| |
| |||||||
Log-Analyse und Auswertung: OTL - First Run, Weißer Bildschirm nach Anmeldung, VistaWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.04.2013, 22:51
| #1 |
 |  OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Hallo alle zusammen! Ich bin sehr dankbar hier im Forum Mitglied zu sein und eure Hilfe in Anspruch nehmen zu dürfen. Es geht sich um folgendes: Ich habe einen Asus Laptop mit Windows Vist 64bit Wenn ich diesen einschlate dauert es nun ziemlich lang. Wenn ich mich bei meinem Hauptkonto anmelde ist diese Anmeldezeit wieder äußerst lang und es erscheint nur ein weißer Bildschirm. Das Aufrufen des Task-Manager geht mal und mal wieder nicht. Abmelden funktioniert immer. Fahre ich den PC per Knopf herunter, sehe ich kurz den Desktop. Melde ich mich bei meinem Nebenkonto (auch Administrato, Sicherheitskonto von mir sozusagen) Funktioniert das Desktop aber bei jedem Neustart ist die Windows Firewall komplett aus. Und er ist eben sehr langsam. Außerdem findet der AVG nichts. Habe mir mal mit dem OTL einen Scan durch laufen lassen, das Ergebnis daraus bzw. dieses Dokument habe ich im Anhang. Sicherheitshalber auch nochmal hier: Ich bitte, wenn möglich und ohne jemanden zu stressen da ja jeder auch ein Leben außer hier hat, um rasche Antwort. Vielen herzlichen Dank für eure Bemühungen im Voraus!! Danke! LG Andi OTL logfile created on: 18.04.2013 23:33:25 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sicherheit\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19088) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 6,00 Gb Total Physical Memory | 3,68 Gb Available Physical Memory | 61,39% Memory free 12,20 Gb Paging File | 9,85 Gb Available in Paging File | 80,76% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 117,96 Gb Total Space | 58,47 Gb Free Space | 49,57% Space Free | Partition Type: NTFS Drive D: | 220,18 Gb Total Space | 92,87 Gb Free Space | 42,18% Space Free | Partition Type: NTFS Drive G: | 114,92 Gb Total Space | 56,68 Gb Free Space | 49,33% Space Free | Partition Type: NTFS Computer Name: ANDI | User Name: Sicherheit | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.18 23:06:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe PRC - [2013.04.16 23:12:54 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\Opera.exe PRC - [2013.02.13 04:37:16 | 001,263,952 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2012.01.29 14:43:17 | 002,077,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exe PRC - [2010.11.24 21:51:33 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe PRC - [2010.07.21 11:03:18 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe PRC - [2010.07.17 19:17:41 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe PRC - [2009.11.23 22:40:22 | 000,070,144 | ---- | M] (AlcaTech) -- C:\Windows\SysWOW64\mmrtkrnl.exe PRC - [2009.09.20 12:07:23 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2009.09.20 11:17:46 | 000,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe PRC - [2009.04.07 18:34:26 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe PRC - [2009.03.21 05:37:18 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe PRC - [2009.03.04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2009.02.11 01:51:18 | 000,113,208 | ---- | M] (ASUSTeK Inc.) -- C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\wbctlvga.exe PRC - [2009.02.07 01:57:18 | 000,072,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe PRC - [2008.10.15 01:13:24 | 002,987,008 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\TurboGear.exe PRC - [2008.10.01 02:52:44 | 001,025,536 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\GearHelp.exe PRC - [2008.08.14 05:59:56 | 000,301,624 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe PRC - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe PRC - [2008.08.14 01:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe PRC - [2008.07.19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe PRC - [2008.06.18 07:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2008.03.25 06:39:18 | 000,322,104 | ---- | M] (ASUSTek.) -- C:\Program Files (x86)\ASUS\Direct Console\DCHelper.exe PRC - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ========== Modules (No Company Name) ========== MOD - [2013.03.16 01:40:28 | 014,717,144 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll MOD - [2013.02.13 04:38:06 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2013.02.13 04:37:16 | 001,263,952 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe MOD - [2009.10.23 18:01:58 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2008.10.15 01:13:24 | 002,987,008 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\TurboGear.exe MOD - [2008.10.01 02:52:44 | 001,025,536 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\GearHelp.exe MOD - [2008.08.28 01:32:36 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll MOD - [2008.06.09 18:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2008.05.29 06:39:48 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\Direct Console\SysInfo.dll MOD - [2008.05.23 06:24:10 | 000,045,056 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\atkmethod.dll MOD - [2008.02.17 07:08:46 | 000,950,272 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\OcSetting.dll MOD - [2007.06.15 19:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll MOD - [2007.06.02 02:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll MOD - [2007.03.10 01:16:52 | 000,106,496 | ---- | M] () -- C:\Program Files\ATKGFNEX\AGFNEX.dll MOD - [2005.05.12 00:39:32 | 000,565,248 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\pngio.dll ========== Services (SafeList) ========== SRV:64bit: - [2008.01.21 04:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2013.03.16 01:40:29 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.29 12:34:47 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2010.07.21 11:03:18 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc) SRV - [2010.07.17 19:17:41 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2009.10.20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) SRV - [2009.02.07 01:57:18 | 000,072,248 | ---- | M] () [Disabled | Running] -- C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe -- (WBVGAservice) SRV - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2008.07.27 20:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.01.15 22:02:49 | 000,282,976 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgldx64.sys -- (AvgLdx64) DRV:64bit: - [2011.09.12 20:18:11 | 000,035,664 | ---- | M] () [File_System | System | Running] -- C:\Windows\SysNative\Drivers\avgmfx64.sys -- (AvgMfx64) DRV:64bit: - [2011.07.20 09:46:06 | 000,203,320 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ssudmdm.sys -- (ssudmdm) DRV:64bit: - [2011.07.20 09:46:06 | 000,095,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ssudbus.sys -- (dg_ssudbus) DRV:64bit: - [2011.06.09 22:28:16 | 000,311,968 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt) DRV:64bit: - [2011.06.09 22:28:10 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt) DRV:64bit: - [2011.05.06 01:21:57 | 000,317,520 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgtdia.sys -- (AvgTdiA) DRV:64bit: - [2010.08.02 11:00:50 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.07.26 15:18:58 | 000,020,568 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv) DRV:64bit: - [2010.07.26 15:15:26 | 000,016,392 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TFsExDisk.sys -- (TFsExDisk) DRV:64bit: - [2010.04.27 04:25:22 | 000,161,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscemdm.sys -- (sscemdm) DRV:64bit: - [2010.04.27 04:25:22 | 000,129,024 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssceserd.sys -- (ssceserd) DRV:64bit: - [2010.04.27 04:25:22 | 000,127,488 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscebus.sys -- (sscebus) DRV:64bit: - [2010.04.27 04:25:22 | 000,018,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscemdfl.sys -- (sscemdfl) DRV:64bit: - [2010.02.25 17:51:02 | 000,029,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\tap0901.sys -- (tap0901) DRV:64bit: - [2009.11.25 14:59:28 | 000,058,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nchvsc64.sys -- (NCHVSC64) DRV:64bit: - [2009.10.20 20:19:54 | 000,047,632 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) DRV:64bit: - [2009.09.20 11:37:17 | 000,035,384 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm) DRV:64bit: - [2009.05.18 15:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.04.02 02:46:40 | 000,016,440 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\lullaby.sys -- (lullaby) DRV:64bit: - [2009.02.11 11:26:17 | 000,407,576 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor) DRV:64bit: - [2009.01.14 02:48:18 | 001,187,840 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\athrx.sys -- (athr) DRV:64bit: - [2008.11.03 09:03:27 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\kbfiltr.sys -- (kbfiltr) DRV:64bit: - [2008.07.09 11:16:19 | 000,092,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2008.05.13 15:02:13 | 000,019,880 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\btwrchid.sys -- (btwrchid) DRV:64bit: - [2008.05.13 15:02:11 | 000,121,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2008.05.02 07:59:47 | 000,166,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2008.02.16 03:27:18 | 000,062,976 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2008.01.29 04:46:57 | 000,036,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2008.01.24 07:24:23 | 000,060,928 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\enecir.sys -- (enecir) DRV:64bit: - [2008.01.21 04:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2008.01.21 04:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb) DRV:64bit: - [2008.01.21 04:46:55 | 000,111,104 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus) DRV:64bit: - [2008.01.21 04:46:52 | 000,019,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2007.12.06 12:12:55 | 000,320,048 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP) DRV:64bit: - [2007.10.17 06:54:20 | 000,015,872 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\EIO64.sys -- (EIO64) DRV:64bit: - [2007.07.28 04:45:52 | 000,057,856 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2007.07.27 05:33:54 | 000,055,296 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2007.07.24 20:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) DRV:64bit: - [2007.04.16 20:51:50 | 000,014,112 | R--- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (regi) DRV:64bit: - [2006.10.27 15:01:07 | 000,013,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2006.10.04 03:45:36 | 000,273,408 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64) DRV:64bit: - [2006.06.27 15:24:22 | 000,047,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\AmdTools64.sys -- (AmdTools64) DRV - [2010.07.26 15:15:26 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk) DRV - [2004.01.26 17:36:35 | 000,095,552 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02) DRV - [2004.01.26 17:01:28 | 000,052,224 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06) DRV - [2003.12.01 17:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA74C8} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA74C8}: "URL" = hxxp://www.searchqu.com/web?src=ieb&systemid=101&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013.03.05 21:42:16 | 000,000,000 | ---D | M] O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL (Microsoft Corporation) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI9130~1\ToolBar\searchqudtx.dll File not found O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI9130~1\ToolBar\searchqudtx.dll File not found O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ACMON] C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\amd_dc_opt\amd_dc_opt.exe () O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [DirectConsole2] C:\Program Files (x86)\ASUS\Direct Console\Direct Console.exe (ASUSTek.) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\SysWow64\mmrtkrnl.exe (AlcaTech) O4 - HKLM..\Run: [Turbo Gear] C:\Program Files\ASUS\Turbo Gear\TurboGear.exe () O4 - HKLM..\Run: [Turbo Gear Help] C:\Program Files\ASUS\Turbo Gear\GearHelp.exe () O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DirectShowDemuxFilter.dll] C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DirectShowDemuxFilter.dll (DivX, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.43.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B4D2956-A9C9-4FC5-8C99-B5BA51882005}: DhcpNameServer = 192.168.42.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47A80E82-F4D2-4F11-924A-61B118A1C5CF}: DhcpNameServer = 192.168.43.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GR99D3~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI9130~1\Datamngr\x64\datamngr.dll) - File not found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI9130~1\Datamngr\x64\IEBHO.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe () O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.18 23:06:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe [2013.04.18 23:05:37 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Adobe [2013.04.18 00:35:49 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013.04.18 00:35:49 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2013.04.18 00:35:49 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2013.04.18 00:35:49 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2013.04.18 00:35:49 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe [2013.04.18 00:35:49 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.04.18 00:35:49 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.04.18 00:35:49 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.04.18 00:35:49 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.04.18 00:35:49 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.04.18 00:35:49 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.04.18 00:35:49 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2013.04.18 00:35:49 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2013.04.16 23:59:49 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\vlc [2013.04.16 23:56:22 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\NVIDIA [2013.04.16 23:56:11 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\DivX [2013.04.16 23:43:52 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll [2013.04.16 23:43:52 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll [2013.04.16 23:43:37 | 010,624,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll [2013.04.16 23:43:31 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL [2013.04.16 23:42:37 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll [2013.04.16 23:42:13 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbc32.dll [2013.04.16 23:40:50 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.04.16 23:40:38 | 002,067,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2013.04.16 23:40:36 | 000,677,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe [2013.04.16 23:40:12 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2013.04.16 23:40:12 | 000,323,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sbe.dll [2013.04.16 23:40:12 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2013.04.16 23:40:12 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sbeio.dll [2013.04.16 23:38:52 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2013.04.16 23:38:52 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll [2013.04.16 23:38:52 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2013.04.16 23:38:16 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll [2013.04.16 23:38:16 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll [2013.04.16 23:35:18 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll [2013.04.16 23:35:17 | 001,161,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll [2013.04.16 23:28:24 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.04.16 23:23:01 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskschd.dll [2013.04.16 23:23:01 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskcomp.dll [2013.04.16 23:21:10 | 000,866,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll [2013.04.16 23:21:09 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe [2013.04.16 23:09:07 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Opera [2013.04.16 23:09:07 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Opera [2013.04.16 23:03:39 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\VirtualStore [2013.04.16 22:53:01 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Apple Computer [2013.04.16 22:52:54 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Power2Go [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Searches [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.04.16 22:51:16 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Identities [2013.04.16 22:51:14 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Contacts [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Vorlagen [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Verlauf [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Temporary Internet Files [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Startmenü [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\SendTo [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Recent [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Netzwerkumgebung [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Lokale Einstellungen [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Videos [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Musik [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Eigene Dateien [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Bilder [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Druckumgebung [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Cookies [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Anwendungsdaten [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Anwendungsdaten [2013.04.16 22:50:03 | 000,000,000 | --SD | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Videos [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Saved Games [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Pictures [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Music [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Links [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Favorites [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Downloads [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Documents [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Desktop [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.04.16 22:50:03 | 000,000,000 | -H-D | C] -- C:\Users\Sicherheit\AppData [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Temp [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Microsoft [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Media Center Programs [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Macromedia [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite [2013.04.02 23:02:12 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2013.04.02 23:02:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2013.04.02 23:01:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.18 23:06:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe [2013.04.18 22:56:01 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe [2013.04.18 22:53:16 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl [2013.04.18 22:53:09 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.04.18 22:53:08 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.04.18 22:53:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.04.18 22:52:41 | 2146,471,935 | -HS- | M] () -- C:\hiberfil.sys [2013.04.18 22:51:40 | 000,004,268 | ---- | M] () -- C:\Windows\bthservsdp.dat [2013.04.18 22:39:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.04.18 04:05:00 | 117,792,174 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm [2013.04.18 00:55:36 | 000,374,424 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.04.18 00:20:11 | 000,000,514 | ---- | M] () -- C:\Windows\SysWow64\ABG71GX.DAT [2013.04.16 23:30:44 | 001,427,406 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.04.16 23:30:44 | 000,621,952 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.04.16 23:30:44 | 000,590,082 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.04.16 23:30:44 | 000,123,852 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.04.16 23:30:44 | 000,102,094 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.04.16 22:55:17 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2013.04.02 23:04:57 | 000,122,608 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.18 00:36:51 | 000,694,784 | ---- | C] () -- C:\Windows\SysNative\drivers\bthport.sys [2013.04.18 00:36:51 | 000,204,288 | ---- | C] () -- C:\Windows\SysNative\fsquirt.exe [2013.04.18 00:36:51 | 000,035,328 | ---- | C] () -- C:\Windows\SysNative\drivers\BTHUSB.SYS [2013.04.18 00:36:51 | 000,026,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bthenum.sys [2013.04.18 00:35:57 | 009,272,320 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll [2013.04.18 00:35:56 | 012,477,440 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll [2013.04.18 00:35:51 | 001,488,384 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll [2013.04.18 00:35:50 | 002,339,840 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll [2013.04.18 00:35:50 | 001,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll [2013.04.18 00:35:50 | 001,062,912 | ---- | C] () -- C:\Windows\SysNative\mstime.dll [2013.04.18 00:35:50 | 000,710,656 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll [2013.04.18 00:35:50 | 000,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll [2013.04.18 00:35:50 | 000,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll [2013.04.18 00:35:49 | 001,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb [2013.04.18 00:35:49 | 001,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl [2013.04.18 00:35:49 | 000,479,232 | ---- | C] () -- C:\Windows\SysNative\html.iec [2013.04.18 00:35:49 | 000,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll [2013.04.18 00:35:49 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll [2013.04.18 00:35:49 | 000,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe [2013.04.18 00:35:49 | 000,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll [2013.04.18 00:35:49 | 000,096,768 | ---- | C] () -- C:\Windows\SysNative\mshtmled.dll [2013.04.18 00:35:49 | 000,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll [2013.04.18 00:35:49 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll [2013.04.18 00:35:49 | 000,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll [2013.04.18 00:35:49 | 000,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe [2013.04.18 00:35:49 | 000,056,832 | ---- | C] () -- C:\Windows\SysNative\licmgr10.dll [2013.04.18 00:35:49 | 000,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll [2013.04.18 00:35:49 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe [2013.04.18 00:35:45 | 002,762,240 | ---- | C] () -- C:\Windows\SysNative\win32k.sys [2013.04.18 00:35:44 | 000,176,128 