 81, 89]
.text ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Otl für Computer B:OTL Logfile: Code:
ATTFilter OTL logfile created on: 24.02.2013 17:31:40 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Klauso\Downloads Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19088) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 50,56% Memory free 3,99 Gb Paging File | 2,82 Gb Available in Paging File | 70,67% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 93,13 Gb Total Space | 48,63 Gb Free Space | 52,22% Space Free | Partition Type: NTFS Computer Name: ARWED | User Name: Klaus | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.24 17:30:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Klauso\Downloads\OTL.exe PRC - [2012.08.28 19:39:37 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.26 18:32:12 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.26 18:32:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.26 18:32:10 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.05.08 09:35:50 | 002,780,432 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe PRC - [2009.05.08 09:34:08 | 000,559,888 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe PRC - [2009.04.30 15:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe PRC - [2009.04.30 13:39:30 | 005,472,016 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Logitech Vid\Vid.exe PRC - [2009.04.20 14:34:18 | 000,816,904 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\Logitech WebCam Software\LU\LogitechUpdate.exe PRC - [2009.04.20 14:34:00 | 000,300,296 | ---- | M] (Logitech, Inc.) -- c:\Programme\Logitech\Logitech WebCam Software\LU\LULnchr.exe PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.05.29 21:30:18 | 002,580,480 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.bin PRC - [2008.05.29 21:28:18 | 002,363,392 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.exe PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.19 08:33:30 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2008.01.19 08:33:04 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2006.12.23 18:05:20 | 000,143,360 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2006.12.23 18:04:42 | 000,905,216 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2006.11.14 14:47:54 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Programme\Common Files\aol\1173082611\ee\aolsoftware.exe PRC - [2006.10.23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Programme\Common Files\aol\acs\AOLacsd.exe ========== Modules (No Company Name) ========== MOD - [2009.05.08 09:35:50 | 002,780,432 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe MOD - [2009.05.08 09:35:28 | 000,181,520 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LvApi11\LvApi11.dll MOD - [2009.04.30 13:39:56 | 000,138,000 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll MOD - [2009.04.30 13:39:56 | 000,035,088 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qico4.dll MOD - [2009.04.30 13:39:52 | 000,028,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll MOD - [2009.04.30 13:39:08 | 000,027,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\SDL.dll MOD - [2009.04.30 13:38:56 | 000,363,792 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtxml4.dll MOD - [2009.04.30 13:38:44 | 011,311,888 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtWebKit4.dll MOD - [2009.04.30 13:38:34 | 000,199,952 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtsql4.dll MOD - [2009.04.30 13:38:22 | 000,968,976 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtNetwork4.dll MOD - [2009.04.30 13:38:22 | 000,475,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtOpenGL4.dll MOD - [2009.04.30 13:38:10 | 007,704,336 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtGui4.dll MOD - [2009.04.30 13:37:58 | 002,140,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtCore4.dll MOD - [2009.04.30 13:37:48 | 000,291,600 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\phonon4.dll MOD - [2007.12.19 14:04:24 | 000,828,416 | ---- | M] () -- C:\Programme\OpenOffice.org 2.4\program\libxml2.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc) SRV - [2012.05.26 18:32:12 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.26 18:32:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2009.04.30 15:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2006.10.23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Programme\Common Files\aol\acs\AOLacsd.exe -- (AOL ACS) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.05.26 18:32:12 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.26 18:32:12 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.05.01 00:03:08 | 006,754,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) DRV - [2009.05.01 00:01:36 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS) DRV - [2009.05.01 00:00:00 | 000,114,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvpopflt.sys -- (lvpopflt) DRV - [2009.04.30 15:00:12 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2007.02.27 15:46:12 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) DRV - [2007.01.15 17:35:18 | 001,032,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD) DRV - [2006.12.22 20:28:56 | 000,100,648 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32) DRV - [2006.12.19 