| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win32.Downloader.gen auf meinem Rechner gefunden...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
08.07.2013, 00:55
| #1 |
 |  Win32.Downloader.gen auf meinem Rechner gefunden... Hallo und guten Tag. Ich habe seit einigen Tagen das Problem, das beim Surfen mit Firefox sich immer wieder kleine Fenster mit dem Namen "Deal Finder" in den Pages öffenen. Beim Googlen bin ich dann auf den Trojaner gestoßen. Als ich dann den Spybot über meinen PC gejagt habe, hat er den Win32.Downloader.gen ausgespuckt, den ich nicht gelöscht bekomme. Ich habe versucht mal zu schauen, was ihr in anderen Fällen geraten habt, habe aber sicherheitshalber mal noch nichts davon ausprobiert. Ich bitte darum alle Anweisungen DAU sicher zu beschreiben, da ich schon dankbar bin, wenn ich den Rechner anbekomme ohne mich zu verletzen ;-) Ich habe, wie gewünscht den defogger und das otl installiert. Code:
ATTFilter OTL Extras logfile created on: 07.07.2013 20:51:45 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Bobby\Desktop\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 68,17% Memory free
3,85 Gb Paging File | 3,35 Gb Available in Paging File | 86,96% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 150,97 Gb Total Space | 95,69 Gb Free Space | 63,39% Space Free | Partition Type: NTFS
Drive D: | 780,54 Gb Total Space | 454,79 Gb Free Space | 58,27% Space Free | Partition Type: NTFS
Drive E: | 6,17 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive K: | 1,93 Gb Total Space | 1,91 Gb Free Space | 98,96% Space Free | Partition Type: FAT
Computer Name: BOPP-C7717D3EEB | User Name: Bobby | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\Gemeinsame Dateien\XpressUpdate\XPressUpdate.exe" = C:\Programme\Gemeinsame Dateien\XpressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate
"C:\Programme\Zattoo\zattood.exe" = C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\Team17\Worms 2\Frontend.exe" = C:\Programme\Team17\Worms 2\Frontend.exe:*:Enabled:Worms 2 Frontend
"C:\Programme\Windows Media Player\wmplayer.exe" = C:\Programme\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player -- (Microsoft Corporation)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\ICQ7.4\ICQ.exe" = C:\Programme\ICQ7.4\ICQ.exe:*:Enabled:ICQ -- (ICQ, LLC.)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\INSTAR\InstarVision\InstarVision.exe" = C:\INSTAR\InstarVision\InstarVision.exe:*:Enabled:InstarVision -- ()
"C:\Programme\MyPhoneExplorer\MyPhoneExplorer.exe" = C:\Programme\MyPhoneExplorer\MyPhoneExplorer.exe:*:Enabled:MyPhoneExplorer -- (F.J. Wechselberger)
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath -- (Skype Technologies S.A.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{109AB81D-9732-40B3-9C1F-113A86CE6F93}" = Canon MP Navigator 1.0
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{1D8635E1-46A9-1B10-6151-ED7169AB8C9A}" = GMX SMS-Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2121BEF3-F102-4B7F-B5CF-A5299DAADA25}_is1" = CAO-Faktura 1.4
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{2D512DA6-860F-41BB-98E4-7EFF325E72E8}" = DTSA Quiz
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FF3DD04-F386-46B0-97FC-B86238B65487}" = Canon MP Drivers 6.0
"{42442BC6-5A92-4BC2-9E0C-3D359D548A21}_is1" = Pazera Free MP4 to AVI Converter 1.6
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.5
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}" = OmniPage SE
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{944167EA-7F89-4705-8DCD-1D63B53141B0}" = Ad-Aware Antivirus
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BDFE199D-E889-4BB6-BECB-C4BDF5700849}" = Documents To Go
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C35CCBEB-5A54-4DD8-9EC8-110F2A8154B3}" = Motorola Mobile Drivers Installation 5.1.0
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4D9F101-9C35-477E-88FC-935415CD9916}" = Norton Security Scan
"{E0D51394-1D45-460A-B62D-383BC4F8B335}" = QuickTime
"{EDA023EF-0F82-4030-BF23-5283C1EE1031}" = Nero 7 Essentials
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FF8157AA-F640-45BD-B7C2-BAA1016B267A}" = palmOne
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AudibleManager" = AudibleManager
"Avira AntiVir Desktop" = Avira Free Antivirus
"BSW" = BrettspielWelt
"com.unitedinternet.ums.sms-mms-manager" = GMX SMS-Manager
"CUEcards 2000" = CUEcards 2000
"DVD Shrink_is1" = DVD Shrink 3.2
"Free Audio CD to MP3 Converter_is1" = Free Audio CD to MP3 Converter version 1.3.12.908
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.22.508
"GMX ProfiFax" = GMX ProfiFax
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"InstarVision_is1" = InstarVision 1.2
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mobile Partner" = Mobile Partner
