| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dllWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
29.03.2010, 11:37
| #1 |
 |  TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hallo Anscheind ist mein PC wieder infiziert mit dem oben genannten Virus. Jedes Mal wenn ich den Browser das erste Mal öffne kommt die Nachricht von AntiVir. Deshalb hab ich mich hier registriert und hoffe dass ihr mir mit meinem Logfile helfen könnt: Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 12:27:42 on 29.03.2010 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 3.6.2 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe "BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe (File found, but it contains no detailed information) [Common] -----( %SystemRoot%\Tasks )----- "Auf Updates für Windows Live Toolbar prüfen.job" - "Microsoft Corporation" - C:\Programme\Windows Live Toolbar\MSNTBUP.EXE "Ad-Aware Update (Weekly).job" - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL "Windows Media Connect" - "Microsoft Corporation" - C:\Programme\Windows Media Connect 2\wmccpl.dll [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys "avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "CrystalSysInfo" (CrystalSysInfo) - ? - C:\Programme\MediaCoder PMP Edition\SysInfo.sys (File found, but it contains no detailed information) "d3dswy" (d3dswy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\d3dswy.sys "DLABOIOM" (DLABOIOM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLABOIOM.SYS "DLACDBHM" (DLACDBHM) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DLACDBHM.SYS "DLADResN" (DLADResN) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLADResN.SYS "DLAIFS_M" (DLAIFS_M) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAIFS_M.SYS "DLAOPIOM" (DLAOPIOM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAOPIOM.SYS "DLAPoolM" (DLAPoolM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAPoolM.SYS "DLARTL_N" (DLARTL_N) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DLARTL_N.SYS "DLAUDFAM" (DLAUDFAM) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAUDFAM.SYS "DLAUDF_M" (DLAUDF_M) - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLAUDF_M.SYS "DRVMCDB" (DRVMCDB) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DRVMCDB.SYS "DRVNDDM" (DRVNDDM) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DRVNDDM.SYS "GMSIPCI" (GMSIPCI) - ? - D:\INSTALL\GMSIPCI.SYS (File not found) "IVI ASPI Shell" (Iviaspi) - "InterVideo, Inc." - C:\WINDOWS\System32\drivers\iviaspi.sys "Lbd" (Lbd) - "Lavasoft AB" - C:\WINDOWS\System32\DRIVERS\Lbd.sys "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "pmem" (pmem) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\pmemnt.sys "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys "srescan" (srescan) - "Zone Labs, LLC" - C:\WINDOWS\System32\ZoneLabs\srescan.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys "Symantec Network Security Intermediate Filter Service" (SymIM) - ? - C:\WINDOWS\System32\DRIVERS\SymIM.sys (File not found) "SymIMMP" (SymIMMP) - ? - C:\WINDOWS\System32\DRIVERS\SymIM.sys (File not found) "TVT Packet Filter Service" (TVTPktFilter) - ? - C:\WINDOWS\System32\DRIVERS\tvtpktfilter.sys (File not found) "vsdatant" (vsdatant) - "Zone Labs, LLC" - C:\WINDOWS\System32\vsdatant.sys "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) "XDva289" (XDva289) - ? - C:\WINDOWS\system32\XDva289.sys (File not found) [Explorer] -----( HKCU\Software\Classes\Folder\shellex\ColumnHandlers )----- {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - c:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLASHX_W.DLL {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - (File not found | COM-object registry key not found) {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - (File not found | COM-object registry key not found) {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - (File not found | COM-object registry key not found) {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - (File not found | COM-object registry key not found) {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll {52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension" - "Simply Super Software" - C:\PROGRA~1\TROJAN~1\Trshlex.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll {D9872D13-7651-4471-9EEE-F0A00218BEBB} "ZLAVShExt Class" - "Zone Labs, LLC" - C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) <binary data> "Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live Toolbar\msntb.dll -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.5.0_06" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {31435657-9980-0010-8000-00AA00389B71} "{31435657-9980-0010-8000-00AA00389B71}" - ? - (File not found | COM-object registry key not found) / hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {0FE81B52-73FA-425F-8F06-3F32451AC73F} "ClsidExtension" - "Lenovo Group Limited" - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll "ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "Ask Toolbar" - "Ask.com" - C:\Programme\AskBarDis\bar\bin\askBar.dll {855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} "NCO Toolbar 2.0" - ? - (File not found | COM-object registry key not found) <binary data> "Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live Toolbar\msntb.dll <binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {02478D38-C3F9-4efb-9B51-7695ECA05670} "&Yahoo! Toolbar Helper" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {201f27d4-3704-41d6-89c1-aa35e39143ed} "AskBar BHO" - "Ask.com" - C:\Programme\AskBarDis\bar\bin\askBar.dll {F040E541-A427-4CF7-85D8-75E3E0F476C5} "CPwmIEBrowserHelper Object" - "Lenovo Group Limited" - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll {5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLASHX_W.DLL {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} "SingleInstance Class" - "Yahoo! Inc" - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Programme\Windows Live Toolbar\msntb.dll {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} "{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Development Company, L.P." - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\Hendrik\Startmenü\Programme\Autostart\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" "AMSG" - "LENOVO" - C:\Programme\ThinkVantage\AMSG\Amsg.exe /startup "avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "AVMWlanClient" - "AVM Berlin" - C:\Programme\avmwlanstick\wlangui.exe "cssauth" - "Lenovo Group Limited" - "C:\Programme\Lenovo\Client Security Solution\cssauth.exe" silent "DLA" - "Sonic Solutions" - C:\WINDOWS\System32\DLA\DLACTRLW.EXE "ISUSPM Startup" - "InstallShield Software Corporation" - C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup "ISUSScheduler" - "InstallShield Software Corporation" - "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start "LPManager" - "Lenovo Group Limited" - C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe "Start WingMan Profiler" - "Logitech Inc." - C:\Programme\Logitech\Gaming Software\LWEMon.exe /noui "StartCCC" - ? - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (File found, but it contains no detailed information) "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe" "TVT Scheduler Proxy" - "Lenovo Group Limited" - C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe "ZoneAlarm Client" - "Zone Labs, LLC" - "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "HP Standard TCP/IP Port" - "Hewlett Packard" - C:\WINDOWS\system32\HpTcpMon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "Adobe Active File Monitor V7" (AdobeActiveFileMonitor7.0) - "Adobe Systems Incorporated" - C:\Programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe "ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe "AVM WLAN Connection Service" (AVM WLAN Connection Service) - "AVM Berlin" - C:\Programme\avmwlanstick\WlanNetService.exe "FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "Google Updater Service" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe "ICQ Service" (ICQ Service) - ? - C:\Programme\ICQ6Toolbar\ICQ Service.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe "IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe "Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE "nProtect GameGuard Service" (npggsvc) - "INCA Internet Co., Ltd." - C:\WINDOWS\system32\GameMon.des "O&O Defrag" (O&O Defrag) - "O&O Software GmbH" - C:\WINDOWS\system32\oodag.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE "SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe "SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe "System Update" (SUService) - "Lenovo Group Limited" - c:\programme\lenovo\system update\suservice.exe "ThinkVantage Registry Monitor Service" (ThinkVantage Registry Monitor Service) - "Lenovo Group Limited" - C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe "TrueVector Internet Monitor" (vsmon) - "Zone Labs, LLC" - C:\WINDOWS\system32\ZoneLabs\vsmon.exe "TVT Backup Protection Service" (TVT Backup Protection Service) - ? - C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe "TVT Backup Service" (TVT Backup Service) - "Lenovo Group Limited" - C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe "TVT Scheduler" (TVT Scheduler) - "Lenovo Group Limited" - c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe "tvtnetwk" (tvtnetwk) - ? - C:\Programme\Lenovo\Rescue and Recovery\ADM\IUService.exe (File found, but it contains no detailed information) "Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Media Connect-Dienst" (WMConnectCDS) - "Microsoft Corporation" - C:\Programme\Windows Media Connect 2\wmccds.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe "Yahoo! Updater" (YahooAUService) - "Yahoo! Inc." - C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll "WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
29.03.2010, 11:55
| #2 |
| /// TB-Ausbilder     | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi,
__________________erstell bitte einen Scan mit GMER und einen mit OTL: CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
Code:
ATTFilter netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
MfG myrtille
__________________ |
|
29.03.2010, 14:36
| #3 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll OTL.Txt:
__________________OTL logfile created on: 29.03.2010 15:20:38 - Run 1 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Dokumente und Einstellungen\Hendrik\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 61,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 229,38 Gb Total Space | 76,36 Gb Free Space | 33,29% Space Free | Partition Type: NTFS Drive D: | 1,66 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF1.02 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LENOVO-HENDRIK Current User Name: Hendrik Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.03.29 13:00:38 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hendrik\Desktop\OTL.exe PRC - [2010.03.01 17:40:34 | 001,029,456 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe PRC - [2010.03.01 17:40:34 | 000,524,632 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2009.09.16 22:14:48 | 000,153,608 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Gaming Software\LWEMon.exe PRC - [2009.07.21 15:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2009.05.13 17:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2009.03.05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009.03.02 14:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe PRC - [2008.10.19 15:30:02 | 000,222,456 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe PRC - [2008.09.16 13:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.12.20 02:04:00 | 001,748,992 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe PRC - [2007.12.20 02:04:00 | 000,364,544 | R--- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe PRC - [2007.12.09 19:10:02 | 000,120,096 | ---- | M] (Lenovo Group Limited) -- C:\Programme\ThinkVantage\PrdCtr\LPMGR.EXE PRC - [2007.08.03 17:35:38 | 002,630,968 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Client Security Solution\cssauth.exe PRC - [2007.08.03 17:10:46 | 000,644,408 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe PRC - [2007.07.11 21:53:58 | 000,540,672 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe PRC - [2007.07.11 21:53:50 | 001,126,400 | ---- | M] (Lenovo Group Limited) -- c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe PRC - [2007.07.11 21:46:10 | 000,696,320 | ---- | M] (Lenovo Limited Group Corporation) -- C:\Programme\Lenovo\Rescue and Recovery\rrcmd.exe PRC - [2007.07.11 21:44:38 | 000,950,272 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe PRC - [2007.07.11 21:38:44 | 000,569,344 | ---- | M] () -- C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe PRC - [2007.07.11 21:33:26 | 000,143,360 | ---- | M] () -- C:\Programme\Lenovo\Rescue and Recovery\Migration\bin\R2R.exe PRC - [2007.07.11 21:32:06 | 000,022,016 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Lenovo\Logger\logmon.exe PRC - [2007.07.11 20:19:00 | 000,045,056 | ---- | M] () -- C:\Programme\Lenovo\Rescue and Recovery\ADM\IUService.exe PRC - [2007.06.07 17:43:46 | 000,013,312 | ---- | M] (Lenovo Group Limited) -- c:\Programme\Lenovo\System Update\SUService.exe PRC - [2007.03.09 01:02:00 | 000,919,280 | ---- | M] (Zone Labs, LLC) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2007.03.09 01:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe PRC - [2007.02.01 20:00:01 | 000,419,376 | ---- | M] (LENOVO) -- C:\Programme\ThinkVantage\AMSG\Amsg.exe PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006.03.03 22:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe PRC - [2006.02.02 06:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE PRC - [2005.05.11 04:09:54 | 000,225,280 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe PRC - [2004.07.27 17:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe ========== Modules (SafeList) ========== MOD - [2010.03.29 13:00:38 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hendrik\Desktop\OTL.exe ========== Win32 Services (SafeList) ========== SRV - [2010.03.01 17:40:34 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2010.01.04 21:55:00 | 003,404,560 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc) SRV - [2009.11.22 17:14:31 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009.07.21 15:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009.05.13 17:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) SRV - [2008.10.19 15:30:02 | 000,222,456 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2008.09.16 13:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0) SRV - [2007.12.20 02:04:00 | 000,364,544 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service) SRV - [2007.08.03 17:10:46 | 000,644,408 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service) SRV - [2007.07.11 21:53:50 | 001,126,400 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler) SRV - [2007.07.11 21:44:38 | 000,950,272 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe -- (TVT Backup Service) SRV - [2007.07.11 21:38:44 | 000,569,344 | ---- | M] () [Auto | Running] -- C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe -- (TVT Backup Protection Service) SRV - [2007.07.11 20:19:00 | 000,045,056 | ---- | M] () [Auto | Running] -- C:\Programme\Lenovo\Rescue and Recovery\ADM\IUService.exe -- (tvtnetwk) SRV - [2007.06.07 17:43:46 | 000,013,312 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- c:\Programme\Lenovo\System Update\SUService.exe -- (SUService) SRV - [2007.03.09 01:01:58 | 000,075,568 | ---- | M] (Zone Labs, LLC) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon) SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.10.26 20:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.04.14 11:07:20 | 028,933,976 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) SRV - [2006.04.14 11:05:58 | 000,240,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2006.04.14 11:04:54 | 000,087,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2006.03.03 22:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2005.10.14 04:50:20 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) SRV - [2005.10.06 19:13:10 | 000,856,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS) SRV - [2005.05.11 04:09:54 | 000,225,280 | ---- | M] (O&O Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag) SRV - [2004.10.22 04:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.03.28 15:09:07 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.03.23 11:16:52 | 000,000,000 | ---D | M] [2009.11.14 17:15:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Extensions [2010.03.29 11:08:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions [2010.02.05 15:35:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009.11.14 19:23:52 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2010.02.14 12:59:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2009.11.27 18:11:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2010.03.29 11:08:23 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2009.11.24 17:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.03.22 13:44:05 | 000,380,790 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 13116 more lines... O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O2 - BHO: (CPwmIEBrowserHelper Object) - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AMSG] C:\Programme\ThinkVantage\AMSG\Amsg.exe (LENOVO) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin) O4 - HKLM..