| |
| |||||||
Log-Analyse und Auswertung: mydirtyhobby.com RechnungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.04.2013, 14:46
| #2 | |
| /// TB-Ausbilder   |  mydirtyhobby.com Rechnung Hallo flizu,
__________________Zitat:
(Die Logfiles bitte nicht anhängen (das erschwert mir das Auswerten massiv), sondern deren Inhalt direkt innerhalb von Codetags einfügen: [code]Inhalt Logfile[/code].)
__________________ |
|
14.04.2013, 21:41
| #3 |
| | mydirtyhobby.com Rechnung anbei die Logfiles
__________________ |
|
14.04.2013, 21:56
| #4 |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Ja, da läuft noch was... Hast du auch noch das Logfile von Gmer?
__________________ cheers, Leo |
|
15.04.2013, 08:45
| #5 |
| |  mydirtyhobby.com Rechnung hi, ja hab ich und schick es! sorry gestern vergessen und shconmal danke für die HIlfe! Mfg |
|
15.04.2013, 13:28
| #6 | |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Hi, dann so weiter: Schritt 1 Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.
Schritt 2 Warnung für Mitleser: Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix.
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Schritt 3
Code:
ATTFilter reg query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0" /c
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}" /s /c
Bitte poste in deiner nächsten Antwort:
__________________ --> mydirtyhobby.com Rechnung |
|
15.04.2013, 21:32
| #7 |
| | mydirtyhobby.com Rechnung Hi, so nun endlich nach der Arbeit geschafft deine aufträge aus zuführen! Hoffe ich hab alles richtig gemacht! Gruss |
|
15.04.2013, 22:19
| #8 |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Hallo, vom Schritt 3 hast du eine alte Extras.txt gepostet. Davon bräuchte ich aber die aktuelle OTL.txt. Kannst du diese bitte noch nachreichen?  (Die Logfiles bitte nicht anhängen (das erschwert mir das Auswerten massiv), sondern deren Inhalt direkt innerhalb von Codetags einfügen: [code]Inhalt Logfile[/code].)
__________________ cheers, Leo |
|
16.04.2013, 22:09
| #9 |
| | mydirtyhobby.com RechnungCode:
ATTFilter OTL logfile created on: 16.04.2013 22:52:48 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Winzler\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1022,42 Mb Total Physical Memory | 405,61 Mb Available Physical Memory | 39,67% Memory free 2,40 Gb Paging File | 1,88 Gb Available in Paging File | 78,31% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 93,16 Gb Total Space | 59,20 Gb Free Space | 63,55% Space Free | Partition Type: NTFS Computer Name: NAME-5DDFE97525 | User Name: Winzler | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe PRC - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.29 18:44:18 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.03.29 18:44:16 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2013.02.10 23:32:21 | 000,295,072 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Real\RealPlayer\Update\realsched.exe PRC - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.11.29 21:33:04 | 000,232,608 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\RealNetworks\RealDownloader\recordingmanager.exe PRC - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe PRC - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe PRC - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.03.07 16:29:36 | 002,658,304 | ---- | M] (LG Electronics) -- C:\Programme\LG Software\On Screen Display\HotKey.exe PRC - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2013.02.24 10:27:58 | 000,397,704 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2010.04.15 12:54:42 | 000,187,528 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsEngineRes407.dll MOD - [2010.04.15 12:51:22 | 000,126,088 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsSQLBackupRestore.dll MOD - [2010.03.29 08:36:50 | 000,005,120 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\throttle.dll MOD - [2002.05.28 19:11:04 | 000,122,880 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.03.17 17:24:35 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.12.19 10:49:34 | 000,732,648 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service) SRV - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) [Auto | Running] -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe -- (nsService) SRV - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) [Auto | Running] -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService) SRV - [2007.03.11 23:02:52 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007.03.11 22:24:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMon) SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\VcommMgr.sys -- (VcommMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VComm.sys -- (VComm) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PFC027.SYS -- (PAC207) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDRm.sys -- (InCDRm) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDPass.sys -- (InCDPass) DRV - File not found [File_System | Disabled | Stopped] -- system32\drivers\InCDFs.sys -- (InCDFs) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Winzler\LOKALE~1\Temp\catchme.sys -- (catchme) DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vbtenum.sys -- (BTHidEnum) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\btcusb.sys -- (Btcsrusb) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btnetdrv.sys -- (BT) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\blueletaudio.sys -- (BlueletAudio) DRV - [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.24 10:28:17 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.11.20 12:00:58 | 000,027,496 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VirtualAudio.sys -- (WsAudio_Device) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2012.11.09 16:33:30 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2012.11.09 16:33:30 | 000,018,560 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2012.10.17 14:53:46 | 000,019,072 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1) DRV - [2008.09.12 15:30:19 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PzWDM.sys -- (PzWDM) DRV - [2007.05.02 04:52:00 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2006.06.28 22:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.05.03 13:50:42 | 001,540,608 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006.02.13 12:15:36 | 000,075,648 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGR1310_51.sys -- (AGR1310_51) DRV - [2006.01.13 10:13:18 | 004,137,984 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) DRV - [2006.01.08 08:12:42 | 000,117,906 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATSwpDrv.sys -- (ATSWPDRV) DRV - [2005.12.04 17:55:30 | 001,428,096 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) DRV - [2005.11.18 12:17:28 | 000,036,352 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2005.08.31 07:15:42 | 000,015,616 | R--- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LGDMEBTN.sys -- (LGDMEBTN) DRV - [2005.01.07 18:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{4A34A1E9-98FF-4AC6-97EA-540E02FFF2C0}: "URL" = hxxp://www.bing.com/search?FORM=IP2TDF&PC=IP2TDF&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{5E15021D-0131-4EE7-B7D0-916B056B7E74}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=7f3f2787-c059-4300-89bd-661bf15abd6b&apn_sauid=5512EBCF-C3B9-4267-879F-56A98812D092 IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADBF_de IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Programme\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2012.05.18 15:17:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013.02.10 23:33:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013.02.10 23:33:33 | 000,000,000 | ---D | M] [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.04.15 21:54:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Firefox\Profiles\6yseursn.default\extensions O1 HOSTS File: ([2013.04.15 22:15:08 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found. O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation) O4 - HKLM..\Run: [KeybdUtility] C:\Programme\LG Software\On Screen Display\HotKey.exe (LG Electronics) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube Download - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytmp3downloader.htm () O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: cleverreach.com ([novastor] http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: google-analytics.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]https in Vertrauenswürdige Sites) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Java Plug-in 1.4.