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys [2013.04.18 00:35:44 | 000,144,896 | ---- | C] () -- C:\Windows\SysNative\drivers\srvnet.sys [2013.04.18 00:35:43 | 000,847,872 | ---- | C] () -- C:\Windows\SysNative\oleaut32.dll [2013.04.18 00:35:43 | 000,274,432 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb10.sys [2013.04.18 00:35:43 | 000,135,168 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb.sys [2013.04.18 00:35:43 | 000,105,984 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb20.sys [2013.04.18 00:35:42 | 000,407,552 | ---- | C] () -- C:\Windows\SysNative\drivers\afd.sys [2013.04.18 00:35:42 | 000,097,792 | ---- | C] () -- C:\Windows\SysNative\drivers\dfsc.sys [2013.04.18 00:35:41 | 000,975,360 | ---- | C] () -- C:\Windows\SysNative\inetcomm.dll [2013.04.18 00:35:40 | 000,344,576 | ---- | C] () -- C:\Windows\SysNative\schannel.dll [2013.04.18 00:35:39 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\winsrv.dll [2013.04.18 00:35:39 | 000,085,504 | ---- | C] () -- C:\Windows\SysNative\csrsrv.dll [2013.04.18 00:20:11 | 000,000,514 | ---- | C] () -- C:\Windows\SysWow64\ABG71GX.DAT [2013.04.17 00:04:08 | 000,316,416 | ---- | C] () -- C:\Windows\SysNative\msshsq.dll [2013.04.16 23:45:47 | 000,633,856 | ---- | C] () -- C:\Windows\SysNative\comctl32.dll [2013.04.16 23:45:00 | 000,087,552 | ---- | C] () -- C:\Windows\SysNative\consent.exe [2013.04.16 23:44:12 | 000,224,256 | ---- | C] () -- C:\Windows\SysNative\iphlpsvc.dll [2013.04.16 23:44:12 | 000,029,696 | ---- | C] () -- C:\Windows\SysNative\drivers\tunnel.sys [2013.04.16 23:43:44 | 013,425,152 | ---- | C] () -- C:\Windows\SysNative\wmp.dll [2013.04.16 23:43:31 | 008,147,968 | ---- | C] () -- C:\Windows\SysNative\wmploc.DLL [2013.04.16 23:42:37 | 000,189,952 | ---- | C] () -- C:\Windows\SysNative\t2embed.dll [2013.04.16 23:42:13 | 000,462,848 | ---- | C] () -- C:\Windows\SysNative\odbc32.dll [2013.04.16 23:41:59 | 000,301,568 | ---- | C] () -- C:\Windows\SysNative\shsvcs.dll [2013.04.16 23:41:20 | 004,692,368 | ---- | C] () -- C:\Windows\SysNative\ntoskrnl.exe [2013.04.16 23:41:19 | 001,560,960 | ---- | C] () -- C:\Windows\SysNative\ntdll.dll [2013.04.16 23:41:11 | 001,794,560 | ---- | C] () -- C:\Windows\SysNative\msxml6.dll [2013.04.16 23:41:01 | 012,898,304 | ---- | C] () -- C:\Windows\SysNative\shell32.dll [2013.04.16 23:40:56 | 000,454,144 | ---- | C] () -- C:\Windows\SysNative\shlwapi.dll [2013.04.16 23:40:50 | 000,817,664 | ---- | C] () -- C:\Windows\SysNative\jscript.dll [2013.04.16 23:40:49 | 000,613,376 | ---- | C] () -- C:\Windows\SysNative\vbscript.dll [2013.04.16 23:40:45 | 000,979,344 | ---- | C] () -- C:\Windows\SysNative\winresume.exe [2013.04.16 23:40:44 | 001,075,600 | ---- | C] () -- C:\Windows\SysNative\winload.efi [2013.04.16 23:40:44 | 001,062,800 | ---- | C] () -- C:\Windows\SysNative\winload.exe [2013.04.16 23:40:44 | 000,990,096 | ---- | C] () -- C:\Windows\SysNative\winresume.efi [2013.04.16 23:40:43 | 000,020,880 | ---- | C] () -- C:\Windows\SysNative\kdusb.dll [2013.04.16 23:40:43 | 000,018,832 | ---- | C] () -- C:\Windows\SysNative\kd1394.dll [2013.04.16 23:40:43 | 000,018,320 | ---- | C] () -- C:\Windows\SysNative\kdcom.dll [2013.04.16 23:40:38 | 002,424,320 | ---- | C] () -- C:\Windows\SysNative\mstscax.dll [2013.04.16 23:40:36 | 000,730,624 | ---- | C] () -- C:\Windows\SysNative\mstsc.exe [2013.04.16 23:40:31 | 001,923,584 | ---- | C] () -- C:\Windows\SysNative\ole32.dll [2013.04.16 23:40:16 | 000,461,312 | ---- | C] () -- C:\Windows\SysNative\drivers\srv.sys [2013.04.16 23:40:13 | 000,560,128 | ---- | C] () -- C:\Windows\SysNative\EncDec.dll [2013.04.16 23:40:12 | 000,416,768 | ---- | C] () -- C:\Windows\SysNative\sbe.dll [2013.04.16 23:40:12 | 000,226,816 | ---- | C] () -- C:\Windows\SysNative\mpg2splt.ax [2013.04.16 23:40:12 | 000,210,944 | ---- | C] () -- C:\Windows\SysNative\sbeio.dll [2013.04.16 23:38:58 | 000,090,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bowser.sys [2013.04.16 23:38:53 | 000,367,616 | ---- | C] () -- C:\Windows\SysNative\atmfd.dll [2013.04.16 23:38:52 | 000,096,256 | ---- | C] () -- C:\Windows\SysNative\fontsub.dll [2013.04.16 23:38:52 | 000,048,128 | ---- | C] () -- C:\Windows\SysNative\atmlib.dll [2013.04.16 23:38:17 | 000,179,712 | ---- | C] () -- C:\Windows\SysNative\srvsvc.dll [2013.04.16 23:38:16 | 000,017,920 | ---- | C] () -- C:\Windows\SysNative\netevent.dll [2013.04.16 23:38:16 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\sscore.dll [2013.04.16 23:37:14 | 000,002,048 | ---- | C] () -- C:\Windows\SysNative\tzres.dll [2013.04.16 23:35:18 | 001,398,784 | ---- | C] () -- C:\Windows\SysNative\mfc42.dll [2013.04.16 23:35:18 | 001,360,384 | ---- | C] () -- C:\Windows\SysNative\mfc42u.dll [2013.04.16 23:35:14 | 001,251,840 | ---- | C] () -- C:\Windows\SysNative\sdclt.exe [2013.04.16 23:23:03 | 000,854,528 | ---- | C] () -- C:\Windows\SysNative\schedsvc.dll [2013.04.16 23:23:02 | 000,655,872 | ---- | C] () -- C:\Windows\SysNative\taskschd.dll [2013.04.16 23:23:02 | 000,499,712 | ---- | C] () -- C:\Windows\SysNative\wmicmiplugin.dll [2013.04.16 23:23:01 | 000,410,112 | ---- | C] () -- C:\Windows\SysNative\taskcomp.dll [2013.04.16 23:23:01 | 000,267,776 | ---- | C] () -- C:\Windows\SysNative\taskeng.exe [2013.04.16 23:21:10 | 001,090,048 | ---- | C] () -- C:\Windows\SysNative\wmpmde.dll [2013.04.16 23:21:09 | 000,221,184 | ---- | C] () -- C:\Windows\SysNative\dnsapi.dll [2013.04.16 23:21:09 | 000,117,760 | ---- | C] () -- C:\Windows\SysNative\dnsrslvr.dll [2013.04.16 23:21:09 | 000,028,672 | ---- | C] () -- C:\Windows\SysNative\dnscacheugc.exe [2013.04.16 22:55:17 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2013.04.16 22:52:15 | 000,000,956 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2013.04.16 22:51:29 | 000,000,986 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.04.16 22:51:20 | 000,000,981 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2013.04.16 22:51:13 | 000,000,922 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2011.06.01 16:24:44 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2009.10.01 15:03:48 | 000,000,084 | -H-- | C] () -- C:\ProgramData\aspg.dat [2009.09.29 14:22:17 | 000,231,716 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.09.29 14:22:15 | 000,231,716 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg ========== ZeroAccess Check ========== [2006.11.02 17:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2011.01.21 17:56:31 | 012,898,304 | ---- | M] () "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 17:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.09.20 11:17:46 | 000,891,392 | ---- | M] () "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.09.20 11:17:46 | 000,615,424 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008.01.21 04:50:58 | 000,513,024 | ---- | M] () "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.04.16 23:09:07 | 000,000,000 | ---D | M] -- C:\Users\Sicherheit\AppData\Roaming\Opera ========== Purity Check ========== < End of report > |
|
19.04.2013, 12:01
| #2 |
| /// TB-Ausbilder   | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Hallo Andi,
__________________mach bitte auch noch einen Gmer-Scan: Lade dir Gmer herunter (auf den Button Download EXE drücken) und speichere das Programm auf den Desktop.
__________________ |
|
19.04.2013, 12:57
| #3 |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Hallo!
__________________Vielen Dank für die sehr schnelle Antwort. Werde dies gleich heute um ca. halb 5, 5 machen da ich noch nicht zuhause bin und es gleich reinstellen. Danke! |
|
19.04.2013, 13:04
| #4 |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Ok, alles klar.
__________________ cheers, Leo |
|
19.04.2013, 17:36
| #6 |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Läuft der Gmer-Scan denn noch oder hat er sich aufgehängt?
__________________ --> OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista |
|
20.04.2013, 01:42
| #7 |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Also musste dann weg bzw. hat ich was vor. Der Scan ist aber durch und anbei zu finden... Danke!!! LG Andi GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-04-20 02:35:46
Windows 6.0.6001 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0002 465,76GB
Running: mx7b4erb.exe; Driver: C:\Users\SICHER~1\AppData\Local\Temp\ugddrpod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
.text C:\Windows\system32\DRIVERS\USBPORT.SYS!DllUnload + 1 fffffa6002fdcfa5 11 bytes {MOV RAX, 0xfffffa80087e72a0; JMP RAX}
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960001b3900 7 bytes [00, 6B, F3, FF, C1, 40, FC]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960001b3908 3 bytes [C0, E5, 01]
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\mmrtkrnl.exe[4548] C:\Windows\SysWOW64\wsock32.dll!recv + 81 00000000755f18a9 2 bytes CALL 7725142d C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mmrtkrnl.exe[4548] C:\Windows\SysWOW64\wsock32.dll!recvfrom + 87 00000000755f190e 2 bytes CALL 7725142d C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mmrtkrnl.exe[4548] C:\Windows\SysWOW64\wsock32.dll!setsockopt + 98 00000000755f19f0 2 bytes JMP 775b8400 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\mmrtkrnl.exe[4548] C:\Windows\SysWOW64\wsock32.dll!setsockopt + 109 00000000755f19fb 2 bytes JMP 775c8b38 C:\Windows\syswow64\WS2_32.dll
---- Kernel IAT/EAT - GMER 2.1 ----
IAT C:\Windows\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] [fffffa8006572440] [unknown section]
IAT C:\Windows\system32\drivers\pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [fffffa6000a6c650] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\pci.sys[ntoskrnl.exe!IoDetachDevice] [fffffa6000a6c5dc] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [fffffa6000a372c0] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [fffffa6000a3735c] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [fffffa6000a37224] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [fffffa6000a37a24] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [fffffa6000a37ba0] \SystemRoot\System32\Drivers\spmx.sys [unknown section]
IAT C:\Windows\system32\drivers\ataport.SYS[ntoskrnl.exe!DbgBreakPoint] [fffffa80065bc440] [unknown section]
IAT C:\Windows\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] [fffffa80087e7440] [unknown section]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortReadPortUshort] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortCompleteRequest] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortNotification] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortReadPortBufferUshort] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortInitialize] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortGetPhysicalAddress] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortStallExecution] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortReadPortUchar] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortDeviceStateChange] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortWritePortUchar] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortGetUnCachedExtension] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortMoveMemory] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortWritePortUlong] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortWritePortBufferUshort] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortGetDeviceBase] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortGetScatterGatherList] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortGetParentBusType] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[ataport.SYS!AtaPortRequestCallback] [?]
IAT C:\Windows\System32\Drivers\aekwtm0l.SYS[NTOSKRNL.exe!KeBugCheckEx] [?]
