| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Infiziert oder doch nicht?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
12.05.2013, 13:19
| #1 |
 |  Infiziert oder doch nicht? Hallo zusammen, ich bin neu hier und habe glaube ich ein großes Problem. Da ich mich mit der Virenmaterie nicht sehr gut bis gar nicht auskenne, seid Ihr meine letzte Rettung. Vielleicht mach ich mir ja auch umsonst sorgen. Hier mal die Sachsen die mir so aufgefallen sind. Mein Rechner arbeitet im Betriebsmodus ganz ruhig aber wenn ich 10 mins nichts tue und er sich "unbeobachtet" fühlt fängt er an zu rechnen ohne ende er wird laut alle lüfter springen an und die Prozessor led dreht durch. Windows Updates habe ich auch gemacht, während dem Download leuchten bei meinem Router keinerlei lichter, was mir sehr komisch vorkommt denn beim Download machen die normalerweise eine schöne Lichtershow und blinken wie verrückt. Des weiteren habe ich komische Ordner und Dateinamen gefunden hier mal ein paar mit Pfad: C:\Users\UpdatusUser\AppData\Local\Microsoft\Internet Explorer, dort drin liegen files mit namen: brndlog.bak; brndlog.txt; MSIMGSIZ.dat In der TXT file ist folgendes hinterlegt. Code:
ATTFilter 04/07/2011 09:47:14 Checking for existence of Branding Active Setup stub...
04/07/2011 09:47:14 InternetExplorerBrandGUID didn't exist: Branding component not installed
04/07/2011 09:47:14 Inf Version is set to "9,00,8112,16421".
04/07/2011 09:47:14 COM initialized with S_OK success code.
04/07/2011 09:47:14 Branding Internet Explorer...
04/07/2011 09:47:14 Command line is "/mode:isp /peruser".
04/07/2011 09:47:14 Global branding settings are:
04/07/2011 09:47:14 Context is (0x01C00008) "Internet Content Providers, running from per-user stub";
04/07/2011 09:47:14 Settings file is "C:\Program Files (x86)\Internet Explorer\Signup\install.ins";
04/07/2011 09:47:14 Target folder path is "C:\Program Files (x86)\Internet Explorer\Signup".
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 About to clear previous branding...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing migration of old settings...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing wininet setup...
04/07/2011 09:47:14 There are no connection settings to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing deletion of connection settings...
04/07/2011 09:47:14 Existing connection settings weren't specified to be deleted!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing zones HKCU settings...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing local machine policies and restrictions...
04/07/2011 09:47:14 There are no local machine *.inf files to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing current user policies and restrictions...
04/07/2011 09:47:14 There are no current user *.inf files to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing legacy policies and restrictions...
04/07/2011 09:47:14 There are no local machine *.inf files to process!
04/07/2011 09:47:14 There are no current user *.inf files to process!
04/07/2011 09:47:14 There are no legacy *.inf files to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing general customizations...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing Help->About customization...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing browser toolbar buttons...
04/07/2011 09:47:14 There are no toolbar buttons to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing root certificates...
04/07/2011 09:47:14 This feature is for ISPs only!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing default favorites and/or quick links...
04/07/2011 09:47:14 Creating separate thread for processing default favorites...
04/07/2011 09:47:14 COM initialized with S_OK success code.
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing deletion of favorites and/or quick links...
04/07/2011 09:47:14 None of the favorites folders were specified to be deleted!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing favorites...
04/07/2011 09:47:14 There are no favorites to add!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing ordering of favorites...
04/07/2011 09:47:14 Favorites will be put into the default position!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing quick links...
04/07/2011 09:47:14 There are no quick links to add!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing ordering of quick links...
04/07/2011 09:47:14 Quick Links will be put into the default position!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing connection settings...
04/07/2011 09:47:14 There are no connection settings to process!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Processing TrustedPublisherLockdown restriction...
04/07/2011 09:47:14 This restriction is not set!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Creating feeds...
04/07/2011 09:47:14 Processing [Feeds] section...
04/07/2011 09:47:14 Processing [FavoritesBar] section for Feeds...