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17960938-DAA4-433D-A851-95A83AB8B690}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.03.22 06:03:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.16 22:46:08 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2013.04.15 22:22:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:05:09 | 000,000,000 | RHSD | C] -- C:\cmdcons [2013.04.15 22:01:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2013.04.15 22:01:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2013.04.15 22:01:51 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2013.04.15 22:01:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2013.04.15 22:01:38 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.04.15 22:01:32 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Winzler\Startmenü\Programme\Verwaltung [2013.04.15 22:01:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt [2013.04.15 22:00:24 | 005,054,270 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.10 07:58:12 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\64F232C6 [2013.03.25 23:13:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Sun [2009.04.20 12:01:52 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.16 22:45:24 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.04.16 22:44:53 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.16 22:44:53 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.16 22:44:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.04.16 22:44:41 | 1072,156,672 | -HS- | M] () -- C:\hiberfil.sys [2013.04.15 22:24:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:15:08 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2013.04.15 22:05:16 | 000,000,327 | RHS- | M] () -- C:\boot.ini [2013.04.15 22:00:24 | 005,054,270 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.15 21:57:11 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.15 21:53:58 | 000,613,083 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 23:30:10 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.14 13:12:35 | 000,267,800 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013.04.14 10:04:05 | 000,377,856 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 22:38:00 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.11 21:52:36 | 000,499,326 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:07 | 000,580,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2013.04.10 00:36:21 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2013.04.10 00:00:06 | 000,463,436 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2013.04.10 00:00:06 | 000,444,902 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2013.04.10 00:00:06 | 000,086,280 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2013.04.10 00:00:06 | 000,072,778 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.15 22:05:16 | 000,000,211 | ---- | C] () -- C:\Boot.bak [2013.04.15 22:05:11 | 000,262,448 | RHS- | C] () -- C:\cmldr [2013.04.15 22:01:51 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe [2013.04.15 22:01:51 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe [2013.04.15 22:01:51 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2013.04.15 22:01:51 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2013.04.15 22:01:51 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2013.04.15 21:53:57 | 000,613,083 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 10:04:02 | 000,377,856 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 21:52:36 | 000,499,326 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:06 | 000,580,968 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2012.06.03 10:03:40 | 003,224,576 | ---- | C] () -- C:\Programme\Gemeinsame DateienDDBACSetup.msi [2012.04.15 17:40:22 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.02.15 14:27:46 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.01.02 12:06:38 | 000,001,057 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\vso_ts_preview.xml [2009.07.03 23:37:30 | 001,456,640 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\Falk Navi-Manager.msi [2009.06.28 13:08:39 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc [2009.06.28 12:42:55 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\$_hpcst$.hpc [2009.04.20 12:01:52 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\inst.exe [2009.04.20 12:01:52 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.cat [2009.04.20 12:01:52 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.inf [2008.09.12 22:31:49 | 000,000,168 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.dat [2008.09.12 22:31:48 | 000,000,255 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.tif [2007.02.09 00:19:26 | 000,000,157 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\default.pls [2006.12.18 23:09:51 | 000,018,944 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006.11.22 17:05:36 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.11.22 00:39:10 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat ========== ZeroAccess Check ========== [2006.03.22 09:13:44 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.09.25 07:35:26 | 001,509,888 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.02.24 16:32:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.12.09 15:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.09.13 20:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2012.01.30 15:17:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dvdfab [2011.11.01 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2013.02.10 22:57:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON [2013.04.15 21:54:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Infineon [2013.02.16 19:05:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia [2010.11.28 01:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2011.01.01 22:08:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NovaStor [2010.11.28 03:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2008.06.11 15:22:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL [2009.04.20 12:52:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vsosdk [2010.04.18 10:38:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\Infineon [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\SRSCPL [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Infineon [2013.02.10 20:24:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\SRSCPL [2013.02.10 21:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Thunderbird [2013.04.14 09:55:01 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\64F232C6 [2012.12.09 15:05:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.12.08 20:36:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Installer [2009.12.08 20:39:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Programme [2010.11.27 22:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DataLayer [2012.12.09 17:33:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDFab [2013.02.10 23:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDVideoSoft [2011.11.01 15:35:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\elsterformular [2008.08.23 19:36:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EPSON [2007.01.13 22:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EverAd [2010.02.08 14:41:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Gutscheinmieze [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Infineon [2010.02.08 12:45:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\mmserver [2011.01.01 21:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\NASNaviator2 [2013.02.10 18:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia [2010.11.28 03:33:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Ovi Suite [2013.02.10 18:00:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Suite [2013.02.10 18:00:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\SRSCPL [2010.11.23 10:09:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Thunderbird [2012.08.06 22:27:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Vso ========== Purity Check ========== ========== Custom Scans ========== < reg query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0" /c > ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI PORT 0 DMAEnabled REG_DWORD 0x1 Driver REG_SZ atapi HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SCSI\SCSI PORT 0\Scsi Bus 0 < reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}" /s /c > ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318} Class REG_SZ hdc <NO NAME> REG_SZ IDE ATA/ATAPI-Controller Icon REG_SZ -9 Installer32 REG_SZ SysSetup.Dll,HdcClassInstaller TroubleShooter-0 REG_SZ hcp://help/tshoot/tsdrive.htm HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0000 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0001 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0002 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x2 SlaveDeviceType REG_DWORD 0x0 SlaveDeviceDetectionTimeout REG_DWORD 0x1 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0003 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x0 