---- Devices - GMER 2.1 ----
Device \Driver\aekwtm0l \Device\Scsi\aekwtm0l1Port2Path0Target0Lun0 fffffa8008af62c0
Device \Driver\aekwtm0l \Device\Scsi\aekwtm0l1 fffffa8008af62c0
Device \FileSystem\Ntfs \Ntfs fffffa80065ca2c0
Device \FileSystem\fastfat \Fat fffffa800a0ad2c0
Device \Driver\usbehci \Device\USBFDO-7 fffffa80088b22c0
Device \Driver\usbuhci \Device\USBPDO-5 fffffa80088ba2c0
Device \Driver\usbehci \Device\USBFDO-3 fffffa80088b22c0
Device \Driver\usbuhci \Device\USBPDO-1 fffffa80088ba2c0
Device \Driver\iScsiPrt \Device\RaidPort0 fffffa8008ae32c0
Device \Driver\cdrom \Device\CdRom0 fffffa8008a9a2c0
Device \Driver\cdrom \Device\CdRom1 fffffa8008a9a2c0
Device \Driver\usbuhci \Device\USBPDO-6 fffffa80088ba2c0
Device \Driver\usbuhci \Device\USBFDO-4 fffffa80088ba2c0
Device \Driver\netbt \Device\NetBT_Tcpip_{47A80E82-F4D2-4F11-924A-61B118A1C5CF} fffffa800903d2c0
Device \Driver\usbuhci \Device\USBPDO-2 fffffa80088ba2c0
Device \Driver\usbuhci \Device\USBFDO-0 fffffa80088ba2c0
Device \Driver\usbehci \Device\USBPDO-7 fffffa80088b22c0
Device \Driver\usbuhci \Device\USBFDO-5 fffffa80088ba2c0
Device \Driver\usbehci \Device\USBPDO-3 fffffa80088b22c0
Device \Driver\usbuhci \Device\USBFDO-1 fffffa80088ba2c0
Device \Driver\volmgr \Device\HarddiskVolume1 fffffa80065c02c0
Device \Driver\volmgr \Device\FtControl fffffa80065c02c0
Device \Driver\volmgr \Device\VolMgrControl fffffa80065c02c0
Device \Driver\volmgr \Device\HarddiskVolume2 fffffa80065c02c0
Device \Driver\volmgr \Device\HarddiskVolume3 fffffa80065c02c0
Device \Driver\volmgr \Device\HarddiskVolume4 fffffa80065c02c0
Device \Driver\netbt \Device\NetBt_Wins_Export fffffa800903d2c0
Device \Driver\usbuhci \Device\USBFDO-6 fffffa80088ba2c0
Device \Driver\netbt \Device\NetBT_Tcpip_{18EAE573-80C2-4ABF-81BE-70CBBA28FDCC} fffffa800903d2c0
Device \Driver\usbuhci \Device\USBPDO-4 fffffa80088ba2c0
Device \Driver\usbuhci \Device\USBFDO-2 fffffa80088ba2c0
Device \Driver\usbuhci \Device\USBPDO-0 fffffa80088ba2c0
Device \Driver\iScsiPrt \Device\ScsiPort1 fffffa8008ae32c0
Device \Driver\aekwtm0l \Device\ScsiPort2 fffffa8008af62c0
Device \Driver\Smb \Device\NetbiosSmb fffffa800906d2c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\aekwtm0l.SYS (ATAPI IDE Miniport Driver/Microsoft Corporation)(2008-01-21 02:46:50) fffffa6003293000-fffffa60032d8000 (282624 bytes)
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243d1734a
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243d1734a@0025670f8fd3 0x3E 0x46 0xA2 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243d1734a@f49f54c7ed7a 0xB8 0xEB 0x5E 0xAD ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243d1734a@a8922c44979b 0xD8 0x21 0xEB 0x21 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243d1734a@9c0298a0549c 0x25 0x55 0x4E 0x5F ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x65 0x97 0x99 0x30 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x33 0xFD 0x69 0xFA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA7 0x31 0x6D 0x12 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002243d1734a (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002243d1734a@0025670f8fd3 0x3E 0x46 0xA2 0xB4 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002243d1734a@f49f54c7ed7a 0xB8 0xEB 0x5E 0xAD ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002243d1734a@a8922c44979b 0xD8 0x21 0xEB 0x21 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002243d1734a@9c0298a0549c 0x25 0x55 0x4E 0x5F ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xFA 0x7F 0x0A 0x5C ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x33 0xFD 0x69 0xFA ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA7 0x31 0x6D 0x12 ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- Files - GMER 2.1 ----
File C:\ADSM_PData_0150 0 bytes
File C:\ADSM_PData_0150\DB 0 bytes
File C:\ADSM_PData_0150\DB\SI.db 624 bytes
File C:\ADSM_PData_0150\DB\UL.db 1040 bytes
File C:\ADSM_PData_0150\DB\VL.db 8208 bytes
File C:\ADSM_PData_0150\DB\WAL.db 2048 bytes
File C:\ADSM_PData_0150\DragWait.exe 315392 bytes executable
File C:\ADSM_PData_0150\_avt 512 bytes
File C:\Users\Andreas\Gesicherte Musik 0 bytes
File C:\Users\Andreas\Gesicherte Musik\_avt 512 bytes
File C:\Users\Andreas\Gesicherte Musik\_lit 512 bytes
File C:\Users\Andreas\Gesichertes Dokument 0 bytes
File C:\Users\Andreas\Gesichertes Dokument\_avt 512 bytes
File C:\Users\Andreas\Gesichertes Dokument\_lit 512 bytes
File C:\Users\Andreas\Gesichertes Video 0 bytes
File C:\Users\Andreas\Gesichertes Video\_avt 512 bytes
File C:\Users\Andreas\Gesichertes Video\_lit 512 bytes
---- EOF - GMER 2.1 ----
|
|
20.04.2013, 01:54
| #8 |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Hmm.. Schritt 1 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinen Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung. Hinweis: Sollte der Scan Button ausgeblendet sein, schliesse das Tool und starte es erneut. Sollte es erneut nicht klappen, teile mir das bitte mit. Schritt 2 Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts löschen, sondern nur einen Scan-Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
20.04.2013, 03:00
| #9 |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista ist das "hmm.." eher ein schlechtes zeichen....XD ? hab den ersten scan laufen |
|
20.04.2013, 12:21
| #10 |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Nein, das hat nicht so viel zu bedeuten. Ich möchte mir einfach noch etwas anschauen, bevor wir zuschlagen. 
__________________ cheers, Leo |
|
20.04.2013, 13:06
| #11 |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software Run date: 2013-04-20 03:52:34 ----------------------------- 03:52:34.383 OS Version: Windows x64 6.0.6001 Service Pack 1 03:52:34.383 Number of processors: 2 586 0x170A 03:52:34.383 ComputerName: ANDI UserName: 03:52:35.617 Initialize success 03:59:46.192 AVAST engine defs: 13041901 04:00:17.207 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 04:00:17.210 Disk 0 Vendor: ST950032 0002 Size: 476940MB BusType: 3 04:00:19.024 Disk 0 MBR read successfully 04:00:19.026 Disk 0 MBR scan 04:00:19.030 Disk 0 unknown MBR code 04:00:19.144 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 12997 MB offset 63 04:00:19.294 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 120794 MB offset 26619705 04:00:19.378 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 117677 MB offset 274008064 04:00:19.382 Disk 0 Partition - 00 0F Extended LBA 225466 MB offset 515011770 04:00:19.510 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 225466 MB offset 515011833 04:00:20.891 Disk 0 scanning C:\Windows\system32\drivers 04:02:21.695 Service scanning 04:02:45.699 Modules scanning 04:02:45.700 Disk 0 trace - called modules: 04:02:45.822 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys spmx.sys hal.dll 04:02:45.823 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006b14740] 04:02:45.823 3 CLASSPNP.SYS[fffffa600140db3a] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80067cf050] 04:02:46.803 AVAST engine scan C:\Windows 04:04:09.343 AVAST engine scan C:\Windows\system32 04:13:20.773 AVAST engine scan C:\Windows\system32\drivers 04:13:49.063 AVAST engine scan C:\Users\Sicherheit 04:14:17.399 AVAST engine scan C:\ProgramData 04:17:18.322 Scan finished successfully 14:04:34.425 Disk 0 MBR has been saved successfully to "C:\Users\Sicherheit\Desktop\MBR.dat" 14:04:34.428 The log file has been saved successfully to "C:\Users\Sicherheit\Desktop\aswMBR.txt" Geändert von Kudla (20.04.2013 um 13:13 Uhr) Grund: zuviel |
|
20.04.2013, 13:11
| #12 | |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, VistaZitat:
|
|
20.04.2013, 13:17
| #13 | |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Ok, dann los: Schritt 1 Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.
Schritt 2 Warnung für Mitleser: Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix.
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Schritt 3 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
21.04.2013, 00:37
| #14 |
| | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Teil 1 vom AdwCleaner: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.200 - Datei am 21/04/2013 um 00:59:16 erstellt
# Aktualisiert am 02/04/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Sicherheit - ANDI
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sicherheit\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\SICHER~1\AppData\Local\Temp\searchqutoolbar-manifest.xml
Gelöscht mit Neustart : C:\Program Files\Babylon
Gelöscht mit Neustart : C:\Users\Andreas\AppData\LocalLow\searchquband
Gelöscht mit Neustart : C:\Users\Andreas\AppData\LocalLow\Searchqutoolbar
Gelöscht mit Neustart : C:\Users\Andreas\AppData\Roaming\dvdvideosoftiehelpers
Gelöscht mit Neustart : C:\Users\Andreas\AppData\Roaming\vghd
***** [Registrierungsdatenbank] *****
Daten Gelöscht : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\WI9130~1\Datamngr\x64\datamngr.dll
Daten Gelöscht : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\WI9130~1\Datamngr\x64\IEBHO.dll
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Bandoo
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabyDict
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabyGloss
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabyOptFile
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\14919ea49a8f3b4aa3cf1058d9a64cec
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43B7-BEA3-87217BDA74C8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.19088
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Opera v12.15.1748.0
Datei : C:\Users\Andreas\AppData\Roaming\Opera\Opera\operaprefs.ini
Gelöscht : Home URL=hxxp://www.searchqu.com/
Datei : C:\Users\Sicherheit\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [8613 octets] - [21/04/2013 00:59:16]
########## EOF - C:\AdwCleaner[S1].txt - [8673 octets] ##########
Teil 2: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.200 - Datei am 21/04/2013 um 01:04:22 erstellt
# Aktualisiert am 02/04/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 1 (64 bits)
# Benutzer : Sicherheit - ANDI
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sicherheit\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Gelöscht mit Neustart : C:\Program Files\Babylon
Gelöscht mit Neustart : C:\Users\Andreas\AppData\LocalLow\searchquband
Gelöscht mit Neustart : C:\Users\Andreas\AppData\LocalLow\Searchqutoolbar
Gelöscht mit Neustart : C:\Users\Andreas\AppData\Roaming\dvdvideosoftiehelpers
Gelöscht mit Neustart : C:\Users\Andreas\AppData\Roaming\vghd
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.6001.19088
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Opera v12.15.1748.0
Datei : C:\Users\Andreas\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
Datei : C:\Users\Sicherheit\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [8684 octets] - [21/04/2013 00:59:16]
AdwCleaner[S2].txt - [1213 octets] - [21/04/2013 01:04:22]
########## EOF - C:\AdwCleaner[S2].txt - [1273 octets] ##########
Logfile vom Combofix: Combofix Logfile: Code:
ATTFilter ComboFix 13-04-20.02 - Sicherheit 21.04.2013 1:24.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.43.1031.18.4862.3423 [GMT 2:00]
ausgeführt von:: c:\users\Sicherheit\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\programdata\Microsoft\Windows\Templates\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
c:\users\Andreas\AppData\Local\uninstall.tmp
c:\users\Andreas\AppData\Roaming\skype.dat
c:\users\Andreas\AppData\Roaming\skype.ini
c:\windows\msvcr71.dll
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\SET2915.tmp
c:\windows\SysWow64\SETFE9.tmp
c:\windows\SysWow64\suf3BC9.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-03-20 bis 2013-04-20 ))))))))))))))))))))))))))))))
.