04/07/2011 09:47:14 Processing [FavoritesBar] section for WebSlices...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Creating start pages...
04/07/2011 09:47:14 There are no start pages to add!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Creating search providers...
04/07/2011 09:47:14 There are no search providers to add!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Installing Activities...
04/07/2011 09:47:14 There are no Actitivies to Install!
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Installing Unattend Favorite bar items...
04/07/2011 09:47:14 Cannot Open Registry Key HKCU\SOFTWARE\Microsoft\Internet Explorer\AppliedUnattend [error=2]. It probably doesn't exist. Not an error.
04/07/2011 09:47:14 ProcessUnattendFavBarItems processing favbaritems from location: SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\ActiveSetup\FavoriteBarItems
04/07/2011 09:47:14 No subkeys found.
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Installing Unattend Activites...
04/07/2011 09:47:14 Cannot Open Registry Key HKCU\SOFTWARE\Microsoft\Internet Explorer\AppliedUnattend [error=2]. It probably doesn't exist. Not an error.
04/07/2011 09:47:14 ProcessUnattendActivities processing activities from location: SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\ActiveSetup\Accelerators
04/07/2011 09:47:14 No subkeys found.
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Refreshing browser settings...
04/07/2011 09:47:14 Broadcasting "Windows settings change" to all top level windows...
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Done.
04/07/2011 09:47:14 Done.
Dann wäre hier noch dieser Ordner C:\Windows\Branding in diesem Ordner sind noch 2 ordner mit dem Namen Basebrd und ShellBrd in denen jeweils eine .dll Datei mit den jeweiligen namen liegen und im basebrd noch ein ordner liegt der de-DE heißt und dort eine basebrd.dll.mui drin liegt. Ich könnte jetzt noch eine weile weitermachen. So da ich echt keinen Plan hab von der Materie und ich echt nicht weiß ob jetzt eine Infizierung vorliegt oder nicht Bitte ich euch um Hilfe. Hier mal die gewünschten logfiles Malwarebyteslog Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.05.12.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16540 Diggah :: DIGGAH-PC [Administrator] 12.05.2013 13:19:53 mbam-log-2013-05-12 (13-19-53).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 318765 Laufzeit: 21 Minute(n), 2 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter OTL logfile created on: 12.05.2013 12:29:04 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Diggah\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16540) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,91 Gb Total Physical Memory | 6,55 Gb Available Physical Memory | 82,80% Memory free 15,82 Gb Paging File | 14,33 Gb Available in Paging File | 90,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 429,75 Gb Free Space | 92,29% Space Free | Partition Type: NTFS Computer Name: DIGGAH-PC | User Name: Diggah | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.11 01:17:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Diggah\Desktop\OTL.exe PRC - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe ========== Modules (No Company Name) ========== MOD - [2011.08.03 13:50:00 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ========== Services (SafeList) ========== SRV - [2011.08.03 13:50:00 | 002,255,464 | R--- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2010.11.11 14:36:38 | 000,282,616 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV - [2010.11.11 14:36:38 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.09.21 14:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.08.09 02:32:02 | 012,289,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.08.03 13:50:00 | 000,027,240 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2011.01.04 11:29:46 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.11.21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.10.24 21:25:38 | 000,072,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2010.10.14 19:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {8DA52FAF-6CE7-492E-B472-32AC788059A0} IE:64bit: - HKLM\..\SearchScopes\{8DA52FAF-6CE7-492E-B472-32AC788059A0}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {8DA52FAF-6CE7-492E-B472-32AC788059A0} IE - HKLM\..\SearchScopes\{8DA52FAF-6CE7-492E-B472-32AC788059A0}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.vcm-gruppe.de IE - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://syb.msn.com [binary data] IE - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\..