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0004 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0005 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0006 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal SlaveDeviceDetectionTimeout REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 MasterDeviceType REG_DWORD 0x2 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 MasterIdDataCheckSum REG_DWORD 0x10f9d HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0007 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0008 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0009 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal SlaveDeviceDetectionTimeout REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 MasterDeviceType REG_DWORD 0x2 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0010 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0011 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0012 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x2 SlaveDeviceType REG_DWORD 0x0 SlaveDeviceDetectionTimeout REG_DWORD 0x1 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0013 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0014 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0015 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal SlaveDeviceDetectionTimeout REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 MasterDeviceType REG_DWORD 0x2 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0016 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0017 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0018 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal SlaveDeviceDetectionTimeout REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 MasterDeviceTimingMode REG_DWORD 0x2010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 MasterDeviceType REG_DWORD 0x2 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0019 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0020 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0021 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0022 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0023 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0024 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0025 InfPath REG_SZ oem0.inf InfSection REG_SZ iaStor_mobl_Inst ProviderName REG_SZ Intel DriverDateData REG_BINARY 008073E3BFCEC501 DriverDate REG_SZ 10-12-2005 DriverVersion REG_SZ 5.5.0.1035 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c5&cc_0106 DriverDesc REG_SZ Intel(R) 82801GBM SATA AHCI Controller HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0026 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0027 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0028 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c4 DriverDesc REG_SZ Intel(R) 82801GBM/GHM (ICH7-M Family) Serial ATA Storage Controller - 27C4 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0029 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 SlaveDeviceDetectionTimeout REG_DWORD 0x1 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0030 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0031 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c4 DriverDesc REG_SZ Intel(R) 82801GBM/GHM (ICH7-M Family) Serial ATA Storage Controller - 27C4 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0032 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 SlaveDeviceDetectionTimeout REG_DWORD 0x1 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0033 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0034 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27c4 DriverDesc REG_SZ Intel(R) 82801GBM/GHM (ICH7-M Family) Serial ATA Storage Controller - 27C4 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0035 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x0 SlaveDeviceDetectionTimeout REG_DWORD 0x1 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x0 UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0036 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal MasterDeviceType REG_DWORD 0x0 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x0 SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0037 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0038 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0039 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0040 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0041 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0042 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0043 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0044 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0045 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0046 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0047 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0048 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0049 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0050 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0051 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0052 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0053 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0054 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0055 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0056 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0057 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0058 MasterOnMask REG_DWORD 0x80 MasterOnConfigOffset REG_DWORD 0x41 SlaveOnMask REG_DWORD 0x80 SlaveOnConfigOffset REG_DWORD 0x43 InfPath REG_SZ ich7ide.inf InfSection REG_SZ intelide ProviderName REG_SZ Intel DriverDateData REG_BINARY 0000CB5C2A5FC501 DriverDate REG_SZ 5-23-2005 DriverVersion REG_SZ 7.0.0.1020 MatchingDeviceId REG_SZ pci\ven_8086&dev_27df DriverDesc REG_SZ Intel(R) 82801G (ICH7 Family) Ultra ATA Storage Controllers - 27DF HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0059 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_primary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ primary_ide_channel DriverDesc REG_SZ Primärer IDE-Kanal MasterDeviceType REG_DWORD 0x1 SlaveDeviceType REG_DWORD 0x2 MasterDeviceTimingMode REG_DWORD 0x10010 MasterDeviceTimingModeAllowed REG_DWORD 0xffffffff SlaveDeviceTimingMode REG_DWORD 0x2010 SlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0060 EnumPropPages32 REG_SZ storprop.dll,IdePropPageProvider InfPath REG_SZ mshdc.inf InfSection REG_SZ atapi_Inst_secondary ProviderName REG_SZ Microsoft DriverDateData REG_BINARY 008062C5C001C101 DriverDate REG_SZ 7-1-2001 DriverVersion REG_SZ 5.1.2600.2180 MatchingDeviceId REG_SZ secondary_ide_channel DriverDesc REG_SZ Sekundärer IDE-Kanal UserMasterDeviceTimingModeAllowed REG_DWORD 0xffffffff UserSlaveDeviceTimingModeAllowed REG_DWORD 0xffffffff ResetErrorCountersOnSuccess REG_DWORD 0x1 HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties < > [2006.03.22 05:54:05 | 000,000,065 | RH-- | C] () -- C:\WINDOWS\Tasks\desktop.ini [2006.03.22 06:06:37 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\Tasks\SA.DAT [2010.04.18 10:35:51 | 000,000,276 | ---- | C] () -- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job [2013.02.10 23:35:21 | 000,000,282 | ---- | C] () -- C:\WINDOWS\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.02.10 23:35:22 | 000,000,274 | ---- | C] () -- C:\WINDOWS\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.02.10 23:38:31 | 000,000,322 | ---- | C] () -- C:\WINDOWS\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.02.10 23:38:36 | 000,000,296 | ---- | C] () -- C:\WINDOWS\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.02.10 23:38:36 | 000,000,304 | ---- | C] () -- C:\WINDOWS\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.02.17 14:06:14 | 000,000,884 | ---- | C] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job < End of report > ich hoffe es hat geklappt! Bin ned so der Held am PC! danke Gruss |
|
17.04.2013, 00:15
| #10 |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Hallo, ja das passt so.  Wie läuft der Rechner? Schritt 1 Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschliesslich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
17.04.2013, 22:46
| #11 |
| | mydirtyhobby.com Rechnung hi, also PC läuft stabil!:-) Code:
ATTFilter ComboFix 13-04-17.01 - Winzler 17.04.2013 23:28:47.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1022.577 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Winzler\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Winzler\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Winzler\Anwendungsdaten\64F232C6
c:\dokumente und einstellungen\Winzler\Anwendungsdaten\64F232C6\64F232C6.DAT
c:\dokumente und einstellungen\Winzler\Anwendungsdaten\64F232C6\64F232C6.DAT.DAT
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-03-17 bis 2013-04-17 ))))))))))))))))))))))))))))))
.
.