.
2013-04-20 23:31 . 2013-04-20 23:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-20 23:31 . 2013-04-20 23:31 -------- d-----w- c:\users\Andreas\AppData\Local\temp
2013-04-20 22:59 . 2013-04-20 23:04 684 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-17 22:36 . 2011-05-18 02:08 694784 ----a-w- c:\windows\system32\drivers\bthport.sys
2013-04-17 22:36 . 2011-05-18 02:08 204288 ----a-w- c:\windows\system32\fsquirt.exe
2013-04-17 22:36 . 2011-05-18 02:08 26624 ----a-w- c:\windows\system32\drivers\bthenum.sys
2013-04-17 22:36 . 2011-05-18 02:08 35328 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2013-04-16 22:04 . 2010-09-20 12:14 316416 ----a-w- c:\windows\system32\msshsq.dll
2013-04-16 22:04 . 2010-09-20 09:25 231936 ----a-w- c:\windows\SysWow64\msshsq.dll
2013-04-16 21:45 . 2010-08-31 15:21 633856 ----a-w- c:\windows\system32\comctl32.dll
2013-04-16 21:45 . 2010-08-31 15:40 531968 ----a-w- c:\windows\SysWow64\comctl32.dll
2013-04-16 21:45 . 2010-10-18 14:25 87552 ----a-w- c:\windows\system32\consent.exe
2013-04-16 21:44 . 2010-02-18 14:21 224256 ----a-w- c:\windows\system32\iphlpsvc.dll
2013-04-16 21:44 . 2010-02-18 12:15 29696 ----a-w- c:\windows\system32\drivers\tunnel.sys
2013-04-16 21:43 . 2010-08-31 15:41 954752 ----a-w- c:\windows\SysWow64\mfc40.dll
2013-04-16 21:43 . 2010-08-31 15:41 954288 ----a-w- c:\windows\SysWow64\mfc40u.dll
2013-04-16 21:43 . 2010-09-10 17:30 13425152 ----a-w- c:\windows\system32\wmp.dll
2013-04-16 21:43 . 2010-09-10 16:35 168960 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-04-16 21:43 . 2010-09-10 15:51 171008 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-04-16 21:43 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-04-16 21:43 . 2010-09-10 15:52 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2013-04-16 21:41 . 2009-07-10 12:37 301568 ----a-w- c:\windows\system32\shsvcs.dll
2013-04-16 21:41 . 2010-10-15 14:02 4692368 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-16 21:41 . 2010-10-15 13:43 1560960 ----a-w- c:\windows\system32\ntdll.dll
2013-04-16 21:41 . 2010-10-15 13:43 1167488 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-04-16 21:41 . 2009-08-10 14:09 1794560 ----a-w- c:\windows\system32\msxml6.dll
2013-04-16 21:41 . 2009-08-10 11:01 1399296 ----a-w- c:\windows\SysWow64\msxml6.dll
2013-04-16 21:41 . 2011-01-21 15:56 12898304 ----a-w- c:\windows\system32\shell32.dll
2013-04-16 21:38 . 2011-02-18 13:50 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2013-04-16 21:38 . 2011-02-16 13:44 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-16 21:38 . 2011-02-16 15:36 48128 ----a-w- c:\windows\system32\atmlib.dll
2013-04-16 21:38 . 2011-02-16 15:29 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-16 21:38 . 2011-02-16 13:24 292864 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-16 21:38 . 2010-06-16 15:52 96256 ----a-w- c:\windows\system32\fontsub.dll
2013-04-16 21:38 . 2010-06-16 15:12 72704 ----a-w- c:\windows\SysWow64\fontsub.dll
2013-04-16 21:38 . 2010-09-06 15:59 179712 ----a-w- c:\windows\system32\srvsvc.dll
2013-04-16 21:38 . 2010-09-06 16:24 9728 ----a-w- c:\windows\SysWow64\sscore.dll
2013-04-16 21:38 . 2010-09-06 16:23 17920 ----a-w- c:\windows\SysWow64\netevent.dll
2013-04-16 21:38 . 2010-09-06 15:59 12288 ----a-w- c:\windows\system32\sscore.dll
2013-04-16 21:38 . 2010-09-06 15:57 17920 ----a-w- c:\windows\system32\netevent.dll
2013-04-16 21:37 . 2010-10-12 16:16 35328 ----a-w- c:\program files\Windows Mail\wabfind.dll
2013-04-16 21:37 . 2010-10-12 14:15 68096 ----a-w- c:\program files\Windows Mail\wabmig.exe
2013-04-16 21:37 . 2010-10-12 14:15 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2013-04-16 21:37 . 2010-10-12 13:52 66048 ----a-w- c:\program files (x86)\Windows Mail\wabmig.exe
2013-04-16 21:37 . 2010-10-12 13:52 515584 ----a-w- c:\program files (x86)\Windows Mail\wab.exe
2013-04-16 21:37 . 2010-10-12 15:48 33280 ----a-w- c:\program files (x86)\Windows Mail\wabfind.dll
2013-04-16 21:37 . 2010-10-28 13:17 2048 ----a-w- c:\windows\system32\tzres.dll
2013-04-16 21:37 . 2010-10-28 12:56 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-04-16 21:35 . 2011-03-10 16:30 1360384 ----a-w- c:\windows\system32\mfc42u.dll
2013-04-16 21:35 . 2011-03-10 16:30 1398784 ----a-w- c:\windows\system32\mfc42.dll
2013-04-16 21:35 . 2011-03-10 16:12 1136640 ----a-w- c:\windows\SysWow64\mfc42.dll
2013-04-16 21:35 . 2011-03-10 16:12 1161728 ----a-w- c:\windows\SysWow64\mfc42u.dll
2013-04-16 21:35 . 2010-12-14 16:20 1251840 ----a-w- c:\windows\system32\sdclt.exe
2013-04-16 21:23 . 2010-11-06 04:35 854528 ----a-w- c:\windows\system32\schedsvc.dll
2013-04-16 21:23 . 2010-11-06 04:35 499712 ----a-w- c:\windows\system32\wmicmiplugin.dll
2013-04-16 21:23 . 2010-11-06 04:35 655872 ----a-w- c:\windows\system32\taskschd.dll
2013-04-16 21:23 . 2010-11-06 11:10 357376 ----a-w- c:\windows\SysWow64\taskschd.dll
2013-04-16 21:23 . 2010-11-06 11:10 270336 ----a-w- c:\windows\SysWow64\taskcomp.dll
2013-04-16 21:23 . 2010-11-06 04:35 410112 ----a-w- c:\windows\system32\taskcomp.dll
2013-04-16 21:23 . 2010-11-05 00:53 171520 ----a-w- c:\windows\SysWow64\taskeng.exe
2013-04-16 21:23 . 2010-11-04 21:16 267776 ----a-w- c:\windows\system32\taskeng.exe
2013-04-16 21:21 . 2010-08-20 15:56 1090048 ----a-w- c:\windows\system32\wmpmde.dll
2013-04-16 21:21 . 2010-08-20 15:21 866816 ----a-w- c:\windows\SysWow64\wmpmde.dll
2013-04-16 21:21 . 2011-03-02 15:10 117760 ----a-w- c:\windows\system32\dnsrslvr.dll
2013-04-16 21:21 . 2011-03-02 15:10 221184 ----a-w- c:\windows\system32\dnsapi.dll
2013-04-16 21:21 . 2009-05-04 10:38 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2013-04-16 21:21 . 2009-05-04 10:11 25088 ----a-w- c:\windows\SysWow64\dnscacheugc.exe
2013-04-16 20:50 . 2013-04-16 20:51 -------- d-----w- c:\users\Sicherheit
2013-04-02 21:02 . 2013-04-02 21:02 -------- d-----w- c:\program files\Bonjour
2013-04-02 21:02 . 2013-04-02 21:02 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-02 21:01 . 2013-04-02 21:01 -------- d-----w- c:\program files (x86)\Apple Software Update
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-20 23:06 . 2009-09-20 10:16 45056 ----a-w- c:\windows\system32\acovcnt.exe
2013-04-01 17:58 . 2006-11-02 12:35 72702784 ----a-w- c:\windows\system32\mrt.exe
2013-03-15 23:40 . 2012-04-24 15:53 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-15 23:40 . 2011-05-15 01:57 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-10 03:25 . 2013-02-18 20:54 15275744 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-02-10 03:25 . 2013-02-18 20:54 7569184 ----a-w- c:\windows\system32\nvopencl.dll
2013-02-10 03:25 . 2013-02-18 20:54 6267240 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-02-10 03:25 . 2013-02-18 20:54 26947360 ----a-w- c:\windows\system32\nvoglv64.dll
2013-02-10 03:25 . 2013-02-18 20:54 20534560 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-02-10 03:25 . 2013-02-18 20:54 12862400 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-02-10 03:25 . 2013-02-18 20:54 11040544 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-02-10 03:25 . 2013-02-18 20:54 1807136 ----a-w- c:\windows\system32\nvdispco6420294.dll
2013-02-10 03:25 . 2013-02-18 20:54 1510176 ----a-w- c:\windows\system32\nvdispgenco6420162.dll
2013-02-10 03:25 . 2013-02-18 20:54 9422672 ----a-w- c:\windows\system32\nvcuda.dll
2013-02-10 03:25 . 2013-02-18 20:54 7964680 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-02-10 03:25 . 2013-02-18 20:54 2911008 ----a-w- c:\windows\system32\nvcuvid.dll
2013-02-10 03:25 . 2013-02-18 20:54 2726176 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-02-10 03:25 . 2013-02-18 20:54 2350368 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-02-10 03:25 . 2013-02-18 20:54 1990944 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-02-10 03:25 . 2013-02-18 20:54 25256736 ----a-w- c:\windows\system32\nvcompiler.dll
2013-02-10 03:25 . 2013-02-18 20:54 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-02-10 03:25 . 2009-07-01 22:59 15038296 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-02-10 03:25 . 2009-02-19 03:40 17987192 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-02-10 03:25 . 2009-02-19 03:40 2854344 ----a-w- c:\windows\system32\nvapi64.dll
2013-02-10 03:25 . 2008-12-16 07:02 2528840 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-02-10 01:04 . 2011-01-07 18:50 6393120 ----a-w- c:\windows\system32\nvcpl.dll
2013-02-10 01:04 . 2011-01-07 18:49 3472672 ----a-w- c:\windows\system32\nvsvc64.dll
2013-02-10 01:04 . 2011-01-07 18:49 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-02-10 01:04 . 2011-01-07 18:49 877856 ----a-w- c:\windows\system32\nvvsvc.exe
2013-02-10 01:04 . 2011-01-07 18:49 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-02-10 01:04 . 2009-07-02 00:20 63776 ----a-w- c:\windows\system32\nvshext.dll
2009-04-08 17:31 . 2009-04-08 17:31 106496 ----a-w- c:\program files (x86)\Common Files\CPInstallAction.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08 143360 ----a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1555968]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-04-07 159744]
"ADSMTray"="c:\program files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"DirectConsole2"="c:\program files (x86)\ASUS\Direct Console\Direct Console.exe" [2009-04-08 2861624]
"Turbo Gear Help"="c:\program files\ASUS\Turbo Gear\GearHelp.exe" [2008-10-01 1025536]
"Turbo Gear"="c:\program files\ASUS\Turbo Gear\TurboGear.exe" [2008-10-14 2987008]
"ACMON"="c:\program files (x86)\ASUS\Splendid\ACMON.exe" [2008-10-01 1126400]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-09-20 3054136]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"amd_dc_opt"="c:\program files (x86)\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 106496]
"Realtime Audio Engine"="mmrtkrnl.exe" [2009-11-23 70144]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2012-01-29 2077536]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer7"=wdmaud.drv
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 23:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 23:52 159744 ----a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-03 11842152]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.43.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-MJ - c:\program files (x86)\d-lusion\MJ\uninstall.exe