\Run: [cssauth] C:\Programme\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited) O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [LPManager] C:\Programme\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited) O4 - HKLM..\Run: [Start WingMan Profiler] C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Windows Live Search - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Programme\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.01.27 04:18:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2007.06.21 21:07:56 | 000,000,144 | R--- | M] () - D:\autorun.inf -- [ UDF1.02 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH) O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2006.01.26 00:17:50 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point (17173366603513856) ========== Files/Folders - Created Within 14 Days ========== [2010.03.29 13:00:33 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hendrik\Desktop\OTL.exe [2010.03.29 12:53:27 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Hendrik\Recent [2010.03.29 12:39:21 | 000,000,000 | ---D | C] -- C:\Programme\OSAM [2010.03.27 17:08:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Desktop\Runes_of_Magic_2.1.6.2049 [2010.03.27 16:36:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Eigene Dateien\RCT3 [2010.03.27 16:36:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Atari [2010.03.27 16:35:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Leadertech [2010.03.27 16:27:43 | 000,000,000 | ---D | C] -- C:\Programme\Atari [2010.03.22 23:00:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google [2010.03.22 22:58:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Google [2010.03.22 22:55:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google [2010.03.22 22:55:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Temp [2010.03.20 14:13:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\NFS Underground 2 [2010.03.18 18:29:58 | 000,000,000 | ---D | C] -- C:\Programme\sixteen tons entertainment [2010.03.03 15:05:35 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Microsoft [2010.01.11 16:46:33 | 814,143,398 | ---- | C] (GOA ) -- C:\Programme\loleusetup.exe [2009.12.31 14:52:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft [2008.01.04 05:27:14 | 000,010,896 | ---- | C] (UPEK Inc.) -- C:\Programme\ThinkVantage Fingerprint Software [2006.01.26 00:25:57 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Microsoft [2006.01.26 00:25:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 14 Days ========== [2010.03.29 15:16:29 | 000,509,040 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.03.29 15:16:29 | 000,490,736 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.03.29 15:16:29 | 000,102,858 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.03.29 15:16:29 | 000,089,426 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.03.29 15:16:28 | 001,209,678 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.03.29 15:15:05 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.03.29 15:14:29 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.03.29 15:14:22 | 000,055,081 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml [2010.03.29 15:14:22 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.03.29 15:14:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.03.29 15:13:58 | 2146,684,928 | -HS- | M] () -- C:\hiberfil.sys [2010.03.29 15:13:52 | 000,067,221 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor [2010.03.29 14:59:43 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Hendrik\ntuser.ini [2010.03.29 14:01:06 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\Auf Updates für Windows Live Toolbar prüfen.job [2010.03.29 14:00:02 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.03.29 13:00:38 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hendrik\Desktop\OTL.exe [2010.03.29 12:39:17 | 008,388,608 | -H-- | M] () -- C:\Dokumente und Einstellungen\Hendrik\NTUSER.DAT [2010.03.27 17:39:25 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2010.03.27 16:36:12 | 000,043,520 | ---- | M] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2010.03.27 16:34:49 | 000,000,843 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\RollerCoaster Tycoon 3.lnk [2010.03.22 22:57:40 | 000,001,894 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk [2010.03.22 13:44:05 | 000,380,790 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010.03.18 18:32:07 | 000,000,921 | ---- | M] () -- C:\Dokumente und Einstellungen\Hendrik\Desktop\Emergency 4 Demo.lnk [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.03.27 16:36:12 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2010.03.27 16:34:49 | 000,000,843 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\RollerCoaster Tycoon 3.lnk [2010.03.23 13:08:33 | 000,221,471 | ---- | C] () -- C:\Dokumente und Einstellungen\Hendrik\Desktop\Deutsch.dic [2010.03.22 22:57:40 | 000,001,894 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk [2010.03.22 22:55:50 | 000,001,090 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.03.22 22:55:49 | 000,001,086 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.03.18 18:32:07 | 000,000,921 | ---- | C] () -- C:\Dokumente und Einstellungen\Hendrik\Desktop\Emergency 4 Demo.lnk [2010.02.14 11:15:03 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll [2010.02.14 11:15:03 