Trojan.Agent und Backdoor.bot

Sandy77 · 02.02.2010, 10:40

Deine Tastenkombies funktionieren bei mir nicht! Noch keine

d.h. strg v öffnet sich in Paint nichts...

Doch, google hilft!^^

Habe es jetzt gespeichert!!!

Anhäge verwalten???wo steht das?

Larusso · 02.02.2010, 10:49

doch die funktionieren

Nimm dir Zeit
du musst natürlich auch ins paintfenster klicken damit windows weis was du machen willst

Larusso · 02.02.2010, 10:53

Gerade eingefallen, geht auch anders

Start PE, links oben auf FILE --> Save as --> speichere die Datei am Desktop und poste mir den Inhalt

Sandy77 · 02.02.2010, 11:03

Code:

ATTFilter

Process	PID	CPU	Description	Company Name	CPU History
System Idle Process	0	99.23			
 Interrupts	n/a		Hardware Interrupts		
 DPCs	n/a		Deferred Procedure Calls		
 System	4				
  smss.exe	472		Windows Session Manager	Microsoft Corporation	
csrss.exe	596		Client-Server-Laufzeitprozess	Microsoft Corporation	
wininit.exe	636		Windows-Startanwendung	Microsoft Corporation	
 services.exe	680		Anwendung für Dienste und Controller	Microsoft Corporation	
  svchost.exe	880		Hostprozess für Windows-Dienste	Microsoft Corporation	
   mobsync.exe	3668		Microsoft Sync Center	Microsoft Corporation	
   mcagent.exe	3696		McAfee Integrated Security Platform	McAfee, Inc.	
  nvvsvc.exe	928		NVIDIA Driver Helper Service, Version 175.19	NVIDIA Corporation	
   rundll32.exe	1348		Windows-Hostprozess (Rundll32)	Microsoft Corporation	
  svchost.exe	956		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	1088		Hostprozess für Windows-Dienste	Microsoft Corporation	
   audiodg.exe	1252		Windows Graphisolierung für Audiogeräte 	Microsoft Corporation	
  svchost.exe	1124		Hostprozess für Windows-Dienste	Microsoft Corporation	
   dwm.exe	2320		Desktopfenster-Manager	Microsoft Corporation	
   WUDFHost.exe	2976		Windows Driver Foundation - Benutzermodus-Treiberframework-Hostprozess	Microsoft Corporation	
  svchost.exe	1144		Hostprozess für Windows-Dienste	Microsoft Corporation	
   taskeng.exe	2144		Aufgabenplanungsmodul	Microsoft Corporation	
   taskeng.exe	3112		Aufgabenplanungsmodul	Microsoft Corporation	
   wuauclt.exe	5592		Windows Update	Microsoft Corporation	
  svchost.exe	1276		Hostprozess für Windows-Dienste	Microsoft Corporation	
  SLsvc.exe	1296		Microsoft-Softwarelizenzierungsdienst	Microsoft Corporation	
  svchost.exe	1376		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	1536		Hostprozess für Windows-Dienste	Microsoft Corporation	
  spoolsv.exe	1724		Spoolersubsystem-Anwendung	Microsoft Corporation	
  svchost.exe	1748		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	564		Hostprozess für Windows-Dienste	Microsoft Corporation	
  LSSrvc.exe	888		LightScribe Service	Hewlett-Packard Company	
  McSACore.exe	1244		SiteAdvisor	McAfee, Inc.	
   rundll32.exe	2020		Windows-Hostprozess (Rundll32)	Microsoft Corporation	
  McProxy.exe	1416		McAfee Proxy Service Module	McAfee, Inc.	
  Mcshield.exe	1980		On-Access Scanner service	McAfee, Inc.	
  MpfSrv.exe	2076		McAfee Personal Firewall Service	McAfee, Inc.	
  msksrver.exe	2120		McAfee Anti-Spam Server	McAfee, Inc.	
  svchost.exe	2236		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	2308		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	2352		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	2432		Hostprozess für Windows-Dienste	Microsoft Corporation	
  svchost.exe	2588		Hostprozess für Windows-Dienste	Microsoft Corporation	
  SearchIndexer.exe	2660		Microsoft Windows Search Indexer	Microsoft Corporation	
  mcmscsvc.exe	3464		McAfee Services	McAfee, Inc.	
  svchost.exe	772		Hostprozess für Windows-Dienste	Microsoft Corporation	
  wmpnetwk.exe	3360		Windows Media Player-Netzwerkfreigabedienst	Microsoft Corporation	
  mcsysmon.exe	3592		McAfee SystemGuards Service	McAfee, Inc.	
  McNASvc.exe	3588		McAfee Network Agent	McAfee, Inc.	
 lsass.exe	692		Local Security Authority Process	Microsoft Corporation	
 lsm.exe	700		Lokaler Sitzungs-Manager-Dienst	Microsoft Corporation	
csrss.exe	648		Client-Server-Laufzeitprozess	Microsoft Corporation	
winlogon.exe	816		Windows-Anmeldeanwendung	Microsoft Corporation	
explorer.exe	2600		Windows-Explorer	Microsoft Corporation	
 GrooveMonitor.exe	3300		GrooveMonitor Utility	Microsoft Corporation	
 jusched.exe	3688		Java(TM) Update Scheduler	Sun Microsystems, Inc.	
 GoogleToolbarNotifier.exe	3916		GoogleToolbarNotifier	Google Inc.	
 hpqtra08.exe	3924		HP Digital Imaging Monitor	Hewlett-Packard Co.	
  hpqste08.exe	2212		HP CUE Status Root	Hewlett-Packard Co.	
 wmpnscfg.exe	3188		Windows Media Player Network Sharing Service Configuration Application	Microsoft Corporation	
 firefox.exe	3852		Firefox	Mozilla Corporation	
 procexp.exe	4400	0.77	Sysinternals Process Explorer	Sysinternals - www.sysinternals.com	
 mspaint.exe	4764		Paint	Microsoft Corporation