"MotoHelper" = MotoHelper 2.0.51 Driver 5.1.0
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Pocket Tunes" = Pocket Tunes 5.0.0
"RealPlayer 6.0" = RealPlayer
"Samsung CLP-320 Series" = Wartung Samsung CLP-320 Series
"Side 9 Screensaver" = Side 9 Screensaver
"Startup_Manager_is1" = Startup Manager 2.4.2
"VueScan" = VueScan
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XMedia Recode" = XMedia Recode 2.1.8.4
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"57daec2035483565" = Save.TV EasyRecord DownloadManager
"64ad468768c89317" = Save.TV EasyRecord DownloadManager - 1
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 15.06.2013 02:58:55 | Computer Name = BOPP-C7717D3EEB | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 21.0.0.4879, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 15.06.2013 02:58:59 | Computer Name = BOPP-C7717D3EEB | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 21.0.0.4879,
fehlgeschlagenes Modul mozalloc.dll, Version 21.0.0.4879, Fehleradresse 0x00001988.
Error - 17.06.2013 10:36:20 | Computer Name = BOPP-C7717D3EEB | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 20.06.2013 05:46:16 | Computer Name = BOPP-C7717D3EEB | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 24.06.2013 05:44:40 | Computer Name = BOPP-C7717D3EEB | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 26.06.2013 05:15:45 | Computer Name = BOPP-C7717D3EEB | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung realplay.exe, Version 6.0.12.1662, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 01.07.2013 05:44:54 | Computer Name = BOPP-C7717D3EEB | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 01.07.2013 11:59:16 | Computer Name = BOPP-C7717D3EEB | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung manager.exe, Version 5.5.0.5, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 04.07.2013 05:46:41 | Computer Name = BOPP-C7717D3EEB | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 04.07.2013 11:25:42 | Computer Name = BOPP-C7717D3EEB | Source = MsiInstaller | ID = 11609
Description =
[ System Events ]
Error - 07.07.2013 14:27:23 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
%%126
Error - 07.07.2013 14:27:23 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
%%126
Error - 07.07.2013 14:27:23 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
%%126
Error - 07.07.2013 14:27:23 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
%%126
Error - 07.07.2013 14:32:11 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 07.07.2013 14:32:11 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 07.07.2013 14:32:48 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Lbd
Error - 07.07.2013 14:49:37 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 07.07.2013 14:49:37 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 07.07.2013 14:49:45 | Computer Name = BOPP-C7717D3EEB | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Lbd
< End of report >
Code:
ATTFilter OTL logfile created on: 07.07.2013 20:51:45 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Bobby\Desktop\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 68,17% Memory free 3,85 Gb Paging File | 3,35 Gb Available in Paging File | 86,96% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 150,97 Gb Total Space | 95,69 Gb Free Space | 63,39% Space Free | Partition Type: NTFS Drive D: | 780,54 Gb Total Space | 454,79 Gb Free Space | 58,27% Space Free | Partition Type: NTFS Drive E: | 6,17 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive K: | 1,93 Gb Total Space | 1,91 Gb Free Space | 98,96% Space Free | Partition Type: FAT Computer Name: BOPP-C7717D3EEB | User Name: Bobby | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.07.07 20:47:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Bobby\Desktop\Downloads\OTL.exe PRC - [2013.06.27 14:49:09 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2013.06.27 14:49:01 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2013.06.27 14:49:00 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.06.27 14:49:00 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2013.06.23 18:14:24 | 000,182,184 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2013.06.13 02:27:38 | 001,236,336 | ---- | M] (Lavasoft Limited) -- C:\Programme\Ad-Aware Antivirus\AdAwareService.exe PRC - [2013.03.12 07:32:50 | 000,253,816 | ---- | M] (Oracle Corporation) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe PRC - [2011.04.26 22:22:44 | 000,681,840 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe PRC - [2011.01.24 18:01:13 | 001,626,112 | ---- | M] (Save.TV) -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Apps\2.0\8Q13LAJA.YWW\2E8Z74RZ.1A1\stvs..tion_06e66d72b7d12b8c_0001.0006_aac8908a2c6b20d0\stvSatelliteApp.exe PRC - [2010.06.07 12:15:42 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe PRC - [2009.07.20 13:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe PRC - [2009.07.10 13:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Programme\Gemeinsame Dateien\logishrd\KHAL2\KHALMNPR.