AddRemove-DAEMON Tools Toolbar - c:\program files (x86)\DAEMON Tools Toolbar\uninst.exe
AddRemove-Uplay - d:\program files (x86)\Ubisoft\Ubisoft Game Launcher\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-04-21 01:33:28
ComboFix-quarantined-files.txt 2013-04-20 23:33
.
Vor Suchlauf: 9 Verzeichnis(se), 57.346.666.496 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 65.675.841.536 Bytes frei
.
- - End Of File - - 7FB55E9C87A2AE40184BD5B9D08B23BB
OTL-Logfile: OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.04.2013 01:44:47 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sicherheit\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19088) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 4,75 Gb Total Physical Memory | 3,03 Gb Available Physical Memory | 63,89% Memory free 9,70 Gb Paging File | 7,85 Gb Available in Paging File | 80,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 117,96 Gb Total Space | 61,24 Gb Free Space | 51,91% Space Free | Partition Type: NTFS Drive D: | 220,18 Gb Total Space | 92,87 Gb Free Space | 42,18% Space Free | Partition Type: NTFS Drive G: | 114,92 Gb Total Space | 56,85 Gb Free Space | 49,47% Space Free | Partition Type: NTFS Computer Name: ANDI | User Name: Sicherheit | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.18 23:06:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe PRC - [2013.04.16 23:12:54 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\Opera.exe PRC - [2012.01.29 14:43:17 | 002,077,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgtray.exe PRC - [2010.11.24 21:51:33 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe PRC - [2010.07.21 11:03:18 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe PRC - [2010.07.17 19:17:41 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe PRC - [2009.11.23 22:40:22 | 000,070,144 | ---- | M] (AlcaTech) -- C:\Windows\SysWOW64\mmrtkrnl.exe PRC - [2009.09.20 12:07:23 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2009.09.20 11:17:46 | 000,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe PRC - [2009.04.07 18:34:26 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe PRC - [2009.03.21 05:37:18 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe PRC - [2009.03.04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe PRC - [2008.10.15 01:13:24 | 002,987,008 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\TurboGear.exe PRC - [2008.08.14 05:59:56 | 000,301,624 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe PRC - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe PRC - [2008.08.14 01:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe PRC - [2008.07.19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe PRC - [2008.06.18 07:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ========== Modules (No Company Name) ========== MOD - [2009.10.23 18:01:58 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2008.10.15 01:13:24 | 002,987,008 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\TurboGear.exe MOD - [2008.08.28 01:32:36 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll MOD - [2008.06.09 18:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2008.05.23 06:24:10 | 000,045,056 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\atkmethod.dll MOD - [2008.02.17 07:08:46 | 000,950,272 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\OcSetting.dll MOD - [2007.06.15 19:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll MOD - [2007.06.02 02:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll MOD - [2005.05.12 00:39:32 | 000,565,248 | ---- | M] () -- C:\Program Files\ASUS\Turbo Gear\pngio.dll ========== Services (SafeList) ========== SRV:64bit: - [2008.01.21 04:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV:64bit: - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2013.03.16 01:40:29 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.29 12:34:47 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2010.07.21 11:03:18 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc) SRV - [2010.07.17 19:17:41 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2009.10.20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) SRV - [2009.02.07 01:57:18 | 000,072,248 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe -- (WBVGAservice) SRV - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2008.07.27 20:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.01.15 22:02:49 | 000,282,976 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgldx64.sys -- (AvgLdx64) DRV:64bit: - [2011.09.12 20:18:11 | 000,035,664 | ---- | M] () [File_System | System | Running] -- C:\Windows\SysNative\Drivers\avgmfx64.sys -- (AvgMfx64) DRV:64bit: - [2011.07.20 09:46:06 | 000,203,320 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ssudmdm.sys -- (ssudmdm) DRV:64bit: - [2011.07.20 09:46:06 | 000,095,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ssudbus.sys -- (dg_ssudbus) DRV:64bit: - [2011.06.09 22:28:16 | 000,311,968 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt) DRV:64bit: - [2011.06.09 22:28:10 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt) DRV:64bit: - [2011.05.06 01:21:57 | 000,317,520 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgtdia.sys -- (AvgTdiA) DRV:64bit: - [2010.08.02 11:00:50 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.07.26 15:18:58 | 000,020,568 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv) DRV:64bit: - [2010.07.26 15:15:26 | 000,016,392 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TFsExDisk.sys -- (TFsExDisk) DRV:64bit: - [2010.04.27 04:25:22 | 000,161,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscemdm.sys -- (sscemdm) DRV:64bit: - [2010.04.27 04:25:22 | 000,129,024 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssceserd.sys -- (ssceserd) DRV:64bit: - [2010.04.27 04:25:22 | 000,127,488 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscebus.sys -- (sscebus) DRV:64bit: - [2010.04.27 04:25:22 | 000,018,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sscemdfl.sys -- (sscemdfl) DRV:64bit: - [2010.02.25 17:51:02 | 000,029,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\tap0901.sys -- (tap0901) DRV:64bit: - [2009.11.25 14:59:28 | 000,058,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nchvsc64.sys -- (NCHVSC64) DRV:64bit: - [2009.10.20 20:19:54 | 000,047,632 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) DRV:64bit: - [2009.09.20 11:37:17 | 000,035,384 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\AsDsm.sys -- (AsDsm) DRV:64bit: - [2009.05.18 15:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.04.02 02:46:40 | 000,016,440 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\DRIVERS\lullaby.sys -- (lullaby) DRV:64bit: - [2009.02.11 11:26:17 | 000,407,576 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor) DRV:64bit: - [2009.01.14 02:48:18 | 001,187,840 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\athrx.sys -- (athr) DRV:64bit: - [2008.11.03 09:03:27 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\kbfiltr.sys -- (kbfiltr) DRV:64bit: - [2008.07.09 11:16:19 | 000,092,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2008.05.13 15:02:13 | 000,019,880 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\btwrchid.sys -- (btwrchid) DRV:64bit: - [2008.05.13 15:02:11 | 000,121,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2008.05.02 07:59:47 | 000,166,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2008.02.16 03:27:18 | 000,062,976 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2008.01.29 04:46:57 | 000,036,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2008.01.24 07:24:23 | 000,060,928 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\enecir.sys -- (enecir) DRV:64bit: - [2008.01.21 04:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2008.01.21 04:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb) DRV:64bit: - [2008.01.21 04:46:55 | 000,111,104 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus) DRV:64bit: - [2008.01.21 04:46:52 | 000,019,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2007.12.06 12:12:55 | 000,320,048 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP) DRV:64bit: - [2007.10.17 06:54:20 | 000,015,872 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\EIO64.sys -- (EIO64) DRV:64bit: - [2007.07.28 04:45:52 | 000,057,856 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2007.07.27 05:33:54 | 000,055,296 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2007.07.24 20:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) DRV:64bit: - [2007.04.16 20:51:50 | 000,014,112 | R--- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (regi) DRV:64bit: - [2006.10.27 15:01:07 | 000,013,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2006.10.04 03:45:36 | 000,273,408 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64) DRV:64bit: - [2006.06.27 15:24:22 | 000,047,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\AmdTools64.sys -- (AmdTools64) DRV - [2010.07.26 15:15:26 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk) DRV - [2004.01.26 17:36:35 | 000,095,552 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02) DRV - [2004.01.26 17:01:28 | 000,052,224 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06) DRV - [2003.12.01 17:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013.03.05 21:42:16 | 000,000,000 | ---D | M] O1 HOSTS File: ([2013.04.21 01:31:49 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ACMON] C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\amd_dc_opt\amd_dc_opt.exe () O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS) O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [DirectConsole2] C:\Program Files (x86)\ASUS\Direct Console\Direct Console.exe (ASUSTek.) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\SysWow64\mmrtkrnl.exe (AlcaTech) O4 - HKLM..\Run: [Turbo Gear] C:\Program Files\ASUS\Turbo Gear\TurboGear.exe () O4 - HKLM..\Run: [Turbo Gear Help] C:\Program Files\ASUS\Turbo Gear\GearHelp.exe () O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DirectShowDemuxFilter.dll] C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DirectShowDemuxFilter.dll (DivX, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4136263938-1271678022-4162842909-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.43.