Cool, was ich hier alles noch so lerne!^^

Was ist überhaupt mit den Log, konntest du was sehen...Ist der/das/die Trojaner noch da???

Larusso · 02.02.2010, 11:57

Ich sehe da nichts mehr.

Versuchen wir es mal mit Rooter.exe

Downloade Dir bitte Rooter.exe ( by Eric_71 ) und speichere es auf dem Desktop.

Wichtig: Schließe alle laufenden Programme.
Trenne dich vom Internet.
Deaktiviere Dein Anti Viren Programm sowie vorhandene Hintergrundwächter.
Bitte nichts am Computer machen während der Scan läuft.
Aktiviere Dein Anti Viren Programm bevor Du wieder ins Netz gehst.

Doppelklick auf die Rooter.exe.
Vista und Win7 User: Rechtsklick und "als Administrator starten"
Klicke auf den Scan Button.
Wenn der Scan beendet wurde, wird ein sich ein Textdokument ( Rooter_#.txt ) öffnen. (# ist eine Zahl).
Rooter sollte sich automatisch schließen. Ist dies nicht der Fall bitte auf den Close Button klicken.

Poste mir bitte die Logfile.

schritt 2.

Poste mir eine neue OTL Logfile

Sandy77 · 02.02.2010, 14:22

Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows Vista Home Edition (6.0.6001) Service Pack 1
[32_bits] - x86 Family 15 Model 107 Stepping 1, AuthenticAMD
.
[wscsvc] (Security Center) RUNNING (state:4)
[MpsSvc] RUNNING (state:4)
Windows Firewall -> Disabled !
Windows Defender -> Disabled !
User Account Control (UAC) -> Disabled !
.
Internet Explorer 8.0.6001.18882
Mozilla Firefox 3.6 (de)
.
C:\ [Fixed-NTFS] .. ( Total:292 Go - Free:247 Go )
D:\ [Fixed-NTFS] .. ( Total:5 Go - Free:2 Go )
E:\ [Removable]
F:\ [Removable]
G:\ [Removable]
H:\ [Removable]
I:\ [CD_Rom]
K:\ [CD_Rom]
.
Scan : 14:19.40
Path : C:\Users\saskia\Downloads\Rooter.exe
User : saskia ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
______ \SystemRoot\System32\smss.exe (472)
______ C:\Windows\system32\csrss.exe (596)
______ C:\Windows\system32\wininit.exe (636)
______ C:\Windows\system32\csrss.exe (648)
______ C:\Windows\system32\services.exe (680)
______ C:\Windows\system32\lsass.exe (692)
______ C:\Windows\system32\lsm.exe (700)
______ C:\Windows\system32\winlogon.exe (816)
______ C:\Windows\system32\svchost.exe (880)
______ C:\Windows\system32\nvvsvc.exe (928)
______ C:\Windows\system32\svchost.exe (956)
______ C:\Windows\System32\svchost.exe (1088)
______ C:\Windows\System32\svchost.exe (1124)
______ C:\Windows\system32\svchost.exe (1144)
Locked audiodg.exe (1252)
______ C:\Windows\system32\svchost.exe (1276)
______ C:\Windows\system32\SLsvc.exe (1296)
______ C:\Windows\system32\rundll32.exe (1348)
______ C:\Windows\system32\svchost.exe (1376)
______ C:\Windows\system32\svchost.exe (1536)
______ C:\Windows\System32\spoolsv.exe (1724)
______ C:\Windows\system32\svchost.exe (1748)
______ C:\Windows\system32\svchost.exe (564)
______ C:\Program Files\Common Files\LightScribe\LSSrvc.exe (888)
______ C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (1244)
______ c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (1416)
______ C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (1980)
______ C:\Windows\system32\rundll32.exe (2020)
______ C:\Program Files\McAfee\MPF\MPFSrv.exe (2076)
______ C:\Program Files\McAfee\MSK\MskSrver.exe (2120)
______ C:\Windows\system32\taskeng.exe (2144)
______ C:\Windows\System32\svchost.exe (2236)
______ C:\Windows\System32\svchost.exe (2308)
______ C:\Windows\system32\Dwm.exe (2320)
______ C:\Windows\system32\svchost.exe (2352)
______ C:\Windows\system32\svchost.exe (2432)
______ C:\Windows\System32\svchost.exe (2588)
______ C:\Windows\Explorer.EXE (2600)
______ C:\Windows\system32\SearchIndexer.exe (2660)
______ C:\Windows\system32\WUDFHost.exe (2976)
______ C:\Windows\system32\taskeng.exe (3112)
______ C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (3300)
______ C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (3464)
______ C:\Windows\System32\mobsync.exe (3668)
______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (3688)
______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (3696)
______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3916)
______ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (3924)
______ C:\Program Files\Windows Media Player\wmpnscfg.exe (3188)
______ C:\Windows\system32\svchost.exe (772)
______ C:\Program Files\Windows Media Player\wmpnetwk.exe (3360)
______ C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2212)
______ C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (3592)
______ c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (3588)
______ C:\Windows\system32\wuauclt.exe (5592)
______ C:\Program Files\Mozilla Firefox\firefox.exe (6984)
______ C:\Users\saskia\Downloads\Rooter.exe (5136)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:313779027968)
\Device\Harddisk0\Partition2 (Start_Offset:313780076544 | Length:6291456000)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\McDefragTask.job
C:\Windows\Tasks\McQcTask.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
C:\Windows\Tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 14:19.43
.
C:\Rooter$\Rooter_1.txt - (02/02/2010 | 14:19.43)