2013-03-25 21:13 . 2013-03-25 21:13 -------- d-----w- c:\dokumente und einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Sun
2013-03-21 20:20 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
2013-03-21 20:20 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-29 16:44 . 2013-02-24 11:35 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-29 16:44 . 2013-02-24 11:35 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-29 16:44 . 2013-02-24 11:35 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-17 15:24 . 2013-02-17 12:06 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-17 15:24 . 2011-06-09 07:55 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-08 08:36 . 2006-03-22 03:54 293888 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 15:56 . 2004-08-04 00:50 2031104 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-07 15:56 . 2004-08-04 00:50 2152448 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-02 01:57 . 2006-03-22 03:54 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:53 . 2006-03-22 03:54 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 01:53 . 2006-03-22 03:54 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-02 01:53 . 2006-03-22 03:54 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:08 . 2006-03-22 03:54 385024 ----a-w- c:\windows\system32\html.iec
2013-02-27 07:56 . 2006-03-22 04:01 2067456 ----a-w- c:\windows\system32\mstscax.dll
2013-02-24 08:30 . 2013-02-24 08:31 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-02-24 08:30 . 2013-02-24 08:31 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-02-24 08:30 . 2013-02-24 08:31 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-24 08:30 . 2013-02-24 08:31 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-02-24 00:46 . 2013-02-24 00:46 411368 ----a-w- c:\windows\system32\deploytk.dll
2013-02-12 00:32 . 2008-04-13 18:56 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-02-12 00:32 . 2006-03-22 03:54 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-10 21:32 . 2003-03-18 10:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2013-02-10 21:32 . 2003-02-20 18:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2013-01-26 03:55 . 2006-03-22 03:54 552448 ----a-w- c:\windows\system32\oleaut32.dll
2012-06-03 08:03 . 2012-06-03 08:03 3224576 ----a-w- c:\programme\Gemeinsame DateienDDBACSetup.msi
2011-07-14 09:31 . 2009-07-03 21:37 1456640 ----a-w- c:\programme\Gemeinsame Dateien\Falk Navi-Manager.msi
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-28 14:49 281760 ----a-w- c:\programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-23 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KeybdUtility"="c:\programme\LG Software\On Screen Display\HotKey.exe" [2006-03-07 2658304]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2006-06-02 786521]
"TkBellExe"="c:\programme\Real\RealPlayer\update\realsched.exe" [2013-02-10 295072]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2012-10-25 421888]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2013-03-29 345312]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2013-02-20 152392]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^NovaBACKUP Tray Control.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\NovaBACKUP Tray Control.lnk
backup=c:\windows\pss\NovaBACKUP Tray Control.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2006-06-28 20:32 89541 ----a-w- c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 09:43 69632 ----a-r- c:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-11-02 06:51 59240 ----a-w- c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-01-28 12:08 59720 ----a-w- c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 16:41 45056 ----a-w- c:\programme\ATI Technologies\ATI.ACE\CLI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2005-09-03 14:18 94208 ----a-w- c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:22 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FilterHost]
2010-01-18 14:35 827392 ----a-w- c:\dokumente und einstellungen\Winzler\Anwendungsdaten\mmserver\FilterHost.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-11 20:34 49152 ----a-w- c:\programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2005-10-12 11:30 139264 ----a-w- c:\programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-02-07 07:36 77824 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-02-07 07:40 118784 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-02-07 07:39 94208 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-02-20 11:35 152392 ----a-w- c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG Direct Media Button Service]
2006-02-02 15:59 94208 ----a-w- c:\windows\system32\LGDMEBTN.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LG Intelligent Update]
2009-11-02 06:05 126976 ----a-w- c:\programme\lg_swupdate\autoupdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
2010-05-10 12:12 439568 ----a-w- c:\programme\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-02-08 20:06 7405568 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2006-02-08 20:06 1519616 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-10-25 02:12 421888 ----a-w- c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 19:24 32768 ----a-w- c:\programme\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-01-11 08:23 15961088 ----a-r- c:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-04-23 07:37 39408 ----a-w- c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
2006-03-30 14:45 313472 ----a-r- c:\programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verknüpfung mit der High Definition Audio-Eigenschaftenseite]
2005-01-07 16:07 61952 ----a-w- c:\windows\system32\HdAShCut.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
.
R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12.09.2008 15:30 15172]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [24.02.2013 13:35 37352]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [24.02.2013 13:35 86752]
R2 NasPmService;NAS PM Service;c:\programme\BUFFALO\NASNAVI\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 --> c:\programme\BUFFALO\NASNAVI\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [?]
R2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\programme\NovaStor\NovaStor NovaBACKUP\nsService.exe [15.04.2010 12:51 261256]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\programme\RealNetworks\RealDownloader\rndlresolversvc.exe [29.11.2012 21:31 38608]
R3 AGR1310_51;Agere Systems ET-13xx PCI-E Ethernet Adapter XP Driver;c:\windows\system32\drivers\AGR1310_51.sys [22.11.2006 00:41 75648]
R3 LGDMEBTN;LG Direct Media Button Device Driver;c:\windows\system32\drivers\LGDMEBTN.sys [22.03.2006 12:10 15616]
S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23.03.2006 05:14 36352]
S3 PAC207;Webcam 1200;c:\windows\system32\DRIVERS\PFC027.SYS --> c:\windows\system32\DRIVERS\PFC027.SYS [?]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [20.04.2009 12:01 47360]
S3 WsAudio_Device;WsAudio_Device;c:\windows\system32\drivers\VirtualAudio.sys [09.12.2012 15:04 27496]
S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [09.12.2012 17:22 25704]
S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [09.12.2012 17:22 25704]
S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [09.12.2012 17:22 25704]
S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [09.12.2012 17:22 25704]
S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [09.12.2012 17:23 25704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-17 15:24]
.
2012-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2013-04-11 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job
- c:\programme\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29 19:33]
.
2013-04-17 c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job
- c:\programme\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29 19:31]
.
2013-04-17 c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job
- c:\programme\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29 19:31]
.
2013-04-17 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2012-11-30 14:30]
.
2013-04-14 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2012-11-30 14:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://google.de/
IE: Free YouTube Download - c:\programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
Trusted Zone: cleverreach.com\novastor
Trusted Zone: google-analytics.com
Trusted Zone: novastor.com
TCP: DhcpNameServer = 192.168.2.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-04-17 23:38
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,48,8d,6c,55,32,db,f7,4c,85,7f,f0,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(916)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2013-04-17 23:41:44
ComboFix-quarantined-files.txt 2013-04-17 21:41
ComboFix2.txt 2013-04-15 20:18
.