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll [2010.02.14 11:15:03 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll [2010.02.14 11:15:03 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll [2010.02.05 14:02:13 | 000,000,745 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log [2010.02.05 14:01:00 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll [2010.01.03 12:42:27 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\nvRegDev.dll [2009.11.22 18:03:44 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009.11.16 13:35:55 | 000,007,168 | ---- | C] () -- C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.11.14 18:33:21 | 000,022,168 | ---- | C] () -- C:\WINDOWS\System32\imsinstall_loc0407.dll [2009.11.14 18:33:21 | 000,018,072 | ---- | C] () -- C:\WINDOWS\System32\imslsp_install_loc0407.dll [2009.11.14 18:33:08 | 000,796,312 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2009.11.14 16:57:57 | 000,769,164 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LuUninstall.LiveUpdate [2008.01.04 05:47:11 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2008.01.04 05:40:48 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008.01.04 05:29:09 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2008.01.04 05:29:09 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2008.01.04 05:29:09 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2008.01.04 05:29:09 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2008.01.04 05:29:09 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2008.01.04 05:29:09 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2008.01.04 05:27:07 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008.01.04 05:22:05 | 000,005,528 | ---- | C] () -- C:\WINDOWS\System32\Setup2k.ini [2008.01.04 05:22:05 | 000,000,296 | ---- | C] () -- C:\WINDOWS\System32\presetup.ini [2008.01.04 05:22:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\FSRremoC.DLL [2007.01.16 17:12:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2006.09.05 15:20:36 | 000,079,400 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL [2006.01.27 19:18:01 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006.01.27 19:05:14 | 000,002,963 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2001.09.19 20:18:01 | 000,008,327 | ---- | C] () -- C:\WINDOWS\Zmodeler.ini [2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI ========== LOP Check ========== [2009.11.24 17:22:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2010.01.06 11:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Jr26Jp16EA [2008.01.04 05:37:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lenovo [2008.01.04 05:33:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC-Doctor [2010.02.14 11:15:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software [2010.03.27 11:24:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2009.11.22 16:53:56 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{EF63305C-BAD7-4144-9208-D65528260864} [2010.03.27 16:36:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Atari [2009.11.27 18:12:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Broad Intelligence [2009.11.14 18:31:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\CDZilla [2009.11.15 11:47:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\DeepBurner [2010.03.27 18:39:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\FOG Downloader [2010.03.02 14:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\GetRightToGo [2010.01.28 20:02:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\ICQ [2010.03.27 16:35:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Leadertech [2008.01.04 05:37:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Lenovo [2010.01.09 10:30:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1 [2009.11.17 17:35:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\OpenOffice.org [2010.03.29 10:34:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\QuickScan [2010.02.14 11:15:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\Simply Super Software [2009.11.14 17:58:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\TeamViewer [2010.01.02 16:59:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\TS3Client [2009.12.30 21:43:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hendrik\Anwendungsdaten\uTorrent [2010.03.27 17:39:25 | 000,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job [2010.03.29 14:01:06 | 000,000,250 | ---- | M] () -- C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\I386\sp2.cab:AGP440.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2009.12.31 14:36:12 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2009.12.31 14:36:12 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004.08.04 09:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\I386\sp2.cab:atapi.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2009.12.31 14:36:12 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2009.12.31 14:36:12 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.04 08:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004.08.04 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: IASTOR.SYS > [2005.10.11 18:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys < MD5 for: NETLOGON.DLL > [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004.08.04 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll [2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll [2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtUninstallKB975467_0$\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004.08.04 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2007.06.06 16:53:00 | 000,339,968 | R--- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.01.26 20:08:21 