Sandy77 · 02.02.2010, 14:43

Code:

ATTFilter

OTL logfile created on: 02.02.2010 14:25:23 - Run 2
OTL by OldTimer - Version 3.1.27.1     Folder = C:\Users\saskia\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 58,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 292,23 Gb Total Space | 247,92 Gb Free Space | 84,84% Space Free | Partition Type: NTFS
Drive D: | 5,86 Gb Total Space | 2,16 Gb Free Space | 36,78% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: FAMILIEN-PC
Current User Name: saskia
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - [2010.01.31 16:10:32 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\saskia\Downloads\OTL.exe
PRC - [2010.01.16 04:11:49 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.01.11 15:21:52 | 000,246,504 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jusched.exe
PRC - [2009.12.08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe
PRC - [2009.11.04 16:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan\Mcshield.exe
PRC - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe
PRC - [2009.10.29 06:54:44 | 001,218,008 | ---- | M] (McAfee, Inc.) -- c:\Programme\McAfee.com\Agent\mcagent.exe
PRC - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MSC\mcmscsvc.exe
PRC - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MPF\MpfSrv.exe
PRC - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MSK\msksrver.exe
PRC - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009.02.23 17:47:28 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.05.16 13:01:00 | 000,118,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe
PRC - [2008.01.19 08:33:40 | 000,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.19 08:33:15 | 000,095,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mobsync.exe
PRC - [2007.07.25 14:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Common Files\LightScribe\LSSrvc.exe
PRC - [2007.03.11 21:32:42 | 000,151,552 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\Digital Imaging\bin\hpqste08.exe
PRC - [2007.03.11 21:26:24 | 000,210,520 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.01.31 16:10:32 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\saskia\Downloads\OTL.exe
MOD - [2009.12.08 13:12:24 | 000,014,544 | ---- | M] (McAfee, Inc.) -- c:\Programme\McAfee\SiteAdvisor\sahook.dll
MOD - [2008.01.19 08:26:34 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (TuneUp.UtilitiesSvc)
SRV - File not found [Unknown | Stopped] --  -- (TuneUp.Defrag)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - File not found [Auto | Stopped] --  -- (AntiVirService)
SRV - File not found [Auto | Stopped] --  -- (AntiVirScheduler)
SRV - [2009.12.08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2009.11.04 16:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Programme\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009.10.28 11:50:32 | 000,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSK\MskSrver.exe -- (MSK80Service)
SRV - [2009.07.11 20:59:37 | 000,133,104 | ---- | M] (Google Inc.) [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1ca026221051141) Google Update Service (gupdate1ca026221051141)
SRV - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2009.06.09 19:02:57 | 000,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008.10.25 11:44:08 | 000,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008.05.16 13:01:00 | 000,118,784 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\System32\nvvsvc.exe -- (nvsvc)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008.01.19 08:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.10.25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)
SRV - [2007.07.25 14:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.03.11 22:02:52 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)
SRV - [2007.03.11 21:24:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)
SRV - [2006.11.08 16:35:38 | 000,053,248 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\System32\HPZipm12.dll -- (Pml Driver HPZ12)
SRV - [2006.11.08 16:35:36 | 000,043,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\System32\HPZinw12.dll -- (Net Driver HPZ12)
SRV - [2006.11.02 13:35:29 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.prosieben.de/index.php?icqpath=icq
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:3.1.2
FF - prefs.js..extensions.enabledItems: {2f17f610-5e97-4fed-828f-9940b7b577a4}:1.4.4
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010.02.01 22:40:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M]
 