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.06.01 11:21:30 | 001,209,904 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2007.06.01 11:21:30 | 000,271,920 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe PRC - [2007.06.01 11:21:08 | 000,153,136 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe PRC - [2005.02.11 14:38:28 | 000,274,432 | ---- | M] (Palm, Inc.) -- C:\Programme\palmOne\AlarmApp.exe PRC - [2004.06.09 15:16:08 | 000,471,040 | ---- | M] (PalmSource, Inc) -- C:\Programme\palmOne\Hotsync.exe ========== Modules (No Company Name) ========== MOD - [2013.05.16 07:34:24 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\81b85db6e9fe04e4d1c9547b993acfce\System.Windows.Forms.ni.dll MOD - [2013.05.15 23:29:06 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\17440cd05eee7f87026b3c17119eed58\System.Configuration.ni.dll MOD - [2013.05.15 23:28:28 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2013.05.10 09:57:36 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU MOD - [2013.02.22 23:31:06 | 000,397,704 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2013.02.13 23:28:33 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\8a0eba3c8f881dd718ab4d1bb5118f15\System.Web.Services.ni.dll MOD - [2013.01.10 21:53:51 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\1a6f9e23985e3159e6dd9827fd81c2fd\System.Management.ni.dll MOD - [2013.01.10 08:54:05 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\8462c03b4f10c4624feb95790d6d1e30\System.Data.ni.dll MOD - [2013.01.10 08:54:01 | 001,116,672 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\0ce6b74fddd392d58cb1b0afde82d22b\System.DirectoryServices.ni.dll MOD - [2013.01.10 08:53:35 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\cbee94ec6a0fe649e3b4643cea6e1259\Accessibility.ni.dll MOD - [2013.01.10 08:53:23 | 001,593,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7782f356a838c403b4a8e9c80df5a577\System.Drawing.ni.dll MOD - [2013.01.10 08:52:54 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll MOD - [2013.01.10 08:52:47 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll MOD - [2013.01.10 08:52:38 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll MOD - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe MOD - [2011.04.26 22:22:44 | 000,681,840 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe MOD - [2010.06.07 12:15:42 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe MOD - [2009.09.11 09:47:48 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\sst3cl3.dll MOD - [2009.07.20 13:27:14 | 000,017,936 | ---- | M] () -- C:\Programme\Logitech\SetPoint\khalwrapper.dll MOD - [2007.12.21 12:40:35 | 000,430,080 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2007.12.21 12:40:35 | 000,311,296 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2004.06.09 15:11:36 | 000,233,472 | ---- | M] () -- C:\Programme\palmOne\hslang.dll MOD - [2001.10.28 18:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013.07.03 09:20:49 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.06.27 14:49:09 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.06.27 14:49:00 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.06.23 18:14:24 | 000,182,184 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2013.06.13 02:27:38 | 001,236,336 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Programme\Ad-Aware Antivirus\AdAwareService.exe -- (Ad-Aware Service) SRV - [2013.06.11 18:35:40 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.06.03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.09.20 05:39:12 | 003,677,000 | ---- | M] (GFI Software) [Auto | Stopped] -- C:\Programme\Ad-Aware Antivirus\SBAMSvc.exe -- (SBAMSvc) SRV - [2012.09.05 17:56:44 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.285\McCHSvc.exe -- (McComponentHostService) SRV - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () [Auto | Running] -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper) SRV - [2009.07.20 13:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2007.06.01 11:21:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\antirootkit\trufos.sys -- (Trufos) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\antirootkit\profos.sys -- (Profos) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [File_System | Boot | Stopped] -- system32\DRIVERS\Lbd.sys -- (Lbd) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2013.07.04 23:36:34 | 000,013,560 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\gfibto.sys -- (gfibto) DRV - [2013.03.27 23:19:47 