| |
| |||||||
Log-Analyse und Auswertung: Trojan.bebloh und Angriff durch Trojan.Ransomlock.P Activity 2Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.07.2013, 15:35
| #1 |
| |  Trojan.bebloh und Angriff durch Trojan.Ransomlock.P Activity 2 Hallo Trojaner-Board Team, ich hoffe ihr könnt mir helfen. Meine bessere Hälfte hatte vor ein paar Tagen den zip Anhang einer Mail geöffnet. Kurz darauf meldete sich Norton mit der Aussage, dass der Trojan.bebloh blockiert worden sei. Seit dieser Zeit erfolgen auch immer wieder "Angriffe" durch Trojan.Ransomlock.P Activity 2. Jetzt ist der Urlaub rum und ich muss mich darum kümmern. Sieht man am protokollierten Norton Verlauf. Ich habe mich schon ein wenig im Forum eingelesen und hoffentlich die nachfolgenden Schritte zu eurer Zufriedenheit ausgeführt. Nachfolgend die Meldungen zu den behobenen Sicherheitsrisiken. Code:
ATTFilter Kategorie:Behobene Sicherheitsrisiken
Datum/Uhrzeit,Risiko,Aktivität,Status,Empfohlene Aktion,Pfad - Dateiname
07.07.2013 13:59:41,Hoch,winz.exe (Bloodhound.MalPE) erkannt von Download-Insight,Isoliert,Behoben - Keine Aktion erforderlich,c:\users\florian\appdata\roaming\winz.exe
07.07.2013 13:43:41,Hoch,inbpjcdbnrn.exe (WS.Malware.1) erkannt von Auto-Protect,Isoliert,Behoben - Keine Aktion erforderlich,c:\users\florian\appdata\roaming\tsel\inbpjcdbnrn.exe
25.06.2013 14:53:24,Hoch,{7860-c2f214-c2f614} (Trojan.Bebloh) erkannt von Auto-Protect,Blockiert,Behoben - Keine Aktion erforderlich,
25.06.2013 14:43:07,Hoch,{16a67-c2f214-c2f614} (Trojan.Bebloh) erkannt von Auto-Protect,Blockiert,Behoben - Keine Aktion erforderlich,
25.06.2013 14:33:03,Hoch,{11552-c2f214-c2f614} (Trojan.Bebloh) erkannt von Auto-Protect,Blockiert,Behoben - Keine Aktion erforderlich,
25.06.2013 14:22:59,Hoch,{9a89-c2f214-c2f614} (Trojan.Bebloh) erkannt von Auto-Protect,Blockiert,Behoben - Keine Aktion erforderlich,
25.06.2013 14:20:07,Gering,Tracking Cookies erkannt von Virenscanner,Entfernt,Behoben - Keine Aktion erforderlich,
25.06.2013 14:12:52,Hoch,{16827-c2f214-c2f614} (Trojan.Bebloh) erkannt von Auto-Protect,Blockiert,Behoben - Keine Aktion erforderlich,
13.04.2013 16:28:34,Gering,Tracking Cookies erkannt von Virenscanner,Entfernt,Behoben - Keine Aktion erforderlich,
10.03.2013 15:04:05,Gering,Tracking Cookies erkannt von Virenscanner,Entfernt,Behoben - Keine Aktion erforderlich,
03.03.2013 11:51:58,Gering,Tracking Cookies erkannt von Virenscanner,Entfernt,Behoben - Keine Aktion erforderlich,
15.01.2013 19:55:59,Gering,Tracking Cookies erkannt von Virenscanner,Entfernt,Behoben - Keine Aktion erforderlich,
Code:
ATTFilter Kategorie:Intrusion Prevention
Datum/Uhrzeit,Risiko,Aktivität,Status,Empfohlene Aktion,Name der IPS-Warnung,Standardaktionen,Durchgeführte Aktion,Angreifender Computer,Angreifer-URL,Zieladresse,Quelladresse,Beschreibung des Datenverkehrs,Kategorie
07.07.2013 13:30:46,Hoch,Ein Eindringversuch von 202.63.210.217 wurde blockiert.,Blockiert,Keine Aktion erforderlich,System Infected: Trojan.Ransomlock.P Activity 2,Keine Aktion erforderlich,Keine Aktion erforderlich,"202.63.210.217, 80",privat-tor-service.com/guest.php?ltype=ld&ccr=1&id=740C78C8454D4F480000&stat=0&ver=240613&loc=0x0407&os=Windows 7-64,"HOME (192.168.2.104, 49184)",202.63.210.217,"TCP, www-http",
07.07.2013 13:53:36,Hoch,Ein Eindringversuch von 46.45.182.27 wurde blockiert.,Blockiert,Keine Aktion erforderlich,System Infected: Trojan.Ransomlock.P Activity 2,Keine Aktion erforderlich,Keine Aktion erforderlich,"46.45.182.27, 80",tor-connect-secure.com/guest.php?ltype=ld&ccr=1&id=740C78C8454D4F480000&stat=0&ver=240613&loc=0x0407&os=Windows 7-64,"HOME (192.168.2.104, 49649)",46.45.182.27,"TCP, www-http",
Ich habe mit MBAR angefangen 1. Durchlauf: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org
Database version: v2013.07.07.02
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Florian :: HOME [administrator]
07.07.2013 13:41:36
mbar-log-2013-07-07 (13-41-36).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 258228
Time elapsed: 15 minute(s), 15 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|bxjrbnrn (Trojan.FakePutt) -> Data: C:\Users\Florian\AppData\Roaming\Tsel\inbpjcdbnrn.exe -> Delete on reboot.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winz (Trojan.Banker) -> Data: "C:\Users\Florian\AppData\Roaming\winz.exe" -autorun -> Delete on reboot.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 2