[2010.01.27 12:29:30 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Extensions
[2010.02.01 18:42:13 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions
[2010.01.27 12:33:26 | 000,000,000 | ---D | M] (TV-Fox) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2010.01.30 15:01:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.01.30 15:01:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.01.27 12:31:36 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\smarterwiki@wikiatic.com
[2010.02.01 18:42:13 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2006.07.31 15:07:16 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.01.16 02:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.16 02:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.16 02:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.16 02:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.16 02:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Programme\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Programme\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://games.icq.com/online/online2/zuma/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img16.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img16.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009.05.14 14:16:09 | 000,000,000 | ---D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: Messenger -  File not found
SafeBootNet: MpfService - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
OTL cannot create restorepoints on Vista OSs!
 
========== Files/Folders - Created Within 14 Days ==========
 
[2010.02.02 14:19:43 | 000,000,000 | ---D | C] -- C:\Rooter$
[2010.02.01 22:41:43 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\Neuer Ordner (2)
[2010.01.31 13:51:14 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.01.31 00:11:22 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\ICQ
[2010.01.30 17:41:53 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\VLounge Album
[2010.01.30 17:04:12 | 000,000,000 | ---D | C] -- C:\Programme\SiteAdvisor
[2010.01.30 17:02:27 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2010.01.30 17:02:26 | 000,079,816 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2010.01.30 17:02:26 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2010.01.30 17:02:24 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2010.01.30 17:02:09 | 000,000,000 | ---D | C] -- C:\Programme\McAfee.com
[2010.01.30 17:02:09 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\McAfee
[2010.01.30 17:02:07 | 000,000,000 | ---D | C] -- C:\Programme\McAfee
[2010.01.30 17:00:50 | 000,034,248 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2010.01.30 16:51:34 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2010.01.28 17:00:57 | 000,000,000 | -H-D | C] -- C:\$AVG
[2010.01.28 17:00:41 | 000,000,000 | ---D | C] -- C:\ProgramData\avg9
[2010.01.28 17:00:41 | 000,000,000 | ---D | C] -- C:\Programme\AVG
[2010.01.28 16:56:00 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe
[2010.01.28 16:54:19 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2010.01.28 12:48:46 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010.01.28 12:48:44 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.01.28 12:48:44 | 000,000,000 | ---D | C] -- C:\Users\saskia\AppData\Local\temp
[2010.01.28 12:37:29 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.01.28 12:37:29 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.01.28 12:37:29 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.01.28 12:37:22 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.01.28 12:35:45 | 000,000,000 | ---D | C] -- C:\cofi.exe
[2010.01.28 12:34:43 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.01.27 12:28:22 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\Downloads
[2010.01.23 17:00:32 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe(0)
[2010.01.23 16:58:07 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\Installationsprogramm für Adobe Reader 9
[2010.01.23 16:52:57 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS
[2010.01.23 16:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.01.23 16:51:10 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2010.01.21 17:20:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.01.21 17:20:30 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.01.21 17:20:30 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.01.21 16:10:56 | 000,000,000 | ---D | C] -- C:\Programme\Trojancheck 6
[2010.01.21 15:52:10 | 000,000,000 | ---D | C] -- C:\Users\saskia\AppData\Local\VS Revo Group
[2010.01.21 15:52:07 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys
[2010.01.21 15:52:06 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group
 