13:38:00 | 004,447,808 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2006.11.01 21:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) DRV - [2000.07.24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BRPAR.SYS -- (BrPar) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2008.09.13 16:52:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.02 10:56:13 | 000,000,000 | ---D | M] [2008.09.13 16:52:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Extensions [2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions [2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions\staged-xpis [2009.03.18 13:40:42 | 000,019,153 | ---- | M] () (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\firefox\profiles\veyedxb5.default\extensions\staged-xpis\{20a82645-c095-46ed-80e3-08825760534b}\MicrosoftDotNetFrameworkAssistant.xpi [2010.06.30 16:23:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.06.30 16:23:24 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.06.30 16:23:24 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1} [2008.12.29 14:45:18 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009.05.27 17:32:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2008.03.15 14:56:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2008.03.15 14:56:14 | 000,002,642 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2008.02.19 15:40:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2006.12.03 16:59:22 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2006.11.17 12:19:24 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O4 - HKLM..\Run: [AuditVista] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HostManager] C:\Programme\Common Files\aol\1173082611\ee\aolsoftware.exe (America Online, Inc.) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b File not found O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{27D05CA5-8F22-4C21-BC26-A9C0C568B630}: NameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35E37816-A589-468D-B729-C310A1F90A5A}: DhcpNameServer = 192.168.15.155 192.168.5.57 192.168.5.56 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img11.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img11.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\configure\command - "" = D:\SETUP.EXE O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\install\command - "" = D:\SETUP.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.24 15:09:57 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Roaming\Malwarebytes [2013.02.24 15:09:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.02.24 15:09:39 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.02.24 15:09:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.02.24 11:34:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2013.02.24 11:33:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2013.02.24 11:33:14 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2013.02.24 11:30:50 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Roaming\Avira [2013.02.24 11:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services [2013.02.24 11:30:24 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW [2013.02.24 11:29:17 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Local\Microsoft Help [2013.02.24 11:29:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2013.02.24 11:28:41 | 000,000,000 | RH-D | C] -- C:\MSOCache ========== Files - Modified Within 30 Days ========== [2013.02.24 17:24:22 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BD8977C5-8EC2-45CD-B800-AF3258EB1DA6}.job [2013.02.24 16:56:39 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.24 16:56:39 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.24 15:54:52 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.02.24 15:54:52 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.02.24 15:54:52 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.02.24 15:54:52 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.02.24 15:50:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.24 15:50:13 | 2012,553,216 | -HS- | M] () -- C:\hiberfil.sys [2013.02.24 15:50:12 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs [2013.02.24 15:09:41 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.02.24 12:03:54 | 000,348,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2013.02.24 15:09:41 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2009.05.27 16:56:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.09.13 22:51:00 | 000,004,608 | ---- | C] () -- C:\Users\Klaus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.08.20 14:49:07 | 000,000,350 | ---- | C] () -- C:\Users\Klaus\AppData\Roaming\wklnhst.dat ========== ZeroAccess Check ========== [2006.11.02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.03.03 05:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.19 08:36:49 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2009.08.04 11:44:15 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\Leadertech [2008.08.20 14:49:08 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\Template ========== Purity Check ========== < End of report > OTL Extras Computer BOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 24.02.2013 17:31:40 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Klauso\Downloads