c:\Users\Florian\AppData\Roaming\Tsel\inbpjcdbnrn.exe (Trojan.FakePutt) -> Delete on reboot.
c:\Users\Florian\AppData\Roaming\winz.exe (Trojan.Banker) -> Delete on reboot.
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Im nächsten Schritt habe ich GMER durchgeführt - anbei das Logfile Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-07 14:40:11
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.05.0 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Florian\AppData\Local\Temp\ugldipow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 706 fffff800037f9092 6 bytes [00, 00, 41, B9, 40, 40]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 713 fffff800037f9099 59 bytes [00, 41, B8, 10, 30, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000073711a22 2 bytes [71, 73]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000073711ad0 2 bytes [71, 73]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000073711b08 2 bytes [71, 73]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000073711bba 2 bytes [71, 73]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000073711bda 2 bytes [71, 73]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
---- User IAT/EAT - GMER 2.1 ----
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!FreeLibraryAndExitThread] [10002350] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateThread] [10003450] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!LoadLibraryA] [100011e0] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll
---- EOF - GMER 2.1 ----
Code:
ATTFilter aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-07-07 14:45:48
-----------------------------
14:45:48.919 OS Version: Windows x64 6.1.7601 Service Pack 1
14:45:48.919 Number of processors: 8 586 0x1E05
14:45:48.919 ComputerName: HOME UserName:
14:45:49.639 Initialize success
14:45:51.289 AVAST engine download error: 0
14:46:05.020 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:46:05.020 Disk 0 Vendor: WDC_WD10 05.0 Size: 953869MB BusType: 8
14:46:05.020 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
14:46:05.030 Disk 1 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 8
14:46:05.030 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IAAStorageDevice-3
14:46:05.030 Disk 2 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 8
14:46:05.130 Disk 0 MBR read successfully
14:46:05.130 Disk 0 MBR scan
14:46:05.140 Disk 0 Windows 7 default MBR code
14:46:05.140 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 19456 MB offset 2048
14:46:05.150 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 39847936
14:46:05.160 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 466894 MB offset 40052736
14:46:05.190 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 467417 MB offset 996251648
14:46:05.240 Disk 0 scanning C:\Windows\system32\drivers
14:46:11.431 Service scanning
14:46:22.971 Modules scanning
14:46:22.971 Disk 0 trace - called modules:
14:46:22.981 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
14:46:22.991 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004dab790]
14:46:23.001 3 CLASSPNP.SYS[fffff8800100143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004afe050]
14:46:23.011 Scan finished successfully
14:46:45.573 Disk 0 MBR has been saved successfully to "C:\Users\Florian\Desktop\MBR.dat"
14:46:45.573 The log file has been saved successfully to "C:\Users\Florian\Desktop\aswMBR.txt"
Code:
ATTFilter OTL logfile created on: 07.07.2013 14:51:24 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Florian\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,99 Gb Total Physical Memory | 2,34 Gb Available Physical Memory | 58,71% Memory free 7,98 Gb Paging File | 6,22 Gb Available in Paging File | 77,93% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 455,95 Gb Total Space | 38,14 Gb Free Space | 8,37% Space Free | Partition Type: NTFS Drive D: | 456,46 Gb Total Space | 387,25 Gb Free Space | 84,84% Space Free | Partition Type: NTFS Drive F: | 255,67 Gb Total Space | 176,47 Gb Free Space | 69,02% Space Free | Partition Type: NTFS Drive G: | 195,31 Gb