========== Files - Modified Within 14 Days ==========
 
[2010.02.02 14:24:28 | 003,407,872 | ---- | M] () -- C:\Users\saskia\ntuser.dat
[2010.02.02 14:24:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.02.02 14:17:50 | 000,009,976 | ---- | M] () -- C:\Windows\System32\Config.MPF
[2010.02.02 13:38:44 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.02.02 13:38:43 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.02.02 07:43:44 | 001,418,600 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.02.02 07:43:44 | 000,618,192 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.02.02 07:43:44 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.02.02 07:43:44 | 000,122,442 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.02.02 07:43:44 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.02.02 07:38:56 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.02.02 07:38:44 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.02.02 07:38:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.02.02 00:22:14 | 000,524,288 | -HS- | M] () -- C:\Users\saskia\ntuser.dat{900cac43-a73b-11de-a3f2-001d60aa4c99}.TMContainer00000000000000000001.regtrans-ms
[2010.02.02 00:22:14 | 000,065,536 | -HS- | M] () -- C:\Users\saskia\ntuser.dat{900cac43-a73b-11de-a3f2-001d60aa4c99}.TM.blf
[2010.02.02 00:22:08 | 002,582,777 | -H-- | M] () -- C:\Users\saskia\AppData\Local\IconCache.db
[2010.02.01 22:38:42 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job
[2010.01.31 13:15:34 | 000,017,674 | ---- | M] () -- C:\Users\saskia\AppData\Roaming\wklnhst.dat
[2010.01.30 18:02:41 | 001,034,240 | -H-- | M] () -- C:\Users\saskia\Documents\photothumb.db
[2010.01.30 17:43:53 | 000,151,941 | ---- | M] () -- C:\Users\saskia\Documents\Bild1132.jpg
[2010.01.30 17:26:54 | 000,000,358 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job
[2010.01.30 17:26:54 | 000,000,320 | ---- | M] () -- C:\Windows\tasks\McQcTask.job
[2010.01.30 17:04:21 | 000,000,816 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010.01.30 17:03:50 | 000,000,811 | ---- | M] () -- C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010.01.30 15:37:16 | 000,001,905 | ---- | M] () -- C:\Windows\diagwrn.xml
[2010.01.30 15:37:16 | 000,001,905 | ---- | M] () -- C:\Windows\diagerr.xml
[2010.01.28 18:25:31 | 000,001,976 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010.01.28 12:46:58 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010.01.28 10:18:35 | 000,017,099 | ---- | M] () -- C:\Users\saskia\Documents\DAF 28.01..docx
[2010.01.27 18:32:23 | 000,017,257 | ---- | M] () -- C:\Users\saskia\Documents\SELL.docx
[2010.01.27 12:29:17 | 000,001,729 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010.01.26 08:16:10 | 000,379,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.01.25 15:58:53 | 000,101,856 | ---- | M] () -- C:\Users\saskia\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.01.25 12:02:21 | 000,000,254 | ---- | M] () -- C:\Windows\win.ini
[2010.01.22 00:56:15 | 000,001,051 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Works.lnk
[2010.01.21 22:31:51 | 000,000,966 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2010.01.21 17:20:34 | 000,000,823 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.01.21 16:10:56 | 000,000,813 | ---- | M] () -- C:\Users\saskia\Desktop\Trojancheck.lnk
[2010.01.21 09:50:04 | 000,014,469 | ---- | M] () -- C:\Users\saskia\Documents\DAFZ 21.1..docx
 