\SearchScopes,DefaultScope = {8DA52FAF-6CE7-492E-B472-32AC788059A0} IE - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-2632734036-1220690275-2834133122-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ACB28EEF-53B6-4C43-B419-2B5518D3D990}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.05.12 12:13:06 | 000,000,000 | ---D | C] -- C:\Users\Diggah\Desktop\tdsskiller [2013.05.12 00:38:35 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2013.05.12 00:34:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Diggah\Desktop\OTL.exe [2013.05.11 22:38:55 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Roaming\Adobe [2013.05.11 21:54:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013.05.11 21:53:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2013.05.11 21:53:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2013.05.11 21:08:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\NV [2013.05.11 21:08:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\NV [2013.05.11 21:04:30 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2013.05.11 21:03:51 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2013.05.11 21:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2013.05.11 21:03:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2013.05.11 21:01:53 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2013.05.11 21:01:53 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2013.05.11 21:00:18 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2013.05.11 20:51:17 | 000,000,000 | ---D | C] -- C:\Program Files\Intel [2013.05.11 20:47:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel [2013.05.11 20:47:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel [2013.05.11 20:47:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2013.05.11 20:45:25 | 000,000,000 | ---D | C] -- C:\Intel [2013.05.11 20:43:08 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Local\VirtualStore [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Vorlagen [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\AppData\Local\Verlauf [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\AppData\Local\Temporary Internet Files [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Startmenü [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\SendTo [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Recent [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Netzwerkumgebung [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Lokale Einstellungen [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Documents\Eigene Videos [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Documents\Eigene Musik [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Eigene Dateien [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Documents\Eigene Bilder [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Druckumgebung [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Cookies [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\AppData\Local\Anwendungsdaten [2013.05.11 20:43:03 | 000,000,000 | -HSD | C] -- C:\Users\Diggah\Anwendungsdaten [2013.05.11 20:43:00 | 000,000,000 | --SD | C] -- C:\Users\Diggah\AppData\Roaming\Microsoft [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Videos [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Searches [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Saved Games [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Pictures [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Music [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Links [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Favorites [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Downloads [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Documents [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Desktop [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\Contacts [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.05.11 20:43:00 | 000,000,000 | R--D | C] -- C:\Users\Diggah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.05.11 20:43:00 | 000,000,000 | -H-D | C] -- C:\Users\Diggah\AppData [2013.05.11 20:43:00 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Local\Windows Live [2013.05.11 20:43:00 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Local\Temp [2013.05.11 20:43:00 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Local\Microsoft [2013.05.11 20:43:00 | 000,000,000 | ---D | C] -- C:\Users\Diggah\AppData\Roaming\Identities [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Recovery [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Programme [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2013.05.11 20:42:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2013.05.11 20:39:49 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2013.05.11 20:36:44 