Total Space | 195,19 Gb Free Space | 99,94% Space Free | Partition Type: NTFS Drive H: | 14,76 Gb Total Space | 14,76 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Drive I: | 465,76 Gb Total Space | 26,60 Gb Free Space | 5,71% Space Free | Partition Type: NTFS Computer Name: HOME | User Name: Florian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.07.07 14:50:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Florian\Desktop\OTL.exe PRC - [2013.06.09 18:25:46 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2013.04.05 12:59:08 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe PRC - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe PRC - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2009.08.06 19:18:54 | 000,311,592 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe PRC - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2009.06.05 04:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe PRC - [2009.02.03 23:53:00 | 001,155,072 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe ========== Modules (No Company Name) ========== MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ========== Services (SafeList) ========== SRV:64bit: - [2012.12.19 21:56:00 | 000,240,640 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2013.06.09 18:25:46 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2013.05.26 17:54:53 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.10.27 10:05:37 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe -- (NIS) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.10.22 14:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2010.04.11 20:18:08 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.04.11 20:16:49 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.08.13 00:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2009.08.06 19:18:54 | 000,311,592 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService) SRV - [2009.07.28 21:25:34 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.07.04 03:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) SRV - [2009.06.04 15:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009.02.03 23:53:00 | 001,155,072 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2008.08.07 19:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) ========== Driver Services (SafeList) ========== DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011b\WNt500x64\Sandra.sys -- (SANDRA) DRV:64bit: - [2013.01.22 15:25:52 | 000,076,648 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS) DRV:64bit: - [2013.01.22 15:25:42 | 000,085,864 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K) DRV:64bit: - [2012.12.19 22:48:48 | 011,278,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2012.12.19 22:48:48 | 011,278,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.12.19 21:32:54 | 000,552,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.11.06 13:11:52 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GearAspiWDM) DRV:64bit: - [2012.07.06 04:17:58 | 000,037,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\srtspx64.sys -- (SRTSPX) DRV:64bit: - [2012.07.06 04:17:57 | 000,737,952 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\srtsp64.sys -- (SRTSP) DRV:64bit: - [2012.06.07 06:43:38 | 000,167,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\ccsetx64.sys -- (ccSet_NIS) DRV:64bit: - [2012.05.22 03:37:12 | 001,129,120 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symefa64.sys -- (SymEFA) DRV:64bit: - [2012.05.05 08:35:11 | 000,175,736 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:64bit: - [2012.04.18 04:13:32 | 000,405,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symnets.sys -- (SymNetS) DRV:64bit: - [2012.04.18 03:42:14 | 000,190,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\ironx64.sys -- (SymIRON) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.08.16 00:51:40 | 000,451,192 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1309010.00E\symds64.sys -- (SymDS) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.04.11 22:39:16 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs) DRV:64bit: - [2009.09.30 03:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.09.23 11:11:04 | 000,283,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) DRV:64bit: - [2009.07.18 07:18:48 | 000,109,480 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.20 00:56:08 | 000,712,704 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x) DRV:64bit: - [2009.06.10 22:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.05 03:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2009.04.08 15:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2007.01.17 14:32:00 | 000,015,360 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Spyder2.sys -- (Spyder2) DRV - [2013.05.31 18:58:18 | 001,393,240 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20130702.001\BHDrvx64.sys -- (BHDrvx64) DRV - [2013.05.24 13:33:01 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20130706.003\ex64.sys -- (NAVEX15) DRV - [2013.05.24 13:33:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20130706.003\eng64.sys -- (NAVENG) DRV - [2012.10.16 17:36:14 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2012.09.01 02:27:23 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20130705.001\IDSviA64.sys -- (IDSVia64) DRV - [2012.08.09 07:11:02 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2010.04.11 22:39:16 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.07.13 17:57:04 | 000,034,048 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\npf_devolo.sys -- (NPF_devolo) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210ln0597y263m05yh4i1cl4n IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AOL Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50ffwinamp&s_qt=sb&tb_uuid=2012111361408352&tb_oid=02-04-2010&tb_mrud=13-11-2012&query=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig?hl=de&source=iglk" FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.15 FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.10 FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.4 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.1 FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0 FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.6 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..keyword.URL: "hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&s_qt=ab&s_it=tb50ffwinamp&tb_uuid=2012111361408352&tb_oid=02-04-2010&tb_mrud=13-11-2012&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.4: C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\ [2012.05.05 08:37:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\ [2013.07.07 14:02:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.06.26 10:42:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.26 17:54:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.26 17:54:49 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.06.26 10:42:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.26 17:54:54 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.26 17:54:49 | 000,000,000 | ---D | M] [2010.08.01 22:33:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian\AppData\Roaming\mozilla\Extensions [2010.08.01 22:33:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian\AppData\Roaming\mozilla\Extensions\uploadr@flickr.com [2013.06.23 16:26:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian\AppData\Roaming\mozilla\Firefox\Profiles\04eaclc4.default\extensions [2013.06.23 16:26:06 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\Florian\AppData\Roaming\mozilla\Firefox\Profiles\04eaclc4.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2013.04.05 21:05:13 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\Florian\AppData\Roaming\mozilla\Firefox\Profiles\04eaclc4.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2013.06.23 16:26:06 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Florian\AppData\Roaming\mozilla\Firefox\Profiles\04eaclc4.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2013.06.01 16:45:57 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Florian\AppData\Roaming\mozilla\Firefox\Profiles\04eaclc4.