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.27 23:19:47 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.27 23:19:47 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.02.22 23:31:30 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2011.04.04 14:55:38 | 000,020,480 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp) DRV - [2011.03.31 14:53:22 | 000,024,064 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem) DRV - [2010.04.01 14:31:50 | 000,023,424 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet) DRV - [2010.01.25 19:56:44 | 000,009,472 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice) DRV - [2010.01.19 19:36:48 | 005,818,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2009.11.18 08:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) DRV - [2009.11.18 08:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2009.10.20 19:47:46 | 000,113,280 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2009.10.12 16:21:54 | 000,100,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbdev.sys -- (hwusbdev) DRV - [2009.09.10 15:55:52 | 000,102,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2009.07.31 15:12:18 | 000,341,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wg111v3.sys -- (RTL8187B) DRV - [2009.07.10 13:01:06 | 000,025,856 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motoandroid.sys -- (motandroidusb) DRV - [2009.06.17 18:56:24 | 000,079,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE) DRV - [2009.06.17 18:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2009.06.17 18:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2009.06.17 18:55:34 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE) DRV - [2009.06.17 18:55:26 | 000,063,248 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou) DRV - [2009.06.17 18:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd) DRV - [2009.01.29 17:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl) DRV - [2009.01.29 17:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService) DRV - [2007.12.21 12:01:05 | 000,016,694 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PalmUSBD.sys -- (PalmUSBD) DRV - [2007.12.05 22:45:30 | 000,104,064 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2007.11.02 15:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService) DRV - [2007.10.12 03:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2007.10.12 02:56:22 | 000,490,776 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV561AV.SYS -- (PID_0928) DRV - [2003.03.14 14:36:08 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://service.gmx.net/de/cgi/g.fcgi/application/navigator?CUSTOMERNO=6076497&t=de767898799.1337968818.b656bda IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GCNV_de IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google Search" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "hxxp://www.gmx.de/" FF - prefs.js..extensions.enabledAddons: de-DE%40dictionaries.addons.mozilla.org:2.0.2 FF - prefs.js..extensions.enabledAddons: dictionary-switcher%40design-noir.de:1.3.1 FF - prefs.js..extensions.enabledAddons: en-GB%40dictionaries.addons.mozilla.org:1.19.1 FF - prefs.js..extensions.enabledAddons: en-US%40dictionaries.addons.mozilla.org:6.0 FF - prefs.js..extensions.enabledAddons: es-es%40dictionaries.addons.mozilla.org:1.5 FF - prefs.js..extensions.enabledAddons: %7B37E4D8EA-8BDA-4831-8EA1-89053939A250%7D:3.0.0.2 FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2 FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..keyword.enabled: false FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2910: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.07.04 23:38:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.07.03 09:20:43 | 000,000,000 | ---D | M] [2008.08.26 09:36:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Extensions [2013.07.07 20:36:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions [2011.02.05 11:52:02 | 000,000,000 | ---D | M] (PDF Download) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2011.11.08 13:26:16 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\de-DE@dictionaries.addons.mozilla.org [2011.07.10 14:12:36 | 000,000,000 | ---D | M] (Dictionary Switcher) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\dictionary-switcher@design-noir.de [2012.01.19 19:01:29 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\en-GB@dictionaries.addons.mozilla.org [2012.11.29 18:16:02 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\en-US@dictionaries.addons.mozilla.org [2011.05.13 14:28:01 | 000,000,000 | ---D | M] (Diccionario de Español/España) -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\extensions\es-es@dictionaries.addons.mozilla.org [2011.09.03 17:39:06 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Mozilla\Firefox\Profiles\bosg3csi.default\searchplugins\icqplugin.xml [2013.07.03 09:20:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.07.03 09:20:39 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013.07.03 09:20:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.07.03 09:20:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.07.03 09:20:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.07.03 09:20:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions [2013.07.03 09:20:49 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009.09.07 03:00:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION O1 HOSTS File: ([2012.03.08 23:10:37 | 000,442,902 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.123topsearch.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 136136.net O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 127.0.0.1 163ns.com O1 - Hosts: 127.0.0.1 www.163ns.com O1 - Hosts: 15219 more lines... O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Programme\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Oracle Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Alarm Manager.LNK = C:\Programme\palmOne\AlarmApp.exe (Palm, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\HotSync Manager.lnk = C:\Programme\palmOne\Hotsync.exe (PalmSource, Inc) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Save.TV.lnk = C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Apps\2.0\8Q13LAJA.YWW\2E8Z74RZ.1A1\stvs..tion_06e66d72b7d12b8c_0001.0006_aac8908a2c6b20d0\stvSatelliteApp.exe (Save.TV) O4 - Startup: C:\Dokumente und Einstellungen\Bobby\Startmenü\Programme\Autostart\BJ Status Monitor Canon MP780 Series Printer.lnk = C:\Dokumente und Einstellungen\Bobby\cnmss Canon MP780 Series Printer (Local).exe (CANON INC.) O4 - Startup: C:\Dokumente und Einstellungen\Bobby\Startmenü\Programme\Autostart\GMX-SMS-Manager.lnk = C:\Programme\GMX SMS-MMS-Manager\GMX-SMS-Manager\GMX-SMS-Manager.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 10.25.2) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 10.25.2) O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{444B07E0-30E4-4139-9FD4-CEBEEDB6E4A0}: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B9FB1457-CC45-45F6-9C4F-96EDA351CD39}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.12.21 10:41:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{17fe62cf-c4a9-11df-bf6f-0019dbcc8bc6}\Shell\AutoRun\command - "" = E:\__DT\DT.exe O33 - MountPoints2\{66d1dfcc-4b3c-11e2-83e2-0019dbcc8bc6}\Shell - "" = AutoRun O33 - MountPoints2\{66d1dfcc-4b3c-11e2-83e2-0019dbcc8bc6}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{66d1dfcc-4b3c-11e2-83e2-0019dbcc8bc6}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{8423dc49-74bf-11e1-8278-0019dbcc8bc6}\Shell - "" = AutoRun O33 - MountPoints2\{8423dc49-74bf-11e1-8278-0019dbcc8bc6}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8423dc49-74bf-11e1-8278-0019dbcc8bc6}\Shell\AutoRun\command - "" = I:\setup.exe -a O33 - MountPoints2\{b4a2649e-bed5-11dd-bb79-0019dbcc8bc6}\Shell\AutoRun\command - "" = J:\setupSNK.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.07.04 23:51:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\LavasoftStatistics [2013.07.04 23:51:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ad-Aware Antivirus [2013.07.04 23:39:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Ad-Aware Antivirus [2013.07.04 23:39:23 | 000,000,000 | ---D | C] -- C:\Programme\Ad-Aware Antivirus [2013.07.04 23:38:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations [2013.07.04 23:36:34 | 000,044,424 | ---- | C] (GFI Software) -- C:\WINDOWS\System32\sbbd.exe [2013.07.04 23:36:34 | 000,013,560 | ---- | C] (GFI Software) -- C:\WINDOWS\System32\drivers\gfibto.sys [2013.07.04 23:36:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Ad-Aware Antivirus [2013.07.03 22:10:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\Desktop\Für Mama [2013.07.03 11:36:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\Desktop\Grill & Einweihungsfete [2013.07.03 09:20:38 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2013.07.01 17:31:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\.android [2013.06.28 11:13:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\Desktop\Hochzeit Deigner Bilder für die Hochzeitszeitung [2013.06.25 15:09:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\4.0 [2013.06.25 15:09:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bobby\.tfo4 [2012.01.28 16:27:26 | 000,013,824 | ---- | C] (CANON INC.) -- C:\Dokumente und Einstellungen\Bobby\cnmss Canon MP780 Series Printer (Local).exe [2007.08.13 18:46:00 | 000,102,912 | ---- | C] (Albert L Faber) -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\CDRip.dll [2007.01.18 22:09:54 | 000,623,616 | ---- | C] (Ivan Bischof ©2003 - 2005) -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\No23 Recorder.exe [2006.12.11 20:13:14 | 000,013,872 | ---- | C] (Un4seen Developments) -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\basscd.dll [2006.12.11 20:13:12 | 000,097,336 | ---- | C] (Un4seen Developments) -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\bass.dll [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.07.07 20:50:52 | 000,001,524 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Save.TV.lnk [2013.07.07 20:50:17 | 000,001,034 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Startmenü\Programme\Autostart\BJ Status Monitor Canon MP780 Series Printer.lnk [2013.07.07 20:50:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.07.07 20:49:57 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2013.07.07 20:49:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.07.07 20:45:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2013.07.07 20:43:44 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\defogger_reenable [2013.07.07 20:30:18 | 000,000,206 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\app.restore [2013.07.07 20:16:20 | 000,000,859 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Startmenü\Programme\Autostart\GMX-SMS-Manager.lnk [2013.07.06 08:04:31 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.07.05 00:28:46 | 000,023,040 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.07.05 00:28:46 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2013.07.04 23:51:38 | 000,000,944 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Antivirus Scheduled Scan.job [2013.07.04 23:36:34 | 000,044,424 | ---- | M] (GFI Software) -- C:\WINDOWS\System32\sbbd.exe [2013.07.04 23:36:34 | 000,013,560 | ---- | M] (GFI Software) -- C:\WINDOWS\System32\drivers\gfibto.sys [2013.07.04 23:34:41 | 000,000,484 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2013.07.04 11:46:24 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat [2013.07.04 11:46:24 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat [2013.07.04 11:30:37 | 000,034,660 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Desktop\02252013 -Power Paint_GbR-_Gesellschaftsvertrages mit Daten.pdf [2013.06.28 17:50:36 | 000,000,392 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan.job [2013.06.23 18:52:40 | 001,689,600 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\Desktop\Postbank Konto Eröffnungsunterlagen.pdf [2013.06.21 09:21:55 | 000,000,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Bobby\default.pls [2013.06.13 23:01:00 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.07.07 20:43:44 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\defogger_reenable [2013.07.04 23:51:37 | 000,000,944 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Antivirus Scheduled Scan.job [2013.07.04 11:30:36 | 000,034,660 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Desktop\02252013 -Power Paint_GbR-_Gesellschaftsvertrages mit Daten.pdf [2013.06.23 18:52:40 | 001,689,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Desktop\Postbank Konto Eröffnungsunterlagen.pdf [2012.10.01 20:56:07 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe [2012.04.16 15:38:27 | 000,044,028 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2012.02.15 10:41:00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.07.31 02:42:26 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat [2011.07.31 02:42:26 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat [2010.09.04 15:49:28 | 000,000,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\tmp.no23 [2009.12.10 14:29:45 | 000,001,496 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\RecConfig.xml [2009.07.17 14:45:48 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2009.06.02 14:01:31 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND [2008.05.31 12:05:11 | 000,000,206 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\app.restore [2008.04.11 23:35:15 | 000,001,751 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2008.02.23 10:18:21 | 000,000,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\default.pls [2008.01.15 22:12:21 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat [2007.12.24 12:36:03 | 000,023,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.12.21 11:29:58 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2007.08.13 18:46:00 | 000,155,136 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\lame_enc.dll [2006.10.26 02:06:48 | 000,064,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\vorbisenc.dll [2006.10.26 02:06:48 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\vorbisfile.dll [2006.10.26 02:06:46 | 000,143,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\vorbis.dll [2006.10.26 02:06:36 | 