========== Files Created - No Company Name ==========
 
[2010.01.30 17:42:28 | 000,151,941 | ---- | C] () -- C:\Users\saskia\Documents\Bild1132.jpg
[2010.01.30 17:06:12 | 000,009,976 | ---- | C] () -- C:\Windows\System32\Config.MPF
[2010.01.30 17:04:21 | 000,000,816 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010.01.30 17:03:50 | 000,000,811 | ---- | C] () -- C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010.01.30 17:02:17 | 000,000,358 | ---- | C] () -- C:\Windows\tasks\McDefragTask.job
[2010.01.30 17:02:15 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\McQcTask.job
[2010.01.30 15:37:03 | 000,001,905 | ---- | C] () -- C:\Windows\diagwrn.xml
[2010.01.30 15:37:03 | 000,001,905 | ---- | C] () -- C:\Windows\diagerr.xml
[2010.01.28 12:37:29 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010.01.28 12:37:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.01.28 12:37:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.01.28 12:37:29 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.01.28 12:37:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.01.28 10:07:05 | 000,017,099 | ---- | C] () -- C:\Users\saskia\Documents\DAF 28.01..docx
[2010.01.27 19:24:20 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2010.01.27 12:29:17 | 000,001,729 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010.01.22 00:56:15 | 000,001,051 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Works.lnk
[2010.01.21 17:20:34 | 000,000,823 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.01.21 16:10:56 | 000,000,813 | ---- | C] () -- C:\Users\saskia\Desktop\Trojancheck.lnk
[2010.01.21 15:52:08 | 000,000,966 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2009.12.10 20:12:43 | 000,000,680 | ---- | C] () -- C:\Users\saskia\AppData\Local\d3d9caps.dat
[2009.02.02 10:37:07 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008.10.04 20:32:35 | 000,030,600 | ---- | C] () -- C:\Users\saskia\AppData\Roaming\UserTile.png
[2008.02.06 15:36:00 | 000,639,224 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2008.01.31 15:17:30 | 000,000,325 | ---- | C] () -- C:\Windows\disney.ini
[2008.01.31 11:53:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.01.31 11:07:47 | 000,036,588 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.01.28 12:46:25 | 000,017,674 | ---- | C] () -- C:\Users\saskia\AppData\Roaming\wklnhst.dat
[2008.01.26 00:17:24 | 000,005,632 | ---- | C] () -- C:\Users\saskia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.25 18:33:15 | 000,001,308 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007.09.20 11:05:05 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.10.27 15:16:40 | 000,138,512 | ---- | C] () -- C:\Windows\System32\OUTLCTL.DLL
[1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2009.08.30 12:33:10 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Cornelsen
[2009.06.27 22:05:53 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\gtk-2.0
[2010.01.24 23:07:12 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\ICQ
[2010.01.27 19:28:06 | 000,000,000 | -HSD | M] -- C:\Users\saskia\AppData\Roaming\lowsec
[2008.01.26 18:29:11 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Mattel
[2008.10.04 20:32:35 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\PeerNetworking
[2008.05.08 08:17:04 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Template
[2008.12.26 16:18:10 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\TuxPaint
[2008.01.29 13:45:14 | 000,000,256 | ---- | M] () -- C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2010.01.30 17:26:54 | 000,000,358 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job
[2010.01.30 17:26:54 | 000,000,320 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job
[2010.02.02 00:22:13 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.02.01 22:38:42 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\ERDNT\cache\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\ERDNT\cache\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=615D79A1D2C98817FF2FDEB1B167D808 -- C:\NVIDIA\nForceWinVista\15.01G\IDE\WinVista\sata_ide\nvstor32.sys
[2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=615D79A1D2C98817FF2FDEB1B167D808 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_a195c2b5\nvstor32.sys
[2007.07.02 23:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\Windows\System32\drivers\nvstor32.sys
[2007.07.02 23:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_efe24208\nvstor32.sys
[2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=E1C2036823B9E75535051499C61350F6 -- C:\NVIDIA\nForceWinVista\15.01G\IDE\WinVista\sataraid\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\ERDNT\cache\scecli.dll
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< c:\windows\system32\drivers\*.sys /lockedfiles >
[2008.02.06 15:36:01 | 000,639,224 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
 
< c:\windows\system32\*.dll /lockedfiles >
[2008.01.19 08:38:03 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008.01.19 08:36:10 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
< %systemroot%\*. /mp /s >
 