Vor Suchlauf: 14 Verzeichnis(se), 63.574.904.832 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 63.552.016.384 Bytes frei
.
- - End Of File - - 03046A23188020B08A0FFA2C8B18B09F
|
|
17.04.2013, 22:58
| #12 |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Hi, sehr gut, dann machen wir jetzt noch eine Kontrolle und schliessen vorhandene Sicherheitslücken. Schritt 1 Downloade dir bitte Malwarebytes Anti-Malware .
Schritt 2 Lade das Setup des ESET Online Scanners herunter und speichere es auf den Desktop.
Schritt 3 Downloade dir bitte SecurityCheck (Link 2).
Schritt 4 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
18.04.2013, 21:21
| #13 |
| | mydirtyhobby.com RechnungCode:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.04.18.09 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Winzler :: NAME-5DDFE97525 [Administrator] Schutz: Aktiviert 18.04.2013 22:09:23 mbam-log-2013-04-18 (22-09-23).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 254783 Laufzeit: 11 Minute(n), 3 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) bei Schritt 2 wurden keine Funde gemacht!:-) Code:
ATTFilter Results of screen317's Security Check version 0.99.62 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Avira Free Antivirus Avira successfully updated! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 15 Java 2 Runtime Environment, SE v1.4.2 Java version out of Date! Adobe Reader 7 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: ````````````````````End of Log`````````````````````` Code:
ATTFilter OTL logfile created on: 19.04.2013 00:31:24 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Winzler\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1022,42 Mb Total Physical Memory | 383,04 Mb Available Physical Memory | 37,46% Memory free 2,40 Gb Paging File | 1,82 Gb Available in Paging File | 75,67% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 93,16 Gb Total Space | 59,17 Gb Free Space | 63,52% Space Free | Partition Type: NTFS Computer Name: NAME-5DDFE97525 | User Name: Winzler | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.29 18:44:18 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.03.29 18:44:16 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2013.02.10 23:32:21 | 000,295,072 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Real\RealPlayer\Update\realsched.exe PRC - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe PRC - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe PRC - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.03.07 16:29:36 | 002,658,304 | ---- | M] (LG Electronics) -- C:\Programme\LG Software\On Screen Display\HotKey.exe PRC - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2013.02.24 10:27:58 | 000,397,704 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2010.04.15 12:54:42 | 000,187,528 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsEngineRes407.dll MOD - [2010.04.15 12:51:22 | 000,126,088 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsSQLBackupRestore.dll MOD - [2010.03.29 08:36:50 | 000,005,120 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\throttle.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.03.17 17:24:35 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.12.19 10:49:34 | 000,732,648 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service) SRV - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) [Auto | Running] -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe -- (nsService) SRV - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) [Auto | Running] -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService) SRV - [2007.03.11 23:02:52 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007.03.11 22:24:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMon) SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\VcommMgr.sys -- (VcommMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VComm.sys -- (VComm) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PFC027.SYS -- (PAC207) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDRm.sys -- (InCDRm) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDPass.sys -- (InCDPass) DRV - File not found [File_System | Disabled | Stopped] -- system32\drivers\InCDFs.sys -- (InCDFs) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Winzler\LOKALE~1\Temp\catchme.sys -- (catchme) DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vbtenum.sys -- (BTHidEnum) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\btcusb.sys -- (Btcsrusb) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btnetdrv.sys -- (BT) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\blueletaudio.sys -- (BlueletAudio) DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.24 10:28:17 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.11.20 12:00:58 | 000,027,496 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VirtualAudio.sys -- (WsAudio_Device) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2012.11.09 16:33:30 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2012.11.09 16:33:30 | 000,018,560 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2012.10.17 14:53:46 | 000,019,072 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1) DRV - [2008.09.12 15:30:19 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PzWDM.sys -- (PzWDM) DRV - [2007.05.02 04:52:00 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2006.06.28 22:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.05.03 13:50:42 | 001,540,608 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006.02.13 12:15:36 | 000,075,648 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGR1310_51.sys -- (AGR1310_51) DRV - [2006.01.13 10:13:18 | 004,137,984 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) DRV - [2006.01.08 08:12:42 | 000,117,906 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATSwpDrv.sys -- (ATSWPDRV) DRV - [2005.12.04 17:55:30 | 001,428,096 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) DRV - [2005.11.18 12:17:28 | 000,036,352 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2005.08.31 07:15:42 | 000,015,616 | R--- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LGDMEBTN.sys -- (LGDMEBTN) DRV - [2005.01.07 18:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{4A34A1E9-98FF-4AC6-97EA-540E02FFF2C0}: "URL" = hxxp://www.bing.com/search?FORM=IP2TDF&PC=IP2TDF&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{5E15021D-0131-4EE7-B7D0-916B056B7E74}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=7f3f2787-c059-4300-89bd-661bf15abd6b&apn_sauid=5512EBCF-C3B9-4267-879F-56A98812D092 IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADBF_de IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Programme\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2012.05.18 15:17:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013.02.10 23:33:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013.02.10 23:33:33 | 000,000,000 | ---D | M] [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.04.15 21:54:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Firefox\Profiles\6yseursn.default\extensions O1 HOSTS File: ([2013.04.17 23:38:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found. O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation) O4 - HKLM..\Run: [KeybdUtility] C:\Programme\LG Software\On Screen Display\HotKey.exe (LG Electronics) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube Download - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytmp3downloader.htm () O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: cleverreach.com ([novastor] http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: google-analytics.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]https in Vertrauenswürdige Sites) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Java Plug-in 1.4.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17960938-DAA4-433D-A851-95A83AB8B690}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.03.22 06:03:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.18 22:23:13 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2013.04.18 22:22:23 | 002,347,384 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Winzler\Desktop\esetsmartinstaller_enu.exe [2013.04.18 22:06:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Malwarebytes [2013.04.18 22:06:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2013.04.18 22:06:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2013.04.18 22:06:36 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2013.04.18 22:06:36 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2013.04.18 22:05:46 | 010,285,040 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Winzler\Desktop\mbam-setup-1.75.0.1300.exe [2013.04.17 23:57:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2013.04.17 23:22:27 | 005,054,659 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.15 22:22:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:05:09 | 000,000,000 | RHSD | C] -- C:\cmdcons [2013.04.15 22:01:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2013.04.15 22:01:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2013.04.15 22:01:51 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2013.04.15 