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B4D2956-A9C9-4FC5-8C99-B5BA51882005}: DhcpNameServer = 192.168.42.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47A80E82-F4D2-4F11-924A-61B118A1C5CF}: DhcpNameServer = 192.168.43.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GR99D3~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe () O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GRA8E1~1.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.21 01:33:30 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.04.21 01:33:30 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\temp [2013.04.21 01:22:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.04.21 01:22:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.04.21 01:22:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.04.21 01:18:02 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\AVG9 [2013.04.21 01:13:59 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.04.21 01:13:41 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.04.21 00:57:56 | 005,057,033 | R--- | C] (Swearware) -- C:\Users\Sicherheit\Desktop\ComboFix.exe [2013.04.20 03:52:23 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Sicherheit\Desktop\tdsskiller.exe [2013.04.20 03:50:54 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Sicherheit\Desktop\aswMBR.exe [2013.04.18 23:06:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe [2013.04.18 23:05:37 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Adobe [2013.04.16 23:59:49 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\vlc [2013.04.16 23:56:22 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\NVIDIA [2013.04.16 23:56:11 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\DivX [2013.04.16 23:28:24 | 000,000,000 | ---D | C] -- C:\Config.Msi [2013.04.16 23:09:07 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Opera [2013.04.16 23:09:07 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Opera [2013.04.16 23:03:39 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\VirtualStore [2013.04.16 22:53:01 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Apple Computer [2013.04.16 22:52:54 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Power2Go [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Searches [2013.04.16 22:51:22 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.04.16 22:51:16 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Identities [2013.04.16 22:51:14 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Contacts [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Vorlagen [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Verlauf [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Temporary Internet Files [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Startmenü [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\SendTo [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Recent [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Netzwerkumgebung [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Lokale Einstellungen [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Videos [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Musik [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Eigene Dateien [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Documents\Eigene Bilder [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Druckumgebung [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Cookies [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\AppData\Local\Anwendungsdaten [2013.04.16 22:50:04 | 000,000,000 | -HSD | C] -- C:\Users\Sicherheit\Anwendungsdaten [2013.04.16 22:50:03 | 000,000,000 | --SD | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Videos [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Saved Games [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Pictures [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Music [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Links [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Favorites [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Downloads [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Documents [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\Desktop [2013.04.16 22:50:03 | 000,000,000 | R--D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.04.16 22:50:03 | 000,000,000 | -H-D | C] -- C:\Users\Sicherheit\AppData [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Local\Microsoft [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Media Center Programs [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Macromedia [2013.04.16 22:50:03 | 000,000,000 | ---D | C] -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite [2013.04.02 23:02:12 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2013.04.02 23:02:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2013.04.02 23:01:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.04.21 01:39:14 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.04.21 01:35:39 | 000,000,432 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics [2013.04.21 01:31:49 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2013.04.21 01:06:26 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe [2013.04.21 01:05:58 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.04.21 01:05:58 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.04.21 01:05:56 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl [2013.04.21 01:05:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.04.21 01:05:49 | 804,294,655 | -HS- | M] () -- C:\hiberfil.sys [2013.04.21 01:04:46 | 000,004,268 | ---- | M] () -- C:\Windows\bthservsdp.dat [2013.04.21 01:04:38 | 000,000,684 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat [2013.04.21 00:57:58 | 118,021,586 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm [2013.04.21 00:57:56 | 005,057,033 | R--- | M] (Swearware) -- C:\Users\Sicherheit\Desktop\ComboFix.exe [2013.04.21 00:57:06 | 000,613,083 | ---- | M] () -- C:\Users\Sicherheit\Desktop\adwcleaner.exe [2013.04.20 14:04:34 | 000,000,512 | ---- | M] () -- C:\Users\Sicherheit\Desktop\MBR.dat [2013.04.20 03:52:27 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Sicherheit\Desktop\tdsskiller.exe [2013.04.20 03:52:21 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Sicherheit\Desktop\aswMBR.exe [2013.04.20 02:48:28 | 000,000,104 | ---- | M] () -- C:\Users\Sicherheit\Desktop\Computer.lnk [2013.04.19 16:53:29 | 000,377,856 | ---- | M] () -- C:\Users\Sicherheit\Desktop\mx7b4erb.exe [2013.04.18 23:06:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sicherheit\Desktop\OTL.exe [2013.04.18 00:55:36 | 000,374,424 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.04.18 00:20:11 | 000,000,514 | ---- | M] () -- C:\Windows\SysWow64\ABG71GX.DAT [2013.04.16 23:30:44 | 001,427,406 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.04.16 23:30:44 | 000,621,952 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.04.16 23:30:44 | 000,590,082 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.04.16 23:30:44 | 000,123,852 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.04.16 23:30:44 | 000,102,094 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.04.16 22:55:17 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2013.04.02 23:04:57 | 000,122,608 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.04.21 01:22:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.04.21 01:22:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.04.21 01:22:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.04.21 01:22:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.04.21 01:22:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.04.21 00:59:29 | 000,000,684 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat [2013.04.21 00:57:05 | 000,613,083 | ---- | C] () -- C:\Users\Sicherheit\Desktop\adwcleaner.exe [2013.04.20 14:04:34 | 000,000,512 | ---- | C] () -- C:\Users\Sicherheit\Desktop\MBR.dat [2013.04.20 02:48:28 | 000,000,104 | ---- | C] () -- C:\Users\Sicherheit\Desktop\Computer.lnk [2013.04.19 16:53:29 | 000,377,856 | ---- | C] () -- C:\Users\Sicherheit\Desktop\mx7b4erb.exe [2013.04.18 00:36:51 | 000,694,784 | ---- | C] () -- C:\Windows\SysNative\drivers\bthport.sys [2013.04.18 00:36:51 | 000,204,288 | ---- | C] () -- C:\Windows\SysNative\fsquirt.exe [2013.04.18 00:36:51 | 000,035,328 | ---- | C] () -- C:\Windows\SysNative\drivers\BTHUSB.SYS [2013.04.18 00:36:51 | 000,026,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bthenum.sys [2013.04.18 00:35:57 | 009,272,320 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll [2013.04.18 00:35:56 | 012,477,440 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll [2013.04.18 00:35:51 | 001,488,384 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll [2013.04.18 00:35:50 | 002,339,840 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll [2013.04.18 00:35:50 | 001,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll [2013.04.18 00:35:50 | 001,062,912 | ---- | C] () -- C:\Windows\SysNative\mstime.dll [2013.04.18 00:35:50 | 000,710,656 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll [2013.04.18 00:35:50 | 000,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll [2013.04.18 00:35:50 | 000,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll [2013.04.18 00:35:49 | 001,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb [2013.04.18 00:35:49 | 001,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl [2013.04.18 00:35:49 | 000,479,232 | ---- | C] () -- C:\Windows\SysNative\html.iec [2013.04.18 00:35:49 | 000,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll [2013.04.18 00:35:49 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll [2013.04.18 00:35:49 | 000,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe [2013.04.18 00:35:49 | 000,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll [2013.04.18 00:35:49 | 000,096,768 | ---- | C] () -- C:\Windows\SysNative\mshtmled.dll [2013.04.18 00:35:49 | 000,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll [2013.04.18 00:35:49 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll [2013.04.18 00:35:49 | 000,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll [2013.04.18 00:35:49 | 000,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe [2013.04.18 00:35:49 | 000,056,832 | ---- | C] () -- C:\Windows\SysNative\licmgr10.dll [2013.04.18 00:35:49 | 000,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll [2013.04.18 00:35:49 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe [2013.04.18 00:35:45 | 002,762,240 | ---- | C] () -- C:\Windows\SysNative\win32k.sys [2013.04.18 00:35:44 | 000,176,128 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys [2013.04.18 00:35:44 | 000,144,896 | ---- | C] () -- C:\Windows\SysNative\drivers\srvnet.sys [2013.04.18 00:35:43 | 000,847,872 | ---- | C] () -- C:\Windows\SysNative\oleaut32.dll [2013.04.18 00:35:43 | 000,274,432 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb10.sys [2013.04.18 00:35:43 | 000,135,168 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb.sys [2013.04.18 00:35:43 | 000,105,984 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb20.sys [2013.04.18 00:35:42 | 000,407,552 | ---- | C] () -- C:\Windows\SysNative\drivers\afd.sys [2013.04.18 00:35:42 | 000,097,792 | ---- | C] () -- C:\Windows\SysNative\drivers\dfsc.sys [2013.04.18 00:35:41 | 000,975,360 | ---- | C] () -- C:\Windows\SysNative\inetcomm.dll [2013.04.18 00:35:40 | 000,344,576 | ---- | C] () -- C:\Windows\SysNative\schannel.dll [2013.04.18 00:35:39 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\winsrv.dll [2013.04.18 00:35:39 | 000,085,504 | ---- | C] () -- C:\Windows\SysNative\csrsrv.dll [2013.04.18 00:20:11 | 000,000,514 | ---- | C] () -- C:\Windows\SysWow64\ABG71GX.DAT [2013.04.17 00:04:08 | 000,316,416 | ---- | C] () -- C:\Windows\SysNative\msshsq.dll [2013.04.16 23:45:47 | 000,633,856 | ---- | C] () -- C:\Windows\SysNative\comctl32.dll [2013.04.16 23:45:00 | 000,087,552 | ---- | C] () -- C:\Windows\SysNative\consent.exe [2013.04.16 23:44:12 | 000,224,256 | ---- | C] () -- C:\Windows\SysNative\iphlpsvc.dll [2013.04.16 23:44:12 | 000,029,696 | ---- | C] () -- C:\Windows\SysNative\drivers\tunnel.sys [2013.04.16 23:43:44 | 013,425,152 | ---- | C] () -- C:\Windows\SysNative\wmp.dll [2013.04.16 23:43:31 | 008,147,968 | ---- | C] () -- C:\Windows\SysNative\wmploc.DLL [2013.04.16 23:42:37 | 000,189,952 | ---- | C] () -- C:\Windows\SysNative\t2embed.dll [2013.04.16 23:42:13 | 000,462,848 | ---- | C] () -- C:\Windows\SysNative\odbc32.dll [2013.04.16 23:41:59 | 000,301,568 | ---- | C] () -- C:\Windows\SysNative\shsvcs.dll [2013.04.16 23:41:20 | 004,692,368 | ---- | C] () -- C:\Windows\SysNative\ntoskrnl.exe [2013.04.16 23:41:19 | 001,560,960 | ---- | C] () -- C:\Windows\SysNative\ntdll.dll [2013.04.16 23:41:11 | 001,794,560 | ---- | C] () -- C:\Windows\SysNative\msxml6.dll [2013.04.16 23:41:01 | 012,898,304 | ---- | C] () -- C:\Windows\SysNative\shell32.dll [2013.04.16 23:40:56 | 000,454,144 | ---- | C] () -- C:\Windows\SysNative\shlwapi.dll [2013.04.16 23:40:50 | 000,817,664 | ---- | C] () -- C:\Windows\SysNative\jscript.dll [2013.04.16 23:40:49 | 000,613,376 | ---- | C] () -- C:\Windows\SysNative\vbscript.dll [2013.04.16 23:40:45 | 000,979,344 | ---- | C] () -- C:\Windows\SysNative\winresume.exe [2013.04.16 23:40:44 | 001,075,600 | ---- | C] () -- C:\Windows\SysNative\winload.efi [2013.04.16 23:40:44 | 001,062,800 | ---- | C] () -- C:\Windows\SysNative\winload.exe [2013.04.16 23:40:44 | 000,990,096 | ---- | C] () -- C:\Windows\SysNative\winresume.efi [2013.04.16 23:40:43 | 000,020,880 | ---- | C] () -- C:\Windows\SysNative\kdusb.dll [2013.04.16 23:40:43 | 000,018,832 | ---- | C] () -- C:\Windows\SysNative\kd1394.dll [2013.04.16 23:40:43 | 000,018,320 | ---- | C] () -- C:\Windows\SysNative\kdcom.dll [2013.04.16 23:40:38 | 002,424,320 | ---- | C] () -- C:\Windows\SysNative\mstscax.dll [2013.04.16 23:40:36 | 000,730,624 | ---- | C] () -- C:\Windows\SysNative\mstsc.exe [2013.04.16 23:40:31 | 001,923,584 | ---- | C] () -- C:\Windows\SysNative\ole32.dll [2013.04.16 23:40:16 | 000,461,312 | ---- | C] () -- C:\Windows\SysNative\drivers\srv.sys [2013.04.16 23:40:13 | 000,560,128 | ---- | C] () -- C:\Windows\SysNative\EncDec.dll [2013.04.16 23:40:12 | 000,416,768 | ---- | C] () -- C:\Windows\SysNative\sbe.dll [2013.04.16 23:40:12 | 000,226,816 | ---- | C] () -- C:\Windows\SysNative\mpg2splt.ax [2013.04.16 23:40:12 | 000,210,944 | ---- | C] () -- C:\Windows\SysNative\sbeio.dll [2013.04.16 23:38:58 | 000,090,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bowser.sys [2013.04.16 23:38:53 | 000,367,616 | ---- | C] () -- C:\Windows\SysNative\atmfd.dll [2013.04.16 23:38:52 | 000,096,256 | ---- | C] () -- C:\Windows\SysNative\fontsub.dll [2013.04.16 23:38:52 | 000,048,128 | ---- | C] () -- C:\Windows\SysNative\atmlib.dll [2013.04.16 23:38:17 | 000,179,712 | ---- | C] () -- C:\Windows\SysNative\srvsvc.dll [2013.04.16 23:38:16 | 000,017,920 | ---- | C] () -- C:\Windows\SysNative\netevent.dll [2013.04.16 23:38:16 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\sscore.dll [2013.04.16 23:37:14 | 000,002,048 | ---- | C] () -- C:\Windows\SysNative\tzres.dll [2013.04.16 23:35:18 | 001,398,784 | ---- | C] () -- C:\Windows\SysNative\mfc42.dll [2013.04.16 23:35:18 | 001,360,384 | ---- | C] () -- C:\Windows\SysNative\mfc42u.dll [2013.04.16 23:35:14 | 001,251,840 | ---- | C] () -- C:\Windows\SysNative\sdclt.exe [2013.04.16 23:23:03 | 000,854,528 | ---- | C] () -- C:\Windows\SysNative\schedsvc.dll [2013.04.16 23:23:02 | 000,655,872 | ---- | C] () -- C:\Windows\SysNative\taskschd.dll [2013.04.16 23:23:02 | 000,499,712 | ---- | C] () -- C:\Windows\SysNative\wmicmiplugin.dll [2013.04.16 23:23:01 | 000,410,112 | ---- | C] () -- C:\Windows\SysNative\taskcomp.dll [2013.04.16 23:23:01 | 000,267,776 | ---- | C] () -- C:\Windows\SysNative\taskeng.exe [2013.04.16 23:21:10 | 001,090,048 | ---- | C] () -- C:\Windows\SysNative\wmpmde.dll [2013.04.16 23:21:09 | 000,221,184 | ---- | C] () -- C:\Windows\SysNative\dnsapi.dll [2013.04.16 23:21:09 | 000,117,760 | ---- | C] () -- C:\Windows\SysNative\dnsrslvr.dll [2013.04.16 23:21:09 | 000,028,672 | ---- | C] () -- C:\Windows\SysNative\dnscacheugc.exe [2013.04.16 22:55:17 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2013.04.16 22:52:15 | 000,000,956 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2013.04.16 22:51:29 | 000,000,986 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.04.16 22:51:20 | 000,000,981 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2013.04.16 22:51:13 | 000,000,922 | ---- | C] () -- C:\Users\Sicherheit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2011.06.01 16:24:44 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2009.10.01 15:03:48 | 000,000,084 | -H-- | C] () -- C:\ProgramData\aspg.dat [2009.09.29 14:22:17 | 000,231,716 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.09.29 14:22:15 | 000,231,716 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg ========== ZeroAccess Check ========== [2006.11.02 17:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2011.01.21 17:56:31 | 012,898,304 | ---- | M] () "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 17:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.09.20 11:17:46 | 000,891,392 | ---- | M] () "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\SysWow64\wbem\fastprox.dll -- [2009.09.20 11:17:46 | 000,615,424 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008.01.21 04:50:58 | 000,513,024 | ---- | M] () "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\SysWow64\wbem\wbemess.dll ========== LOP Check ========== [2009.11.24 13:47:20 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\AlcaTech [2010.06.06 17:05:49 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\AVG9 [2011.02.19 20:38:05 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2010.08.02 11:14:30 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\DAEMON Tools Lite [2011.06.08 22:44:47 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\DriverCure [2013.01.21 19:12:28 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\DVDVideoSoft [2013.03.17 14:39:39 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\DVDVideoSoftIEHelpers [2011.05.31 20:54:22 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Easeware [2010.08.21 18:19:45 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\gtk-2.0 [2011.08.18 23:05:03 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Jens Lorek [2009.12.24 00:13:09 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\NCH Swift Sound [2009.09.29 23:52:06 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Opera [2011.06.08 22:44:47 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\ParetoLogic [2012.12.12 21:13:24 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\PunkBuster [2011.08.16 23:16:11 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Samsung [2010.07.08 11:27:30 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\TS3Client [2009.09.29 23:57:07 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\TubeBox [2011.12.01 19:29:44 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\Ubisoft [2009.11.15 05:00:48 | 000,000,000 | ---D | M] -- C:\Users\Andreas\AppData\Roaming\vghd [2013.04.21 01:18:02 | 000,000,000 | ---D | M] -- C:\Users\Sicherheit\AppData\Roaming\AVG9 [2013.04.16 23:09:07 | 000,000,000 | ---D | M] -- C:\Users\Sicherheit\AppData\Roaming\Opera ========== Purity Check ========== < End of report > Danke sehr! LG Andi |
|
21.04.2013, 13:56
| #15 |
| /// TB-Ausbilder | OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista Hallo Andi, Combofix sollte das Ding erwischt haben. Wir kontrollieren noch: Schritt 1
Code:
ATTFilter :commands
[emptytemp]
Schritt 2 Downloade dir bitte Malwarebytes Anti-Malware .
Schritt 3 Lade das Setup des ESET Online Scanners herunter und speichere es auf den Desktop.
Schritt 4 Downloade dir bitte SecurityCheck (Link 2).
Schritt 5 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
| Themen zu OTL - First Run, Weißer Bildschirm nach Anmeldung, Vista |
| adobe, avg, bho, bildschirm, bonjour, browser, defender, error, explorer, firefox, flash player, format, home, logfile, neustart, plug-in, realtek, registry, scan, security, senden, software, task-manager, vista, windows |
Textbox.
Linear-Darstellung