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2013.05.12 12:22:56 | 000,021,856 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.12 12:22:56 | 000,021,856 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.12 12:20:08 | 001,323,360 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.05.12 12:20:08 | 000,583,508 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.05.12 12:20:08 | 000,552,950 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.05.12 12:20:08 | 000,109,808 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.05.12 12:20:08 | 000,089,734 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.05.12 12:15:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.12 12:15:25 | 2073,858,047 | -HS- | M] () -- C:\hiberfil.sys [2013.05.12 12:12:00 | 002,218,636 | ---- | M] () -- C:\Users\Diggah\Desktop\tdsskiller.zip [2013.05.12 00:43:14 | 000,013,986 | ---- | M] () -- C:\Users\Diggah\Desktop\Dokument.rtf [2013.05.12 00:41:37 | 000,000,000 | ---- | M] () -- C:\Users\Diggah\defogger_reenable [2013.05.11 23:39:23 | 000,001,459 | ---- | M] () -- C:\Users\Diggah\Desktop\iexplore - Verknüpfung.lnk [2013.05.11 22:37:26 | 000,001,754 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk [2013.05.11 22:35:40 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.05.11 22:04:31 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2013.05.11 22:04:30 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [2013.05.11 20:44:06 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2013.05.11 20:39:44 | 000,207,887 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2013.05.11 20:39:44 | 000,207,887 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2013.05.11 01:17:55 | 000,377,856 | ---- | M] () -- C:\Users\Diggah\Desktop\gmer_2.1.19163.exe [2013.05.11 01:17:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Diggah\Desktop\OTL.exe [2013.05.11 01:16:54 | 000,050,477 | ---- | M] () -- C:\Users\Diggah\Desktop\Defogger.exe ========== Files Created - No Company Name ========== [2013.05.12 12:11:58 | 002,218,636 | ---- | C] () -- C:\Users\Diggah\Desktop\tdsskiller.zip [2013.05.12 00:43:14 | 000,013,986 | ---- | C] () -- C:\Users\Diggah\Desktop\Dokument.rtf [2013.05.12 00:41:37 | 000,000,000 | ---- | C] () -- C:\Users\Diggah\defogger_reenable [2013.05.12 00:34:52 | 000,377,856 | ---- | C] () -- C:\Users\Diggah\Desktop\gmer_2.1.19163.exe [2013.05.12 00:34:52 | 000,050,477 | ---- | C] () -- C:\Users\Diggah\Desktop\Defogger.exe [2013.05.11 23:39:23 | 000,001,459 | ---- | C] () -- C:\Users\Diggah\Desktop\iexplore - Verknüpfung.lnk [2013.05.11 22:37:26 | 000,001,754 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk [2013.05.11 22:04:31 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2013.05.11 22:04:30 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2013.05.11 21:03:42 | 001,816,324 | R--- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2013.05.11 21:03:20 | 000,007,383 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2013.05.11 20:46:48 | 000,179,992 | ---- | C] () -- C:\Windows\SysNative\difx64.exe [2013.05.11 20:46:48 | 000,075,776 | ---- | C] () -- C:\Windows\SysNative\igdde64.dll [2013.05.11 20:46:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2013.05.11 20:46:48 | 000,004,096 | ---- | C] ( ) -- C:\Windows\SysNative\IGFXDEVLib.dll [2013.05.11 20:46:47 | 000,211,217 | ---- | C] () -- C:\Windows\SysNative\Gfxres.th-TH.resources [2013.05.11 20:46:47 | 000,182,649 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ru-RU.resources [2013.05.11 20:46:47 | 000,140,212 | ---- | C] () -- C:\Windows\SysNative\Gfxres.it-IT.resources [2013.05.11 20:46:47 | 000,138,707 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ko-KR.resources [2013.05.11 20:46:47 | 000,136,584 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ro-RO.resources [2013.05.11 20:46:47 | 000,135,357 | ---- | C] () -- C:\Windows\SysNative\Gfxres.tr-TR.resources [2013.05.11 20:46:47 | 000,134,821 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pt-BR.resources [2013.05.11 20:46:47 | 000,134,373 | ---- | C] () -- C:\Windows\SysNative\Gfxres.hu-HU.resources [2013.05.11 20:46:47 | 000,133,841 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sv-SE.resources [2013.05.11 20:46:47 | 000,133,683 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pt-PT.resources [2013.05.11 20:46:47 | 000,133,149 | ---- | C] () -- C:\Windows\SysNative\Gfxres.pl-PL.resources [2013.05.11 20:46:47 | 000,132,785 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sk-SK.resources [2013.05.11 20:46:47 | 000,128,998 | ---- | C] () -- C:\Windows\SysNative\Gfxres.sl-SI.resources [2013.05.11 20:46:47 | 000,124,056 | ---- | C] () -- C:\Windows\SysNative\Gfxres.en-US.resources [2013.05.11 20:46:47 | 000,117,657 | ---- | C] () -- C:\Windows\SysNative\Gfxres.zh-TW.resources [2013.05.11 20:46:46 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2013.05.11 20:46:46 | 001,981,696 | ---- | C] () -- C:\Windows\SysNative\iglhxa64.cpa [2013.05.11 20:46:46 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2013.05.11 20:46:46 | 000,963,116 | ---- | C] () -- C:\Windows\SysNative\igkrng600.bin [2013.05.11 20:46:46 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2013.05.11 20:46:46 | 000,216,000 | ---- | C] () -- C:\Windows\SysNative\igfcg600m.bin [2013.05.11 20:46:46 | 000,198,037 | ---- | C] () -- C:\Windows\SysNative\Gfxres.el-GR.resources [2013.05.11 20:46:46 | 000,156,192 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ar-SA.resources [2013.05.11 20:46:46 | 000,153,129 | ---- | C] () -- C:\Windows\SysNative\Gfxres.ja-JP.resources [2013.05.11 20:46:46 | 000,148,981 | ---- | C] () -- C:\Windows\SysNative\Gfxres.he-IL.resources [2013.05.11 20:46:46 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2013.05.11 20:46:46 | 000,145,804 | ---- | C] () -- C:\Windows\SysNative\igcompkrng600.bin [2013.05.11 20:46:46 | 000,137,840 | ---- | C] () -- C:\Windows\SysNative\Gfxres.de-DE.resources [2013.05.11 20:46:46 | 000,137,641 | ---- | C] () -- C:\Windows\SysNative\Gfxres.es-ES.resources [2013.05.11 20:46:46 | 000,135,654 | ---- | C] () -- C:\Windows\SysNative\Gfxres.fr-FR.resources [2013.05.11 20:46:46 | 000,134,407 | ---- | C] () -- C:\Windows\SysNative\Gfxres.nl-NL.resources [2013.05.11 20:46:46 | 000,133,381 | ---- | C] () -- C:\Windows\SysNative\Gfxres.cs-CZ.resources [2013.05.11 20:46:46 | 000,132,887 | ---- | C] () -- C:\Windows\SysNative\Gfxres.fi-FI.resources [2013.05.11 20:46:46 | 000,131,840 | ---- | C] () -- C:\Windows\SysNative\Gfxres.hr-HR.resources [2013.05.11 20:46:46 | 000,128,802 | ---- | C] () -- C:\Windows\SysNative\Gfxres.nb-NO.resources [2013.05.11 20:46:46 | 000,128,542 | ---- | C] () -- C:\Windows\SysNative\Gfxres.da-DK.resources [2013.05.11 20:46:46 | 000,116,368 | ---- | C] () -- C:\Windows\SysNative\Gfxres.zh-CN.resources [2013.05.11 20:46:46 | 000,094,208 | ---- | C] () -- C:\Windows\SysNative\IccLibDll_x64.dll [2013.05.11 20:46:46 | 000,059,243 | ---- | C] () -- C:\Windows\SysNative\iglhxo64.vp [2013.05.11 20:46:46 | 000,059,174 | ---- | C] () -- C:\Windows\SysNative\iglhxg64.vp [2013.05.11 20:46:46 | 000,059,062 | ---- | C] () -- C:\Windows\SysNative\iglhxc64.vp [2013.05.11 20:46:46 | 000,017,340 | ---- | C] () -- C:\Windows\SysNative\iglhxs64.vp [2013.05.11 20:46:46 | 000,000,151 | ---- | C] () -- C:\Windows\SysNative\GfxUI.exe.config [2013.05.11 20:43:01 | 000,001,425 | ---- | C] () -- C:\Users\Diggah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.05.11 20:43:00 | 000,001,897 | ---- | C] () -- C:\Users\Diggah\Desktop\Microsoft Security Essentials.lnk [2013.05.11 20:43:00 | 000,001,449 | ---- | C] () -- C:\Users\Diggah\Desktop\Internet Explorer.lnk [2013.05.11 20:36:44 | 2073,858,047 | -HS- | C] () -- C:\hiberfil.sys ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 12.05.2013 00:46:04 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Diggah\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,91 Gb Total Physical Memory | 6,43 Gb Available Physical Memory | 81,25% Memory free
15,82 Gb Paging File | 14,40 Gb Available in Paging File | 91,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 430,26 Gb Free Space | 92,40% Space Free | Partition Type: NTFS
Computer Name: DIGGAH-PC | User Name: Diggah | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{A5BACEB7-3563-49BC-82FF-8760D37A3A7D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{A653B329-E42F-4140-8C9A-220FC2211923}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{38249F67-4D1E-4EAC-9A1B-9E36279754ED}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{85A2F5FF-ECC7-4FAA-B1D9-F20EB64F97E8}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{CF637415-F3FD-407C-9F01-A0763DABD4EC}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}" = Intel(R) PROSet/Wireless WiFi-Software
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)
"{52005FEB-C6D3-43AC-8DDF-86B9F5EBD8C6}" = Microsoft Security Client
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{7782916E-3D46-4F1F-AC4B-3FB9D17049F4}" = Microsoft Antimalware Service DE-DE Language Pack
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.4.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"Microsoft Security Client" = Microsoft Security Essentials
"ProInst" = Intel PROSet Wireless
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"WinLiveSuite" = Windows Live Essentials