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 50,56% Memory free
3,99 Gb Paging File | 2,82 Gb Available in Paging File | 70,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 93,13 Gb Total Space | 48,63 Gb Free Space | 52,22% Space Free | Partition Type: NTFS
Computer Name: ARWED | User Name: Klaus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1485476C-2E20-4C40-8F25-88CE2B215957}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{15000049-5F4F-4AA7-A6AE-D33CBF47BC75}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{35D1DA28-3BC7-4415-A8AF-55B1AEE957C8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{423FAA31-4868-4DDA-AC2A-AC20503407E6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{5AE140AE-FBF4-4183-B434-3FB2823C146A}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{5BEB8857-96FA-4C6C-9BC0-62E47C340884}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{74DF1202-B3E2-418F-9DD4-4F644D8609D7}" = protocol=6 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |
"{9012CFB7-5370-483C-8892-E21A79DCC4F3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{9A11F177-A375-449C-B6FC-2A999E8477EE}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{B76C1215-DCC9-4A2C-B3F9-C3EF1FA7A637}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{C58D4E5D-F944-4614-A1A1-923B4AA2ED1A}" = protocol=17 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |
"{C893E4EC-B4E9-40AD-B4E2-3F4AEEBFFF31}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{CE5747C2-8808-4DEE-BD9A-A69462842539}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{E027ED56-32DA-4DE8-929F-5CD341E51A5F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{E9D589B0-5D0D-48CB-9B05-60DFA5D240F5}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{EAAD0F8E-2D82-448E-8D76-DFF0F381EF08}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{F7C4F9A9-D852-4317-8A09-EDE291633015}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"TCP Query User{239C429E-3701-456B-AD5A-0F7542913D27}C:\users\klauso\temp\teamviewer\version4\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\klauso\temp\teamviewer\version4\teamviewer.exe |
"TCP Query User{66AA1513-66A2-4BA8-8FEE-8AEC0715CE28}C:\program files\logitech\logitech vid\vid.exe" = protocol=6 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |
"UDP Query User{7B92BC18-D752-4851-A173-CD156719ABBD}C:\program files\logitech\logitech vid\vid.exe" = protocol=17 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe |
"UDP Query User{7F6884C4-2582-46B8-ABBF-0D1C94F11DC2}C:\users\klauso\temp\teamviewer\version4\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\klauso\temp\teamviewer\version4\teamviewer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch
"{AC96671C-2001-432C-9826-5266D84EF1DC}" = Logitech Webcam Software
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E5488A81-631F-47FC-AAB8-03A0F87D1031}" = Nero 7 Essentials
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1PLUS_2007.a_is1" = 1PLUS_2007.a
"1PLUS_2007.d_is1" = 1PLUS_2007.d (Portable Version, unabhängig von der BDE)
"1PLUS_2007.e_is1" = 1PLUS_2007.e (Portable Version, unabhängig von der BDE)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Deinstallation" = AOL Deinstallation
"Avira AntiVir Desktop" = Avira Free Antivirus
"Brother HL-1430" = Brother HL-1430
"DivX Codec" = DivX Codec
"lvdrivers_12.0" = Logitech Webcam Software-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.0.1)" = Mozilla Firefox (3.0.1)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Schroedel Arbeitsblätter" = Schroedel Arbeitsblätter
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 02.02.2012 05:56:17 | Computer Name = Arwed | Source = Windows Search Service | ID = 3026
Description =
Error - 02.02.2012 05:56:55 | Computer Name = Arwed | Source = Application Hang | ID = 1002
Description = Programm avcenter.exe, Version 12.1.0.18 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: e00 Anfangszeit: 01cce190c34465db Zeitpunkt der Beendigung:
23
Error - 26.05.2012 13:33:17 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 26.05.2012 13:33:17 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 20.07.2012 12:32:33 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Vid.exe, Version 6.0.6902.0, Zeitstempel 0x49fa0c46,
fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
0xc0000094, Fehleroffset 0x00009520, Prozess-ID 0x18c, Anwendungsstartzeit 01cd66952ce2374b.
Error - 28.08.2012 14:41:46 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 16.09.2012 16:00:26 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Vid.exe, Version 6.0.6902.0, Zeitstempel 0x49fa0c46,
fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
0xc0000094, Fehleroffset 0x00009520, Prozess-ID 0x1d4, Anwendungsstartzeit 01cd9445d4671b49.
Error - 23.02.2013 11:58:06 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Skype.exe, Version 4.2.0.169, Zeitstempel 0x4bebfa84,
fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
0xc0000094, Fehleroffset 0x00009520, Prozess-ID 0x130, Anwendungsstartzeit 01ce11de5bb79f2b.
Error - 23.02.2013 13:13:38 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung brsvc01a.exe, Version 1.0.0.3, Zeitstempel 0x3cb65dc7,
fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode
0xc0000005, Fehleroffset 0x00000000, Prozess-ID 0x5b4, Anwendungsstartzeit 01ce11de599b6e1b.