22:01:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2013.04.15 22:01:38 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.04.15 22:01:32 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Winzler\Startmenü\Programme\Verwaltung [2013.04.15 22:01:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt [2013.03.25 23:13:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Sun [2009.04.20 12:01:52 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.19 00:28:24 | 000,890,815 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\SecurityCheck.exe [2013.04.19 00:24:01 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.04.18 22:22:33 | 002,347,384 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Winzler\Desktop\esetsmartinstaller_enu.exe [2013.04.18 22:06:39 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.18 22:05:46 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Winzler\Desktop\mbam-setup-1.75.0.1300.exe [2013.04.18 21:58:34 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:58:33 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.04.18 21:58:33 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:58:30 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:57:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.04.18 21:57:48 | 1072,156,672 | -HS- | M] () -- C:\hiberfil.sys [2013.04.17 23:38:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2013.04.17 23:22:27 | 005,054,659 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:05:16 | 000,000,327 | RHS- | M] () -- C:\boot.ini [2013.04.15 21:53:58 | 000,613,083 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 23:30:10 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.14 13:12:35 | 000,267,800 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013.04.14 10:04:05 | 000,377,856 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 22:38:00 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.11 21:52:36 | 000,499,326 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:07 | 000,580,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2013.04.10 00:36:21 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2013.04.10 00:00:06 | 000,463,436 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2013.04.10 00:00:06 | 000,444,902 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2013.04.10 00:00:06 | 000,086,280 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2013.04.10 00:00:06 | 000,072,778 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.19 00:28:16 | 000,890,815 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\SecurityCheck.exe [2013.04.18 22:06:39 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.15 22:05:11 | 000,262,448 | RHS- | C] () -- C:\cmldr [2013.04.15 22:01:51 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe [2013.04.15 22:01:51 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe [2013.04.15 22:01:51 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2013.04.15 22:01:51 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2013.04.15 22:01:51 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2013.04.15 21:53:57 | 000,613,083 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 10:04:02 | 000,377,856 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 21:52:36 | 000,499,326 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:06 | 000,580,968 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2012.06.03 10:03:40 | 003,224,576 | ---- | C] () -- C:\Programme\Gemeinsame DateienDDBACSetup.msi [2012.04.15 17:40:22 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.02.15 14:27:46 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.01.02 12:06:38 | 000,001,057 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\vso_ts_preview.xml [2009.07.03 23:37:30 | 001,456,640 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\Falk Navi-Manager.msi [2009.06.28 13:08:39 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc [2009.06.28 12:42:55 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\$_hpcst$.hpc [2009.04.20 12:01:52 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\inst.exe [2009.04.20 12:01:52 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.cat [2009.04.20 12:01:52 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.inf [2008.09.12 22:31:49 | 000,000,168 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.dat [2008.09.12 22:31:48 | 000,000,255 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.tif [2007.02.09 00:19:26 | 000,000,157 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\default.pls [2006.12.18 23:09:51 | 000,018,944 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006.11.22 17:05:36 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.11.22 00:39:10 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat ========== ZeroAccess Check ========== [2006.03.22 09:13:44 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.09.25 07:35:26 | 001,509,888 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.02.24 16:32:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.12.09 15:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.09.13 20:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2012.01.30 15:17:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dvdfab [2011.11.01 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2013.02.10 22:57:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON [2013.04.15 21:54:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Infineon [2013.02.16 19:05:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia [2010.11.28 01:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2011.01.01 22:08:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NovaStor [2010.11.28 03:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2008.06.11 15:22:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL [2009.04.20 12:52:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vsosdk [2010.04.18 10:38:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\Infineon [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\SRSCPL [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Infineon [2013.02.10 20:24:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\SRSCPL [2013.02.10 21:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Thunderbird [2012.12.09 15:05:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.12.08 20:36:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Installer [2009.12.08 20:39:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Programme [2010.11.27 22:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DataLayer [2012.12.09 17:33:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDFab [2013.02.10 23:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDVideoSoft [2011.11.01 15:35:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\elsterformular [2008.08.23 19:36:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EPSON [2007.01.13 22:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EverAd [2010.02.08 14:41:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Gutscheinmieze [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Infineon [2010.02.08 12:45:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\mmserver [2011.01.01 21:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\NASNaviator2 [2013.02.10 18:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia [2010.11.28 03:33:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Ovi Suite [2013.02.10 18:00:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Suite [2013.02.10 18:00:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\SRSCPL [2010.11.23 10:09:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Thunderbird [2012.08.06 22:27:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Vso ========== Purity Check ========== < End of report > Code:
ATTFilter OTL logfile created on: 19.04.2013 00:31:24 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Winzler\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1022,42 Mb Total Physical Memory | 383,04 Mb Available Physical Memory | 37,46% Memory free 2,40 Gb Paging File | 1,82 Gb Available in Paging File | 75,67% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 93,16 Gb Total Space | 59,17 Gb Free Space | 63,52% Space Free | Partition Type: NTFS Computer Name: NAME-5DDFE97525 | User Name: Winzler | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.29 18:44:18 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.03.29 18:44:16 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2013.02.10 23:32:21 | 000,295,072 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Real\RealPlayer\Update\realsched.exe PRC - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe PRC - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe PRC - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.03.07 16:29:36 | 002,658,304 | ---- | M] (LG Electronics) -- C:\Programme\LG Software\On Screen Display\HotKey.exe PRC - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2013.02.24 10:27:58 | 000,397,704 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2010.04.15 12:54:42 | 000,187,528 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsEngineRes407.dll MOD - [2010.04.15 12:51:22 | 000,126,088 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsSQLBackupRestore.dll MOD - [2010.03.29 08:36:50 | 000,005,120 | ---- | M] () -- C:\Programme\NovaStor\NovaStor NovaBACKUP\throttle.