000,015,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\ogg.dll [2005.08.23 23:34:06 | 000,029,184 | ---- | C] () -- C:\Dokumente und Einstellungen\Bobby\Lokale Einstellungen\Anwendungsdaten\no23xwrapper.dll ========== ZeroAccess Check ========== [2007.12.21 12:39:35 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 04:22:25 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 04:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2007.12.21 10:52:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis [2013.07.04 23:51:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ad-Aware Antivirus [2011.03.07 12:04:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Audible [2007.12.21 12:21:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DataViz [2013.07.04 23:38:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations [2011.06.19 12:54:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Easybits GO [2008.02.06 15:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX [2007.12.21 12:02:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HotSync [2011.06.08 20:33:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2009.04.28 17:40:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PixelPlanet [2009.01.21 10:33:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft [2009.01.23 15:36:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir [2009.01.23 15:37:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard [2010.09.09 12:10:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Startup Manager [2012.01.22 12:34:13 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1} [2013.07.07 20:47:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Ad-Aware Antivirus [2012.07.22 15:04:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Canon [2012.04.01 14:44:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\com.unitedinternet.ums.sms-mms-manager [2012.06.06 00:09:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\DVDVideoSoft [2012.06.06 00:09:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\DVDVideoSoftIEHelpers [2008.02.06 15:52:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\GMX [2013.07.04 17:25:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\go [2007.12.21 12:01:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\HotSync [2007.12.21 22:31:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\ICQ Toolbar [2012.10.08 09:52:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\KDE [2007.12.21 12:10:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Leadertech [2011.12.12 21:52:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Lite [2013.07.04 11:25:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\MyPhoneExplorer [2007.12.21 22:40:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\NewSoft [2008.10.05 14:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\NSBackup [2009.01.14 16:39:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\OpenOffice.org [2009.04.28 17:40:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\PixelPlanet [2013.07.07 20:50:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\saveTV [2007.12.21 22:35:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\ScanSoft [2013.05.16 11:28:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\TeamViewer [2012.01.22 12:34:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bobby\Anwendungsdaten\Uniblue ========== Purity Check ========== < End of report > Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-08 01:51:46
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-10 SAMSUNG_HD103SI rev.1AG01118 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\DOKUME~1\Bobby\LOKALE~1\Temp\kgnyiaow.sys
---- System - GMER 2.1 ----
SSDT BA7C2494 ZwClose
SSDT BA7C244E ZwCreateKey
SSDT BA7C249E ZwCreateSection
SSDT BA7C2444 ZwCreateThread
SSDT BA7C2453 ZwDeleteKey
SSDT BA7C245D ZwDeleteValueKey
SSDT BA7C248F ZwDuplicateObject
SSDT BA7C2462 ZwLoadKey
SSDT BA7C2430 ZwOpenProcess
SSDT BA7C2435 ZwOpenThread
SSDT BA7C24B7 ZwQueryValueKey
SSDT BA7C246C ZwReplaceKey
SSDT BA7C24A8 ZwRequestWaitReplyPort
SSDT BA7C2467 ZwRestoreKey
SSDT BA7C24A3 ZwSetContextThread
SSDT BA7C24AD ZwSetSecurityObject
SSDT BA7C2458 ZwSetValueKey
SSDT BA7C24B2 ZwSystemDebugControl