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.01.15 21:54:31 | 000,002,538 | ---- | M] () -- C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\04eaclc4.default\searchplugins\aol-search.xml [2010.04.02 15:44:31 | 000,001,244 | ---- | M] () -- C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\04eaclc4.default\searchplugins\winamp-search.xml [2013.05.26 17:54:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.05.26 17:54:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.05.26 17:54:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.05.26 17:54:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.26 17:54:54 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2011.07.11 23:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\pdf24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.25.2) O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 10.25.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{630F028D-B983-48C4-AE29-6C2B1E9B1D94}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.07.07 14:50:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Florian\Desktop\OTL.exe [2013.07.07 14:43:37 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Florian\Desktop\aswMBR.exe [2013.07.07 13:41:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable) [2013.07.07 13:40:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.07.07 13:39:46 | 000,000,000 | ---D | C] -- C:\Users\Florian\Desktop\mbar-1.06.0.1004 [2013.06.25 16:58:30 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\NPE [2013.06.25 12:50:11 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Roaming\Tsel [2013.06.25 12:48:54 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\{860E06DC-9198-4B6D-B33C-9E83B5915796} [2013.06.23 15:48:58 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\{421CA2FF-F74B-4E86-BB64-AF2A6DF56F22} [2013.06.15 17:35:58 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\{7F470129-0781-4B0F-BE52-081EF959CA49} [2013.06.10 09:54:15 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\{E30FC030-E428-443A-BF1A-1FF4794D8E9E} [2013.06.09 19:19:05 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\{9BD4657E-173E-4682-B7AD-FB5226A0F138} [2013.06.09 09:22:58 | 000,000,000 | ---D | C] -- C:\Users\Florian\Documents\Battlefield 3 [2013.06.09 09:22:44 | 000,000,000 | ---D | C] -- C:\Users\Florian\AppData\Local\ESN [2013.06.09 09:22:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins [2013.06.09 09:18:30 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs [2013.06.09 09:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3 [2010.09.29 14:51:54 | 029,612,256 | ---- | C] (Acresso Software Inc.) -- C:\Users\Florian\ELSTER2010Update20100720.exe [2009.09.17 23:20:06 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.07.07 14:50:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Florian\Desktop\OTL.exe [2013.07.07 14:46:45 | 000,000,512 | ---- | M] () -- C:\Users\Florian\Desktop\MBR.dat [2013.07.07 14:43:49 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Florian\Desktop\aswMBR.exe [2013.07.07 14:16:57 | 000,377,856 | ---- | M] () -- C:\Users\Florian\Desktop\gmer_2.1.19163.exe [2013.07.07 14:08:01 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.07.07 14:08:01 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.07.07 14:00:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.07.07 14:00:35 | 3214,209,024 | -HS- | M] () -- C:\hiberfil.sys [2013.07.07 13:38:42 | 013,399,154 | ---- | M] () -- C:\Users\Florian\Desktop\mbar-1.06.0.1004.zip [2013.06.23 16:49:36 | 001,476,103 | ---- | M] () -- C:\Users\Florian\Desktop\Rappachquerung2.jpg [2013.06.23 16:37:00 | 044,014,179 | ---- | M] () -- C:\Users\Florian\Desktop\BayernAtlas - Druckansicht2.psd [2013.06.09 18:31:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2013.06.09 18:31:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2013.06.09 18:31:20 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2013.06.09 18:25:46 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2013.06.09 09:15:25 | 000,001,174 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.07.07 14:46:45 | 000,000,512 | ---- | C] () -- C:\Users\Florian\Desktop\MBR.dat [2013.07.07 14:16:57 | 000,377,856 | ---- | C] () -- C:\Users\Florian\Desktop\gmer_2.1.19163.exe [2013.07.07 13:38:25 | 013,399,154 | ---- | C] () -- C:\Users\Florian\Desktop\mbar-1.06.0.1004.zip [2013.06.23 16:49:23 | 001,476,103 | ---- | C] () -- C:\Users\Florian\Desktop\Rappachquerung2.jpg [2013.06.23 16:36:58 | 044,014,179 | ---- | C] () -- C:\Users\Florian\Desktop\BayernAtlas - Druckansicht2.psd [2013.06.09 09:15:24 | 000,001,174 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [2013.04.28 21:37:23 | 000,006,144 | ---- | C] () -- C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.04.07 18:38:20 | 000,098,321 | ---- | C] () -- C:\Users\Florian\Conrad 07042013.pdf [2013.03.30 17:35:18 | 004,817,918 | ---- | C] () -- C:\Users\Florian\droplet_v0.1.1_win.zip [2013.03.29 15:00:58 | 000,020,801 | ---- | C] () -- C:\Users\Florian\crazymachine_currentversion.zip [2013.03.29 13:36:51 | 095,890,468 | ---- | C] () -- C:\Users\Florian\arduino-1.0.4-windows.zip [2013.02.01 23:43:11 | 000,075,791 | ---- | C] () -- C:\Users\Florian\Sim-Lock Anleitung zur Entsperrung - Entsperranleitung für Apple iPhone.pdf [2013.01.27 16:01:55 | 000,101,227 | ---- | C] () -- C:\Users\Florian\Conrad Rechnung.pdf [2013.01.27 15:31:18 | 000,042,310 | ---- | C] () -- C:\Users\Florian\151036-da-01-en-TRANSISTOR_BD_137_137_10_16_TO_126__FSC.pdf [2013.01.27 15:31:14 | 001,368,879 | ---- | C] () -- C:\Users\Florian\179205-da-01-en-IC_7805_TO_220.pdf [2013.01.26 18:06:51 | 000,252,771 | ---- | C] () -- C:\Users\Florian\crazymachine_platine.jpg [2013.01.20 17:25:24 | 001,055,453 | ---- | C] () -- C:\Users\Florian\FIFA13pcwinMANOLde.pdf [2013.01.19 17:33:27 | 001,769,161 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_9-18.pdf [2013.01.19 17:31:31 | 000,199,215 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_18.pdf [2013.01.19 17:31:04 | 000,234,986 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_17.pdf [2013.01.19 17:30:32 | 000,202,148 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_16.pdf [2013.01.19 17:30:05 | 000,179,237 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_15.pdf [2013.01.19 17:29:33 | 000,211,123 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_14.pdf [2013.01.19 17:29:01 | 000,210,613 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_13.pdf [2013.01.19 17:28:22 | 000,206,278 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_12.pdf [2013.01.19 17:27:46 | 000,218,181 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_11.pdf [2013.01.19 17:27:17 | 000,199,465 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_10.pdf [2013.01.19 17:26:51 | 000,176,135 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_9.pdf [2013.01.19 17:16:07 | 000,000,136 | ---- | C] () -- C:\Windows\wininit.ini [2013.01.19 13:33:36 | 001,428,222 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_1-8.pdf [2013.01.19 13:25:19 | 000,181,734 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_8.pdf [2013.01.19 13:24:38 | 000,193,059 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_7.pdf [2013.01.19 13:23:58 | 000,208,515 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_6.pdf [2013.01.19 13:23:22 | 000,216,513 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_5.pdf [2013.01.19 13:22:52 | 000,201,040 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_4.pdf [2013.01.19 13:22:18 | 000,245,993 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_3.pdf [2013.01.19 13:21:45 | 000,195,448 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_2.pdf [2013.01.19 13:21:10 | 000,228,032 | ---- | C] () -- C:\Users\Florian\Tropfen-Arduino_1.pdf [2013.01.02 20:58:58 | 000,062,184 | ---- | C] () -- C:\Users\Florian\Lizenz Adobe Lightroom.pdf [2013.01.01 16:39:02 | 043,654,992 | ---- | C] () -- C:\Users\Florian\3039_ctdigital_oktober12.pdf [2012.12.19 21:52:22 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.12.19 21:52:22 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.12.04 21:02:27 | 000,131,754 | ---- | C] () -- C:\Users\Florian\assistant_570473088_914291970_0.pdf [2012.11.24 20:50:22 | 000,032,883 | ---- | C] () -- C:\Users\Florian\assistant_3609138711_145301332_0.pdf [2012.11.24 19:07:33 | 001,815,353 | ---- | C] () -- C:\Users\Florian\IMG_8890.JPG [2012.11.10 18:24:29 | 012,489,594 | ---- | C] () -- C:\Users\Florian\themenspecial_e-book_galileodesign.pdf [2012.11.04 17:17:50 | 002,541,829 | ---- | C] () -- C:\Users\Florian\tutorial-pdf-18970.pdf [2012.10.05 23:40:08 | 000,065,477 | ---- | C] () -- C:\Users\Florian\assistant_2342767107_971160677_0.pdf [2012.10.03 16:51:53 | 000,066,665 | ---- | C] () -- C:\Users\Florian\assistant_1136741720_3174215958_0.pdf [2012.08.28 19:53:59 | 000,026,188 | ---- | C] () -- C:\Users\Florian\h2format.zip [2012.06.09 17:12:55 | 002,219,274 | ---- | C] () -- C:\Users\Florian\2010_verkehrsmengenkarte_stba_aschaffenburg_m100000.pdf [2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012.05.01 09:46:19 | 000,222,672 | ---- | C] () -- C:\Users\Florian\MV.Schebnitz12.pdf [2012.04.12 21:59:11 | 000,080,604 | ---- | C] () -- C:\Users\Florian\ETICKET_5332502.pdf [2011.11.08 19:29:47 | 000,113,561 | ---- | C] () -- C:\Users\Florian\ebpe-pdfSonderbedingungenMTAN.pdf [2011.10.05 20:29:47 | 005,986,748 | ---- | C] () -- C:\Users\Florian\ATA29_-_Skript_2010.pdf [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.19 16:55:23 | 000,005,823 | ---- | C] () -- C:\Users\Florian\.recently-used.xbel [2011.07.25 23:07:34 | 000,007,622 | ---- | C] () -- C:\Users\Florian\AppData\Local\Resmon.ResmonCfg [2010.07.18 23:02:09 | 001,188,552 | ---- | C] () -- C:\Users\Florian\magnesitprospektdeu.pdf [2010.06.24 22:36:29 | 011,704,517 | ---- | C] () -- C:\Users\Florian\fotokurs_lehrbuch.pdf [2010.06.10 14:27:27 | 000,455,222 | ---- | C] () -- C:\Users\Florian\HTMLToPDF-Ticket.pdf [2010.06.01 21:23:12 | 000,048,297 | ---- | C] () -- C:\Users\Florian\2010-05-25 19_38_07.csv [2010.06.01 21:23:04 | 000,046,534 | ---- | C] () -- C:\Users\Florian\2010-05-25 07_19_46.csv [2010.06.01 21:22:48 | 000,051,309 | ---- | C] () -- C:\Users\Florian\2010-05-27 07_43_57.csv [2010.03.14 18:42:12 | 023,068,189 | ---- | C] () -- C:\Users\Florian\4106868232.pdf [2010.02.21 19:59:04 | 000,000,320 | ---- | C] () -- C:\Users\Florian\AppData\Roaming\wklnhst.dat ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.01.19 13:29:08 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Arduino [2010.06.05 15:12:20 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\BlackBean [2010.09.23 12:53:59 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Buhl Data Service [2011.12.20 20:25:27 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Canon [2011.06.19 13:55:25 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\elsterformular [2010.08.01 22:33:35 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Flickr [2011.08.19 16:55:14 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\gtk-2.0 [2010.06.05 16:15:25 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\HDRsoft [2010.09.30 15:44:30 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Leadertech [2011.06.14 20:58:36 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\OpenOffice.org [2013.06.08 18:07:54 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Origin [2012.07.04 19:59:47 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\ProtectDISC [2010.02.21 21:10:41 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\SoftDMA [2010.04.02 15:40:35 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\streamripper [2013.02.10 18:31:31 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\TeamViewer [2010.02.21 19:59:20 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Template [2010.02.27 22:06:47 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\The Creative Assembly [2010.02.22 20:46:04 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Tific [2013.07.07 13:42:48 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Tsel [2012.04.05 22:18:12 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\wargaming.net [2011.09.02 21:12:07 | 000,000,000 | ---D | M] -- C:\Users\Florian\AppData\Roaming\Windows Live Writer ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2 @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:1D32EC29 @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:E1F04E8D < End of report > Weiter habe ich mich nicht getraut - könnt ihr mir bitte weiterhelfen?! Ist der Rechner noch verseucht oder kann ich wieder durchatmen? Vielen Dank vorab! Florian |
| Themen zu Trojan.bebloh und Angriff durch Trojan.Ransomlock.P Activity 2 |
| adobe, blockiert, bonjour, classpnp.sys, computer, desktop, dos fenster, fehlermeldung, firefox, hal.dll, home, launch, log file, logfile, mozilla, plug-in, problem, realtek, registry, scan, security, software, symantec, system, trojan.banker, trojan.bebloh, trojan.fakeputt, trojan.ransomlock.p activity 2, windows |
Baum-Darstellung