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2013.03.29 18:44:32 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.29 18:44:17 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.03.17 17:24:35 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.02.24 10:30:54 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012.12.21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.12.19 10:49:34 | 000,732,648 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012.11.29 21:31:04 | 000,038,608 | ---- | M] () [Auto | Running] -- C:\Programme\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service) SRV - [2010.04.15 12:51:02 | 000,261,256 | ---- | M] (NovaStor) [Auto | Running] -- C:\Programme\NovaStor\NovaStor NovaBACKUP\nsService.exe -- (nsService) SRV - [2009.05.15 12:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) [Auto | Running] -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService) SRV - [2007.03.11 23:02:52 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007.03.11 22:24:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2005.10.12 13:30:24 | 000,086,140 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMon) SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.20 00:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\VcommMgr.sys -- (VcommMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VComm.sys -- (VComm) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PFC027.SYS -- (PAC207) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDRm.sys -- (InCDRm) DRV - File not found [Kernel | System | Stopped] -- system32\drivers\InCDPass.sys -- (InCDPass) DRV - File not found [File_System | Disabled | Stopped] -- system32\drivers\InCDFs.sys -- (InCDFs) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Winzler\LOKALE~1\Temp\catchme.sys -- (catchme) DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vbtenum.sys -- (BTHidEnum) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\btcusb.sys -- (Btcsrusb) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btnetdrv.sys -- (BT) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\blueletaudio.sys -- (BlueletAudio) DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.24 10:28:17 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.11.20 12:00:58 | 000,027,496 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VirtualAudio.sys -- (WsAudio_Device) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2012.11.09 16:33:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2012.11.09 16:33:30 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2012.11.09 16:33:30 | 000,018,560 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2012.10.17 14:53:46 | 000,019,072 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(5).sys -- (WsAudio_DeviceS(5) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(4).sys -- (WsAudio_DeviceS(4) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(3).sys -- (WsAudio_DeviceS(3) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(2).sys -- (WsAudio_DeviceS(2) DRV - [2011.12.09 16:35:58 | 000,025,704 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WsAudio_DeviceS(1).sys -- (WsAudio_DeviceS(1) DRV - [2008.09.12 15:30:19 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PzWDM.sys -- (PzWDM) DRV - [2007.05.02 04:52:00 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2006.06.28 22:13:08 | 001,160,320 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.05.03 13:50:42 | 001,540,608 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006.02.13 12:15:36 | 000,075,648 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGR1310_51.sys -- (AGR1310_51) DRV - [2006.01.13 10:13:18 | 004,137,984 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) DRV - [2006.01.08 08:12:42 | 000,117,906 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATSwpDrv.sys -- (ATSWPDRV) DRV - [2005.12.04 17:55:30 | 001,428,096 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) DRV - [2005.11.18 12:17:28 | 000,036,352 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2005.08.31 07:15:42 | 000,015,616 | R--- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LGDMEBTN.sys -- (LGDMEBTN) DRV - [2005.01.07 18:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{4A34A1E9-98FF-4AC6-97EA-540E02FFF2C0}: "URL" = hxxp://www.bing.com/search?FORM=IP2TDF&PC=IP2TDF&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{5E15021D-0131-4EE7-B7D0-916B056B7E74}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=7f3f2787-c059-4300-89bd-661bf15abd6b&apn_sauid=5512EBCF-C3B9-4267-879F-56A98812D092 IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADBF_de IE - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Programme\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Programme\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2012.05.18 15:17:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013.02.10 23:33:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013.02.10 23:33:33 | 000,000,000 | ---D | M] [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions [2010.11.23 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.04.15 21:54:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Mozilla\Firefox\Profiles\6yseursn.default\extensions O1 HOSTS File: ([2013.04.17 23:38:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found. O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll File not found O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation) O4 - HKLM..\Run: [KeybdUtility] C:\Programme\LG Software\On Screen Display\HotKey.exe (LG Electronics) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-814316363-676130644-456009284-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube Download - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytmp3downloader.htm () O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: cleverreach.com ([novastor] http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: google-analytics.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]http in Vertrauenswürdige Sites) O15 - HKU\S-1-5-21-814316363-676130644-456009284-1006\..Trusted Domains: novastor.com ([]https in Vertrauenswürdige Sites) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab (Java Plug-in 1.4.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17960938-DAA4-433D-A851-95A83AB8B690}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.03.22 06:03:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.18 22:23:13 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2013.04.18 22:22:23 | 002,347,384 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Winzler\Desktop\esetsmartinstaller_enu.exe [2013.04.18 22:06:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Malwarebytes [2013.04.18 22:06:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2013.04.18 22:06:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2013.04.18 22:06:36 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2013.04.18 22:06:36 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2013.04.18 22:05:46 | 010,285,040 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Winzler\Desktop\mbam-setup-1.75.0.1300.exe [2013.04.17 23:57:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2013.04.17 23:22:27 | 005,054,659 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.15 22:22:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:05:09 | 000,000,000 | RHSD | C] -- C:\cmdcons [2013.04.15 22:01:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2013.04.15 22:01:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2013.04.15 22:01:51 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2013.04.15 22:01:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2013.04.15 22:01:38 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.04.15 22:01:32 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Winzler\Startmenü\Programme\Verwaltung [2013.04.15 22:01:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt [2013.03.25 23:13:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\Sun [2009.04.20 12:01:52 | 000,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.19 00:28:24 | 000,890,815 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\SecurityCheck.exe [2013.04.19 00:24:01 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.04.18 22:22:33 | 002,347,384 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Winzler\Desktop\esetsmartinstaller_enu.exe [2013.04.18 22:06:39 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.18 22:05:46 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Winzler\Desktop\mbam-setup-1.75.0.1300.exe [2013.04.18 21:58:34 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:58:33 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.04.18 21:58:33 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:58:30 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.18 21:57:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.04.18 21:57:48 | 1072,156,672 | -HS- | M] () -- C:\hiberfil.sys [2013.04.17 23:38:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2013.04.17 23:22:27 | 005,054,659 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Winzler\Desktop\ComboFix.exe [2013.04.15 22:22:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Winzler\Desktop\OTL.exe [2013.04.15 22:05:16 | 000,000,327 | RHS- | M] () -- C:\boot.ini [2013.04.15 21:53:58 | 000,613,083 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 23:30:10 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.14 13:12:35 | 000,267,800 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013.04.14 10:04:05 | 000,377,856 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 22:38:00 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-814316363-676130644-456009284-1006.job [2013.04.11 21:52:36 | 000,499,326 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:07 | 000,580,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2013.04.10 00:36:21 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2013.04.10 00:00:06 | 000,463,436 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2013.04.10 00:00:06 | 000,444,902 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2013.04.10 00:00:06 | 000,086,280 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2013.04.10 00:00:06 | 000,072,778 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2013.03.29 18:44:37 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys [2013.03.29 18:44:37 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2013.03.29 18:44:37 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.19 00:28:16 | 000,890,815 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\SecurityCheck.exe [2013.04.18 22:06:39 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.15 22:05:11 | 000,262,448 | RHS- | C] () -- C:\cmldr [2013.04.15 22:01:51 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe [2013.04.15 22:01:51 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe [2013.04.15 22:01:51 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2013.04.15 22:01:51 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2013.04.15 22:01:51 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2013.04.15 21:53:57 | 000,613,083 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\adwcleaner.exe [2013.04.14 10:04:02 | 000,377,856 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Desktop\b5ul3w6w.exe [2013.04.12 10:26:09 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\defogger_reenable [2013.04.11 21:52:36 | 000,499,326 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0004.pdf [2013.04.11 21:51:58 | 000,458,374 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0003.pdf [2013.04.11 21:36:06 | 000,260,402 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0002.pdf [2013.04.11 21:30:06 | 000,580,968 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Eigene Dateien\Scan0001.pdf [2012.06.03 10:03:40 | 003,224,576 | ---- | C] () -- C:\Programme\Gemeinsame DateienDDBACSetup.msi [2012.04.15 17:40:22 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.02.15 14:27:46 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.01.02 12:06:38 | 000,001,057 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\vso_ts_preview.xml [2009.07.03 23:37:30 | 001,456,640 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\Falk Navi-Manager.msi [2009.06.28 13:08:39 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc [2009.06.28 12:42:55 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\$_hpcst$.hpc [2009.04.20 12:01:52 | 000,087,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\inst.exe [2009.04.20 12:01:52 | 000,007,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.cat [2009.04.20 12:01:52 | 000,001,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\pcouffin.inf [2008.09.12 22:31:49 | 000,000,168 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.dat [2008.09.12 22:31:48 | 000,000,255 | -H-- | C] () -- C:\Dokumente und Einstellungen\Winzler\hpothb07.tif [2007.02.09 00:19:26 | 000,000,157 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\default.pls [2006.12.18 23:09:51 | 000,018,944 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006.11.22 17:05:36 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.11.22 00:39:10 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Winzler\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat ========== ZeroAccess Check ========== [2006.03.22 09:13:44 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.09.25 07:35:26 | 001,509,888 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2013.02.24 16:32:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.12.09 15:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.09.13 20:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2012.01.30 15:17:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dvdfab [2011.11.01 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2013.02.10 22:57:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON [2013.04.15 21:54:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Infineon [2013.02.16 19:05:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia [2010.11.28 01:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2011.01.01 22:08:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NovaStor [2010.11.28 03:27:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2008.06.11 15:22:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL [2009.04.20 12:52:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vsosdk [2010.04.18 10:38:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\Infineon [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Anwendungsdaten\SRSCPL [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Infineon [2013.02.10 20:24:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\SRSCPL [2013.02.10 21:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Thunderbird [2012.12.09 15:05:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Aimersoft Video Converter Ultimate [2009.12.08 20:36:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Installer [2009.12.08 20:39:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\ASCON Programme [2010.11.27 22:48:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DataLayer [2012.12.09 17:33:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDFab [2013.02.10 23:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\DVDVideoSoft [2011.11.01 15:35:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\elsterformular [2008.08.23 19:36:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EPSON [2007.01.13 22:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\EverAd [2010.02.08 14:41:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Gutscheinmieze [2006.03.23 05:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Infineon [2010.02.08 12:45:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\mmserver [2011.01.01 21:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\NASNaviator2 [2013.02.10 18:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia [2010.11.28 03:33:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Ovi Suite [2013.02.10 18:00:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Nokia Suite [2013.02.10 18:00:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\PC Suite [2006.03.22 10:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\SRSCPL [2010.11.23 10:09:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Thunderbird [2012.08.06 22:27:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Winzler\Anwendungsdaten\Vso ========== Purity Check ========== < End of report > |
|
19.04.2013, 00:03
| #14 |
| /// TB-Ausbilder | mydirtyhobby.com Rechnung Hi, das sieht gut aus. Bleiben noch Updates zu machen und dann räumen wir auf. Schritt 1 Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware zur Infizierung per Drive-by Download missbraucht werden können. Die aktuelle Version ist Java 7 Update 21.
Überleg dir also, ob du eine Java-Installation wirklich brauchst. Falls du Java weiterhin verwenden möchtest, dann:
Schritt 2 Die Version deines Adobe PDF Readers ist veraltet, wir müssen ihn updaten:
Cleanup Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.
>> OK << Wir sind durch, deine Logs sehen für mich im Moment sauber aus. Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst. Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann. Epilog: Tipps, Dos & Don'ts  Aktualität von System und SoftwareDas Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:
Auch die installierte Software sollte immer in der aktuellsten Version vorliegen. Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
Sicherheits-SoftwareEine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt). Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt. Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:
(Un-)Sicheres Verhalten im InternetNebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert. Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
Allgemeine HinweiseAbschliessend noch ein paar grundsätzliche Bemerkungen:
Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen. Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. 
__________________ cheers, Leo |
|
19.04.2013, 21:32
| #15 |
| | mydirtyhobby.com Rechnung HI, danke läuft alles super und paßr!Spende kommt! Gruss |
|
| Themen zu mydirtyhobby.com Rechnung |
| anfänger, crazy, gmer, logfiles, rechnung, thema, verlauf, wirklich |
Textbox.
Linear-Darstellung