< %PROGRAMFILES%\*. >
[2008.11.13 23:18:56 | 000,000,000 | ---D | M] -- C:\Programme\a-squared Anti-Dialer
[2007.09.21 13:51:58 | 000,000,000 | ---D | M] -- C:\Programme\Activation Assistant for the 2007 Microsoft Office suites
[2010.01.28 16:55:54 | 000,000,000 | ---D | M] -- C:\Programme\Adobe
[2007.09.20 09:33:59 | 000,000,000 | ---D | M] -- C:\Programme\Alice
[2009.07.09 12:09:27 | 000,000,000 | ---D | M] -- C:\Programme\ArcSoft
[2010.01.28 17:00:41 | 000,000,000 | ---D | M] -- C:\Programme\AVG
[2010.01.30 17:02:09 | 000,000,000 | ---D | M] -- C:\Programme\Common Files
[2009.08.30 14:13:26 | 000,000,000 | ---D | M] -- C:\Programme\Crawler
[2008.02.06 15:38:41 | 000,000,000 | ---D | M] -- C:\Programme\DAEMON Tools
[2008.01.25 23:04:29 | 000,000,000 | ---D | M] -- C:\Programme\DIFX
[2008.03.25 16:56:46 | 000,000,000 | ---D | M] -- C:\Programme\Disney Interactive
[2008.04.24 13:25:41 | 000,000,000 | ---D | M] -- C:\Programme\Electronic Arts
[2008.04.17 21:20:28 | 000,000,000 | ---D | M] -- C:\Programme\FotoWorks
[2008.01.25 18:09:43 | 000,000,000 | -HSD | M] -- C:\Programme\Gemeinsame Dateien
[2008.04.17 21:30:26 | 000,000,000 | ---D | M] -- C:\Programme\GIMP-2.0
[2009.07.11 20:59:47 | 000,000,000 | ---D | M] -- C:\Programme\Google
[2008.01.25 18:37:10 | 000,000,000 | ---D | M] -- C:\Programme\Hewlett-Packard
[2008.01.25 18:38:29 | 000,000,000 | ---D | M] -- C:\Programme\HP
[2009.07.09 12:05:54 | 000,000,000 | ---D | M] -- C:\Programme\Icatch(IV)
[2009.07.14 15:27:07 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6
[2009.12.28 23:11:30 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6.5
[2008.06.18 08:23:38 | 000,000,000 | ---D | M] -- C:\Programme\ICQToolbar
[2010.01.22 10:56:41 | 000,000,000 | -H-D | M] -- C:\Programme\InstallShield Installation Information
[2010.01.27 19:25:12 | 000,000,000 | ---D | M] -- C:\Programme\Internet Explorer
[2010.01.28 16:54:19 | 000,000,000 | ---D | M] -- C:\Programme\Java
[2008.03.07 00:55:03 | 000,000,000 | ---D | M] -- C:\Programme\Kaminfeuer Titanium Edition 1.2
[2008.12.30 22:47:26 | 000,000,000 | ---D | M] -- C:\Programme\Lavalys
[2007.09.21 07:39:21 | 000,000,000 | ---D | M] -- C:\Programme\LightScribe
[2010.01.21 17:20:34 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware
[2009.08.30 14:04:00 | 000,000,000 | ---D | M] -- C:\Programme\Mathe Perfekt
[2008.01.26 18:28:34 | 000,000,000 | ---D | M] -- C:\Programme\Mattel
[2008.01.31 13:12:25 | 000,000,000 | ---D | M] -- C:\Programme\Maxis
[2010.01.31 22:34:52 | 000,000,000 | ---D | M] -- C:\Programme\McAfee
[2010.01.30 17:02:13 | 000,000,000 | ---D | M] -- C:\Programme\McAfee.com
[2008.08.09 22:01:32 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsDragons
[2009.07.04 11:21:42 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsFairies
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Games
[2008.12.30 19:21:43 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Office
[2008.12.30 19:21:22 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Visual Studio
[2008.12.30 19:18:16 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Visual Studio 8
[2010.01.22 00:56:15 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Works
[2008.12.30 19:20:24 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft.NET
[2009.05.14 14:16:26 | 000,000,000 | ---D | M] -- C:\Programme\Movie Maker
[2010.01.27 12:29:17 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox
[2008.03.07 00:02:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox(1)
[2008.03.01 22:27:29 | 000,000,000 | ---D | M] -- C:\Programme\mresreg
[2008.12.30 19:21:50 | 000,000,000 | ---D | M] -- C:\Programme\MSBuild
[2007.09.20 10:08:53 | 000,000,000 | ---D | M] -- C:\Programme\MSXML 4.0
[2008.01.25 23:04:18 | 000,000,000 | ---D | M] -- C:\Programme\Philips
[2008.04.17 21:29:25 | 000,000,000 | ---D | M] -- C:\Programme\PhotoScape
[2009.07.11 21:00:23 | 000,000,000 | ---D | M] -- C:\Programme\Real
[2007.09.20 10:59:03 | 000,000,000 | ---D | M] -- C:\Programme\Realtek
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Reference Assemblies
[2010.01.30 17:04:12 | 000,000,000 | ---D | M] -- C:\Programme\SiteAdvisor
[2008.02.06 16:58:59 | 000,000,000 | ---D | M] -- C:\Programme\SystemRequirementsLab
[2010.01.21 16:11:51 | 000,000,000 | ---D | M] -- C:\Programme\Trojancheck 6
[2006.11.02 14:01:55 | 000,000,000 | -H-D | M] -- C:\Programme\Uninstall Information
[2010.01.21 15:52:06 | 000,000,000 | ---D | M] -- C:\Programme\VS Revo Group
[2009.05.14 14:16:26 | 000,000,000 | ---D | M] -- C:\Programme\Windows Calendar
[2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Collaboration
[2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Defender
[2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Journal
[2008.03.29 21:52:07 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live
[2008.01.29 13:45:03 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live Favorites
[2008.01.29 13:45:13 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live Toolbar
[2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mail
[2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Media Player
[2008.01.25 18:09:43 | 000,000,000 | ---D | M] -- C:\Programme\Windows NT
[2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Photo Gallery
[2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Sidebar
[2008.12.18 14:56:17 | 000,000,000 | ---D | M] -- C:\Programme\Zylom Games
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-29 11:00:51
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

Sandy77 · 03.02.2010, 22:30

Na nu...Gibt es noch was dazu zu sagen??

Wenn Du nichts mehr siehst, wird ich gern noch erfahren, wie ich das SP2 drauf bekommen könnte??

Larusso · 03.02.2010, 23:21

Sorry, ich würde über deinen Beitrag nicht benachrichtigt -.-

C:\Programme\Crawler bitte deinstallieren und Ordner löschen.