SSDT BA7C243F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8E30360, 0x307F47, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!??2@YAPAXI@Z 77BF9CC5 5 Bytes JMP 0A93C080 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!??3@YAXPAX@Z 77BF9CDD 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 77BF9D9F 5 Bytes JMP 0A93C110 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_aligned_offset_malloc 77BF9DAF 5 Bytes JMP 0A93BFE0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_aligned_free 77BF9E33 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_aligned_malloc 77BF9E52 5 Bytes JMP 0A93BFC0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_aligned_offset_realloc 77BF9E6E 5 Bytes JMP 0A93C020 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_aligned_realloc 77BF9FC6 5 Bytes JMP 0A93C000 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_expand 77BF9FE5 5 Bytes JMP 0A93BFA0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapadd 77BFBC9F 5 Bytes JMP 0A93C160 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapchk 77BFBCB3 5 Bytes JMP 0A93C170 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapset + 1 77BFBD83 4 Bytes JMP 0A93C191 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapmin 77BFBD8C 5 Bytes JMP 0A93C260 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapused 77BFBE3A 5 Bytes JMP 0A93C230 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_heapwalk 77BFBE4D 5 Bytes JMP 0A93C1A0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!_msize 77BFBF6C 5 Bytes JMP 0A93BEB0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!calloc 77BFC0C3 5 Bytes JMP 0A93BE50 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!free 77BFC21B 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!malloc 77BFC407 5 Bytes JMP 0A93BE10 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\AlarmApp.exe[3548] msvcrt.dll!realloc 77BFC437 5 Bytes JMP 0A93BE90 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!??2@YAPAXI@Z 77BF9CC5 5 Bytes JMP 0A93C080 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!??3@YAXPAX@Z 77BF9CDD 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 77BF9D9F 5 Bytes JMP 0A93C110 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_aligned_offset_malloc 77BF9DAF 5 Bytes JMP 0A93BFE0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_aligned_free 77BF9E33 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_aligned_malloc 77BF9E52 5 Bytes JMP 0A93BFC0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_aligned_offset_realloc 77BF9E6E 5 Bytes JMP 0A93C020 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_aligned_realloc 77BF9FC6 5 Bytes JMP 0A93C000 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_expand 77BF9FE5 5 Bytes JMP 0A93BFA0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapadd 77BFBC9F 5 Bytes JMP 0A93C160 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapchk 77BFBCB3 5 Bytes JMP 0A93C170 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapset + 1 77BFBD83 4 Bytes JMP 0A93C191 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapmin 77BFBD8C 5 Bytes JMP 0A93C260 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapused 77BFBE3A 5 Bytes JMP 0A93C230 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_heapwalk 77BFBE4D 5 Bytes JMP 0A93C1A0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!_msize 77BFBF6C 5 Bytes JMP 0A93BEB0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!calloc 77BFC0C3 5 Bytes JMP 0A93BE50 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!free 77BFC21B 5 Bytes JMP 0A93C0E0 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!malloc 77BFC407 5 Bytes JMP 0A93BE10 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\palmOne\Hotsync.exe[3572] msvcrt.dll!realloc 77BFC437 5 Bytes JMP 0A93BE90 C:\Programme\palmOne\SHW32.DLL
.text C:\Programme\Mozilla Firefox\firefox.exe[3956] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 0171EEB0 C:\Programme\Mozilla Firefox\xul.dll
.text C:\Programme\Mozilla Firefox\firefox.exe[3956] kernel32.dll!lstrlenW + 43 7C809AEC 7 Bytes JMP 01D2979B C:\Programme\Mozilla Firefox\xul.dll
.text C:\Programme\Mozilla Firefox\firefox.exe[3956] kernel32.dll!MapViewOfFileEx + 6A 7C80B9A0 7 Bytes JMP 01D29778 C:\Programme\Mozilla Firefox\xul.dll
.text C:\Programme\Mozilla Firefox\firefox.exe[3956] kernel32.dll!ValidateLocale + B1C8 7C8449C8 7 Bytes JMP 01724CE9 C:\Programme\Mozilla Firefox\xul.dll
.text C:\Programme\Mozilla Firefox\firefox.exe[3956] GDI32.dll!SetDIBitsToDevice + 20A 77EF9E14 7 Bytes JMP 01D296F9 C:\Programme\Mozilla Firefox\xul.dll
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310@0018332ca169 0x7F 0xA7 0x31 0x66 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310@0018332ca169 0x7F 0xA7 0x31 0x66 ...
---- EOF - GMER 2.1 ----
während des scans von GMER hatte ich mehrfach Fehlermeldungen, dich dann durch "weiter" übergangen habe. Ich hoffe, ich habe alles soweit richtig gemacht und ihr könnt mir helfen. -Danke- schonmal im Vorraus. MfG crazy-cook |
| Themen zu Win32.Downloader.gen auf meinem Rechner gefunden... |
| ad-aware, avira, bho, canon, converter, deal finder, desktop, error, firefox, flash player, format, google, home, installation, logfile, mozilla, mp3, msiinstaller, myphoneexplorer, netgear, ntdll.dll, plug-in, problem, realtek, registry, rundll, safer networking, scan, security, software, trojaner, usb, windows internet |
Baum-Darstellung