Error - 24.02.2013 06:28:24 | Computer Name = Arwed | Source = VSS | ID = 8194
Description =
[ System Events ]
Error - 24.02.2013 08:52:49 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:52:53 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:52:56 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:52:59 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:53:01 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:53:29 | Computer Name = Arwed | Source = Service Control Manager | ID = 7000
Description =
Error - 24.02.2013 08:53:52 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 08:53:55 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 24.02.2013 10:50:26 | Computer Name = Arwed | Source = HTTP | ID = 15016
Description =
Error - 24.02.2013 10:51:12 | Computer Name = Arwed | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Gmer Computer B: GMER Logfile: Code:
ATTFilter GMER 2.1.19081 - hxxp://www.gmer.net
Rootkit scan 2013-02-24 19:09:43
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000052 ST332082 rev.3.AA 298,09GB
Running: gmer_2.1.19081.exe; Driver: C:\Users\.....\AppData\Local\Temp\pxldrpow.sys
---- System - GMER 2.1 ----
SSDT 8B509FC6 ZwCreateSection
SSDT 8B509FD0 ZwRequestWaitReplyPort
SSDT 8B509FCB ZwSetContextThread
SSDT 8B509FD5 ZwSetSecurityObject
SSDT 8B509FDA ZwSystemDebugControl
SSDT 8B509F67 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetTimerEx + 448 820EBA6C 4 Bytes [C6, 9F, 50, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 76C 820EBD90 4 Bytes [D0, 9F, 50, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 7A0 820EBDC4 4 Bytes [CB, 9F, 50, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 804 820EBE28 4 Bytes [D5, 9F, 50, 8B]
.text ntkrnlpa.exe!KeSetTimerEx + 84C 820EBE70 4 Bytes [DA, 9F, 50, 8B]
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8B60F340, 0x293157, 0xE8000020]
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Processes - GMER 2.1 ----
Process (*** hidden *** ) [4] 84173BD8
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS@StateIndex 0
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Ich werde heute Computer A neu aufsetzen, weil sich die ersten Programme schon wieder verabschieden. |
|
25.02.2013, 09:38
| #2 |
| /// Malwareteam    | Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte Mein Name ist Marius und ich werde dir bei deinem Problem helfen. Eines vorneweg: Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellste und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein Rechner clean ist. Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
Vista und Win7 User Alle Tools mit Rechtsklick --> "als Administrator ausführen" starten. Wir kümmern uns hier ausschließlich um Computer B - wenn du die Festplatte von Computer A bei der Neuinstallation komplett formatiert hast, besteht dort ohnehin keine Gefahr mehr. Wenn dem nicht so ist, gib Bescheid. Scan mit TDSS-Killer Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ |
|
26.02.2013, 13:30
| #3 |
| | Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte Hallo
__________________und vielen Dank für die Unterstützung. Seit dem Neuaufsetzen scheint Computer A stabil zu laufen, so dass ich weiterarbeiten kann. Da mir im Moment die zeitlichen Ressourcen fehlen, kann ich mich nicht zeitnah um Computer B kümmern und würde das auf später verschieben. Er wird im Moment nicht gebraucht. Wäre es möglich diesen Threat zu löschen, weil einige persönliche Daten in der Eile in den logfiles nicht gelöscht wurden. Das wäre mir sehr recht!!! Vielen Dank nochmals für das Angebot Trojanerboard, es ist sehr hilfreich.  |
|
26.02.2013, 13:35
| #4 | |
| /// Malwareteam | Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer FestplatteZitat:
---------------------------------------------------------------------------------------------- Dieses Thema scheint erledigt und wurde aus meinen Abos gelöscht. Solltest du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und ein eigenes Thema erstellen!
__________________ Kein Asylrecht für Trojaner!  Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
| Themen zu Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte |
| administrator, anti-malware, antivir, appdata, autostart, befall, betriebssystem, branding, computer, dateien, erkannt, explorer, fast start, festgestellt, festplatte, gelöscht, install.exe, linux, neu, neu aufsetzen, nicht mehr, not, onlineshop, plug-in, speicher, systeme, trojan.p2p.worm, trojaner, unbedingt, unknown mbr, vista, windows, zugriff |
Linear-Darstellung