Code:

ATTFilter

[2008.08.09 22:01:32 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsDragons
[2009.07.04 11:21:42 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsFairies

Sagt dir diese Software was?

Gmer haben wir ja nicht zum laufen gebracht.

schritt 1

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

Starte das Tool mit Doppelklick.
Vista User: Bitte mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert nun zum Neustart auf. Bestätige dies mit OK.
DeFogger erstellt nun ein Logfile auf dem Desktop (defogger_disable).

Poste bitte den Inhalt der Logfile in Deiner nächsten Antwort.

schritt 2

Windows-Explorer öffnen (Windows-Taste + E) und unter => Extras => Ordneroptionen => im Reiter "Ansicht"

Dateien und Ordner: Erweiterungen bei bekannten Dateitypen ausblenden deaktivieren
Dateien und Ordner: Geschützte Systemdateien ausblenden (empfohlen) deaktivieren
Dateien und Ordner: Inhalte von Systemordnern anzeigen aktivieren (bei Vista nicht vorhanden)
Versteckte Dateien und Ordner: alle Dateien und Ordner anzeigen aktivieren

schritt 3

Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen

Code:

ATTFilter

C:\Windows\System32\rsaenh.dll
C:\Windows\System32\SLC.dll

Also gehe wie hier beschrieben vor:

Öffne diese Webseite: virustotal
Klicke auf "Durchsuchen"
Suche die Datei auf deinem Rechner--> Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
"Senden der Datei"
Warte, bis der Scandurchlauf aller Virenscanner beendet ist
Auf "Filter" klicken
dann auf "Ergebnisse"
das Ergebnis (wie Du es bekommst )
komplett markieren und hier rein kopieren

Sollte die Datei als schädlich erkannt werden bitte noch nicht entfernen

schhritt 4

Versuch bitte GMER zu starten.
Poste mir die Logfile oder teile mir mit wenns wieder nicht läuft.

Sandy77 · 03.02.2010, 23:44

oh man, soviel

Die McDonalds Dateien, sind von Spiele Cds von den Veiein halt, die sich gleich als hintergrund eingerichtet haben

)

Nun gut, werd ich mich morgen mal deinen "Hausaufgaben" widmen!

Sandy77 · 04.02.2010, 10:40

Hi, defogger erstellt kein Logfile auf dem Desktop...Wenn ich es such gibt es defogger_reenable, dies kann ich aber nicht öffnen...

2.Schritt geht auch nicht, da öffnet sich doch "computer", das war schon beim letzten Versuch so

Kann ich trotzdem 3.machen?

sorry, schlechtes Arbeiten mit mir, ne!^^

Larusso · 04.02.2010, 11:23

Und wenn du WIndows + E drückst hast Du oben keinen Button wo extras steht ?

Sandy77 · 04.02.2010, 11:58

Zitat:

Und wenn du WIndows + E drückst hast Du oben keinen Button wo extras steht ?

Ja, unter Ansichten:EXTRA GROßE SYMBOLE!^^hehe

Nein, es steht ja mal eine Sekunde Windows Explorer da, aber dann ist Computer mit den ganzen Laufwerken!!!

Dies scheint ja soweit richtig zu sein, !?
Aber ich seh doch keine Extras...

Larusso · 04.02.2010, 12:18

Schau mal auf den Screenshot

Ich muss jz in die Arbeit.

Sandy77 · 04.02.2010, 12:26

Die Leiste steht nicht da...

frohes Schaffen

Schuldigung, jetzt hab ich sie mit hinzugefügt...man vergisst hier die einfachsten Sachen, weil man denkt alles ist hoch kompliziert...*lol*

02.02.2010, 10:49	#47
Larusso /// Selecta Jahrusso	Trojan.Agent und Backdoor.bot doch die funktionieren Nimm dir Zeit du musst natürlich auch ins paintfenster klicken damit windows weis was du machen willst __________________ __________________

02.02.2010, 10:53	#48
Larusso /// Selecta Jahrusso	Trojan.Agent und Backdoor.bot Gerade eingefallen, geht auch anders Start PE, links oben auf FILE --> Save as --> speichere die Datei am Desktop und poste mir den Inhalt __________________ __________________

04.02.2010, 11:23	#57
Larusso /// Selecta Jahrusso	Trojan.Agent und Backdoor.bot Und wenn du WIndows + E drückst hast Du oben keinen Button wo extras steht ? __________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie

04.02.2010, 12:18	#59
Larusso /// Selecta Jahrusso	Trojan.Agent und Backdoor.bot Schau mal auf den Screenshot Ich muss jz in die Arbeit. Miniaturansicht angehängter Grafiken __________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie

Trojan.Agent und Backdoor.bot

Plagegeister aller Art und deren Bekämpfung: Trojan.Agent und Backdoor.bot