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 11.05.2013 15:25:04 | Computer Name = Diggah-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.05.2013 15:26:32 | Computer Name = Diggah-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.05.2013 15:26:33 | Computer Name = Diggah-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.05.2013 15:26:33 | Computer Name = Diggah-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.05.2013 15:32:35 | Computer Name = Diggah-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
Error - 11.05.2013 15:33:16 | Computer Name = Diggah-PC | Source = WinMgmt | ID = 10
Description =
Error - 11.05.2013 16:34:40 | Computer Name = Diggah-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 1.4.28.0, Zeitstempel:
0x4e3906e6 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x74346cdc ID des fehlerhaften Prozesses:
0x9f4 Startzeit der fehlerhaften Anwendung: 0x01ce4e7e7aa99447 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 33d1f697-ba7a-11e2-8fae-a71b614b988c
Error - 11.05.2013 16:37:04 | Computer Name = Diggah-PC | Source = WinMgmt | ID = 10
Description =
Error - 11.05.2013 16:57:14 | Computer Name = Diggah-PC | Source = SideBySide | ID = 16842824
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
files\microsoft security client\MSESysprep.dll" in Zeile 10. Das imaging-Element
wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
angezeigt, das von dieser Windows-Version nicht unterstützt wird.
Error - 11.05.2013 17:32:20 | Computer Name = Diggah-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 12.04.2011 05:54:35 | Computer Name = WIN-492KESHORVO | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=187316&clcid=0x409&arch=x64&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%801 Aktualisierungstyp: %%803 Benutzer: NT-AUTORITÄT\NETZWERKDIENST Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%859 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://www.microsoft.com Signaturtyp: %%800 Aktualisierungstyp: %%803
Benutzer:
NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: Vorherige Modulversion: 1.1.6603.0 Fehlercode:
0x8024402c Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
unter "Hilfe und Support".
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.6603.0&avdelta=1.99.6.0&asdelta=1.99.6.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.6603.0&avdelta=1.99.6.0&asdelta=1.99.6.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%801 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.6603.0&avdelta=1.99.6.0&asdelta=1.99.6.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.6603.0&avdelta=1.99.6.0&asdelta=1.99.6.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%801 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=187316&clcid=0x409&arch=x64&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=187316&clcid=0x409&arch=x64&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%801 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=187316&clcid=0x409&arch=x64&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
Error - 11.05.2013 14:44:12 | Computer Name = Diggah-PC | Source = Microsoft Antimalware | ID = 2001
Description = Fehler in %%860 beim Aktualisieren von Signaturen. Neue Signaturversion:
Vorherige Signaturversion: 1.99.6.0 Aktualisierungsquelle: %%851 Aktualisierungsstufe:
%%852 Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=187316&clcid=0x409&arch=x64&eng=0.0.0.0&sig=0.0.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp:
%%801 Aktualisierungstyp: %%803 Benutzer: Diggah-PC\Diggah Aktuelle Modulversion:
Vorherige Modulversion: 1.1.6603.0 Fehlercode: 0x80072ee7 Fehlerbeschreibung: Der
Servername oder die Serveradresse konnte nicht verarbeitet werden.
< End of report >
Gmer: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-12 01:06:17
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST9500420AS rev.0002SDM1 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Diggah\AppData\Local\Temp\uwdirpod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075271465 2 bytes [27, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000752714bb 2 bytes [27, 75]
.text ... * 2
---- Files - GMER 2.1 ----
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00177.log 1048576 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00178.log 1048576 bytes
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00179.log 1048576 bytes
---- EOF - GMER 2.1 ----
Grüße McBeller |
| Themen zu Infiziert oder doch nicht? |
| .dll, 7-zip, administrator, bho, branding, browser, error, explorer, fehler, firefox, format, helper, home, homepage, iexplore, iexplore.exe, install.exe, installation, internet, internet explorer, nvpciflt.sys, plug-in, prozessor, registry, registry key, richtlinie, rundll, scan, security, software, system, updates |
Baum-Darstellung