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2006.01.26 20:08:21 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2006.01.26 20:08:20 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav ========== Alternate Data Streams ========== @Alternate Data Stream - 147 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP  FC5A2B2@Alternate Data Stream - 134 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:671329E4 @Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9 < End of report > Extras.Txt: OTL Extras logfile created on: 29.03.2010 15:20:38 - Run 1 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Dokumente und Einstellungen\Hendrik\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 61,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 229,38 Gb Total Space | 76,36 Gb Free Space | 33,29% Space Free | Partition Type: NTFS Drive D: | 1,66 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF1.02 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LENOVO-HENDRIK Current User Name: Hendrik Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect "8370:TCP" = 8370:TCP:*:Enabled:League of Legends Launcher "8370:UDP" = 8370:UDP:*:Enabled:League of Legends Launcher "8372:TCP" = 8372:TCP:*:Enabled:League of Legends Launcher "8372:UDP" = 8372:UDP:*:Enabled:League of Legends Launcher "8394:TCP" = 8394:TCP:*:Enabled:League of Legends Launcher "8394:UDP" = 8394:UDP:*:Enabled:League of Legends Launcher ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.) "C:\Programme\TeamViewer\Version4\TeamViewer.exe" = C:\Programme\TeamViewer\Version4\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH) "C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.) "C:\Riot Games\League of Legends\air\LolClient.exe" = C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby -- File not found "C:\Riot Games\League of Legends\game\League of Legends.exe" = C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client -- File not found "C:\Programme\League of Legends\Air\LolClient.exe" = C:\Programme\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby -- () "C:\Programme\League of Legends\Game\League of Legends.exe" = C:\Programme\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client -- () "C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( ) "C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Development Company, L.P.) "C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{075473F5-846A-448B-BCB3-104AA1760205}" = RecordNow Data "{07A2B037-650B-A461-75B9-E18053D64A91}" = Catalyst Control Center Graphics Full New "{0EC9FF44-1948-4177-B53F-BA1C6DEE85A3}_is1" = Mainz-Finthen v1.0 for rFactor "{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message "{10DDCDDD-9A59-4496-9371-C17F1668D433}" = Windows Live Toolbar "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA "{17359C81-34C3-F709-865F-638160B6619C}" = Catalyst Control Center Localization French "{1B7C82F3-573E-7412-8F2A-4CEE255A95E2}" = Catalyst Control Center Localization Dutch "{1E05A242-7CE4-095F-9954-223FE45F2099}" = Catalyst Control Center Graphics Full Existing "{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress "{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins "{25015AC3-29D9-61C7-C45D-1E70FCC4E722}" = CCC Help Japanese "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) "{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6 "{33BC9D7E-E790-495E-A4EA-CFB160C17A91}" = Logitech Gaming Software 5.08 "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone "{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder "{3924D5F3-A7B7-EC00-18F6-4A74281B1ED5}" = Catalyst Control Center Localization Finnish "{394CA960-5F19-6874-F7A2-736200927B7C}" = Catalyst Control Center Localization Japanese "{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II "{3DFAEA01-04E6-534F-681B-403F463B619B}" = CCC Help German "{3E607825-C9C7-BE1C-D5AE-171DE32D1B14}" = CCC Help Chinese Traditional "{416AA47D-D4E7-0A9E-0195-5003FC250FBC}" = CCC Help Danish "{419B6A9F-E545-E006-C1E1-F21D9985B500}" = CCC Help Dutch "{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm "{49FC50FC-F965-40D9-89B4-CBFF80941031}" = Windows Movie Maker 2.0 "{4AB2CF2C-22A7-35A8-ED50-C03CD22C1E25}" = Catalyst Control Center Localization Chinese Standard "{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies "{50235451-4864-670F-B796-6F3BCEC00DF2}" = CCC Help English "{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client "{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O Defrag Professional Edition "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{54C1F9C4-AA05-0F4A-5021-AFAECC08ED4A}" = ccc-core-preinstall "{5AFB0771-41BA-BD25-0563-7C45034998A3}" = CCC Help Spanish "{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5 "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler "{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg "{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI "{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox "{69333A04-5134-40A5-A055-9166A7AA1EC8}" = "{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme "{744A5A7C-BE94-A322-DBA2-F5AFD2D238DD}" = Catalyst Control Center Localization Italian "{7A46C9B3-10DB-0B17-7EBA-E4E12A053459}" = Catalyst Control Center Localization German "{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI "{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = InterVideo WinDVD Creator 3 "{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update "{868EC22E-7E82-4760-9265-3F2E705BF24B}" = League of Legends "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder "{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU "{897EE754-0C1E-B843-D033-16DB43990D66}" = Catalyst Control Center Localization Norwegian "{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc "{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload "{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12 "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007 "{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD "{96606195-A36C-4614-9482-D4E61464159D}" = DDS Converter 2 "{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center "{98F1EF12-13AC-4292-FA6F-700E70CA0CEE}" = Catalyst Control Center Localization Chinese Traditional "{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy "{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A8C15CF-AF92-95FC-2229-CEAA77E3D9B3}" = CCC Help Finnish "{9D2CACFA-89B2-52AE-9570-5BE31561AE0E}" = CCC Help Swedish "{9FC8D8F8-AF3A-4488-98AF-51C6DEC732F2}" = c3100_Help "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = RecordNow Audio "{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = RecordNow Copy "{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 "{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer "{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes "{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help "{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA "{C9CC6EA7-6C0F-D7B0-B878-A461738A6817}" = ccc-utility "{CA567AD5-33A4-403D-86D1-EE2D38251951}_is1" = VDownloader 1.1 "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{D1DEA031-3902-67E6-5778-D315CD037ECB}" = Catalyst Control Center Core Implementation "{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkCentre "{D78FA740-A26E-1C40-E1F8-E51182D5D8E6}" = Skins "{D886EC4B-36CD-F37B-90B0-C071CA3B1A1A}" = CCC Help Chinese Standard "{D9EFA162-2DE9-6345-89EE-9614B3D8199D}" = CCC Help Norwegian "{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers "{DBA750B4-B243-1B0C-45B1-F79898E41B7C}" = CCC Help Italian "{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp "{DCC1E6DA-28B8-9C23-F30C-B76408406074}" = Catalyst Control Center Localization Swedish "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{E1B80DEE-A795-4258-8445-074C06AE3AB8}" = MarketResearch "{E1CB2184-B0A7-B761-BD39-EE54481FAC59}" = Catalyst Control Center Localization Danish "{E39041F7-6F24-439A-99BC-C2163BB1429B}" = Catalyst Control Center - Branding "{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center "{E80478C9-E171-22FD-AFF4-44E25F065D98}" = Catalyst Control Center Localization Spanish "{EB8C9964-09AC-48bf-8B98-027609C78251}" = C3100 "{F055E1B2-8A05-4D87-8039-1BE979BA4193}" = Client Security Solution "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery "{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC "{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager "{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan "{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA "{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant "{F8616434-9594-D905-4CCD-5F89B00673EE}" = CCC Help French "{F8955661-564D-C5B3-1FB0-BD17795E7EC4}" = ccc-core-static "{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations "{FB3A14A0-217B-75F0-50B3-FCED5C21C30C}" = Catalyst Control Center Graphics Light "{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA "7-Zip" = 7-Zip 9.10 beta "Ad-Aware" = Ad-Aware "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0 "All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software "Ask Toolbar_is1" = Ask Toolbar "ATI Display Driver" = ATI Display Driver "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AVMWLANCLI" = AVM FRITZ!WLAN "Business Contact Manager for Outlook 2007" = Business Contact Manager for Outlook 2007 "CCleaner" = CCleaner "ClearProg" = ClearProg 1.6.0 Final "Emergency 4 Demo" = Emergency 4 Demo "Euro Truck Simulator" = Euro Truck Simulator 1.00 "F1 2009 TrackPack" = F1 2009 TrackPack "F1 DLM 2009 FULL" = F1 DLM 2009 FULL "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2 "GTR 2_is1" = GTR 2 "HP Imaging Device Functions" = HP Imaging Device Functions 7.0 "HPExtendedCapabilities" = HP Customer Participation Program 7.0 "HPOCR" = OCR Software by I.R.I.S 7.0 "ICQToolbar" = ICQ Toolbar "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "League of Legends_is1" = League of Legends "Lenovo Registration" = Lenovo Registration "Marvell Miniport Driver" = Marvell Miniport Driver "MediaCoder PMP Edition" = MediaCoder PMP Edition "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "MouseSuite98" = Mouse Suite "Mozilla Firefox (3.6.2pre)" = Mozilla Firefox (3.6.2pre) "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NLTournet4_is1" = NL Tourengenerator.net 4.0 "PC-Doctor 5 for Windows" = PC-Doctor 5 für Windows "Picasa2" = Picasa 2 "PrintKey2000" = PrintKey2000 "PROR" = Microsoft Office Professional 2007 "RACE_is1" = RACE "Remove Multimedia Center" = Remove Multimedia Center "rF Tv Style_is1" = Tv Style Beta 0.9 "rFactor" = rFactor (remove only) "rFactor Data Acquisition Plugin" = rFactor Data Acquisition Plugin "RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3 "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "TeamSpeak 3 Client" = TeamSpeak 3 Client "TeamViewer 4" = TeamViewer 4 "Trojan Remover_is1" = Trojan Remover 6.8.1 "Uninstall_is1" = Uninstall 1.0.0.1 "vBus" = vBus "vBus 2.2.1" = vBus 2.2.1 "VirtualBus" = VirtualBus A6C RC2.2 "VLC media player" = VLC media player 1.0.3 "WIC" = Windows Imaging Component "Windows Live Toolbar" = Windows Live Toolbar "Windows Media Format Runtime" = Windows Media Format Runtime "Windows Media Player" = Windows Media Player 10 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR "WMCSetup" = Windows Media Connect "Xfire" = Xfire (remove only) "Yahoo! Companion" = Yahoo! Toolbar "Yahoo! Messenger" = Yahoo! Messenger "Yahoo! Software Update" = Yahoo! Software Update "ZModeler" = ZModeler (remove only) "ZoneAlarm" = ZoneAlarm ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Google Chrome" = Google Chrome "vBus" = vBus "Yahoo! BrowserPlus" = Yahoo! BrowserPlus ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 29.03.2010 08:42:28 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 08:43:58 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 08:44:32 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 08:48:42 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 08:58:14 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 08:58:20 | Computer Name = LENOVO-HENDRIK | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.1.37.3, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.03.2010 09:14:49 | Computer Name = LENOVO-HENDRIK | Source = MSSQL$MSSMLBIZ | ID = 17207 Description = FCB::Open: Operating system error 32(Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.) occurred while creating or opening file 'c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\model.mdf'. Diagnose and correct the operating system error, and retry the operation. Error - 29.03.2010 09:14:49 | Computer Name = LENOVO-HENDRIK | Source = MSSQL$MSSMLBIZ | ID = 17204 Description = FCB::Open failed: Could not open file c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\model.mdf for file number 1. OS error: 32(Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.). Error - 29.03.2010 09:14:49 | Computer Name = LENOVO-HENDRIK | Source = MSSQL$MSSMLBIZ | ID = 17207 Description = FCB::Open: Operating system error 32(Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.) occurred while creating or opening file 'c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\MSDBData.mdf'. Diagnose and correct the operating system error, and retry the operation. Error - 29.03.2010 09:14:49 | Computer Name = LENOVO-HENDRIK | Source = MSSQL$MSSMLBIZ | ID = 17204 Description = FCB::Open failed: Could not open file c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\MSDBData.mdf for file number 1. OS error: 32(Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.). [ System Events ] Error - 09.03.2010 06:46:50 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 16.03.2010 08:38:54 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 17.03.2010 11:03:35 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 19.03.2010 16:09:57 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 20.03.2010 15:28:54 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 22.03.2010 03:38:55 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). Error - 29.03.2010 05:57:05 | Computer Name = LENOVO-HENDRIK | Source = Windows Update Agent | ID = 16 Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht, eine Verbindung herzustellen. Error - 29.03.2010 09:14:56 | Computer Name = LENOVO-HENDRIK | Source = Service Control Manager | ID = 7024 Description = Der Dienst "SQL Server (MSSMLBIZ)" wurde mit folgendem dienstspezifischem Fehler beendet: 1814 (0x716). < End of report > PS: Da ich leider nicht so kompetent bin hab ich eine Frage: Ist es schlimm dass ich bei der Anti Vir Meldung auf Löschen/Quarantäne setzen klicke? MfG |
|
29.03.2010, 15:09
| #4 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, kannst du bitte einen Scan mit GMER als nächstes durchführen und anschließend ComboFix laufen lassen: ComboFix
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten. (ausführliche Anleitung -> Ein Leitfaden und Tutorium zur Nutzung von ComboFix) MfG myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
29.03.2010, 15:39
| #5 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Gmer habe ich bereits durchgeführt aber ohne Ergebnis (Fund). Hätte ich dort irgendwas hier reinstellen sollen? MfG Hendrik Geändert von Microprose (29.03.2010 um 16:28 Uhr) |
|
29.03.2010, 17:03
| #6 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Tut mir Leid wegen Doppelpost kann grade irgendwie nicht editieren. So hier das Ergebnis von Combifix, hoffe es hilft dir/euch: ComboFix 10-03-28.03 - Hendrik 29.03.2010 17:40:41.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2047.1319 [GMT 2:00] ausgeführt von:: c:\dokumente und einstellungen\Hendrik\Desktop\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-2318076025-2377257216-817350029-500 c:\windows\system32\Thumbs.db . ((((((((((((((((((((((( Dateien erstellt von 2010-02-28 bis 2010-03-29 )))))))))))))))))))))))))))))) . 2010-03-29 10:39 . 2010-03-29 10:39 -------- d-----w- c:\programme\OSAM 2010-03-27 14:36 . 2010-03-27 14:36 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Atari 2010-03-27 14:36 . 2010-03-27 14:36 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2010-03-27 14:35 . 2010-03-27 14:35 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Leadertech 2010-03-27 14:27 . 2010-03-27 14:27 -------- d-----w- c:\programme\Atari 2010-03-27 09:24 . 2009-08-05 18:29 3036024 ------w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Simply Super Software\Trojan Remover\qpt15.exe 2010-03-22 21:00 . 2010-03-22 21:00 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google 2010-03-22 20:55 . 2010-03-22 20:57 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Temp 2010-03-22 20:55 . 2010-03-22 20:55 -------- d-----w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google 2010-03-22 08:48 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe 2010-03-20 12:13 . 2010-03-20 12:13 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\NFS Underground 2 2010-03-18 16:29 . 2010-03-18 16:29 -------- d-----w- c:\programme\sixteen tons entertainment 2010-03-02 11:34 . 2010-03-02 11:35 -------- d-----w- c:\programme\Microsoft Small Business 2010-03-02 11:30 . 2010-03-02 11:32 -------- d-----w- c:\programme\Microsoft SQL Server 2010-03-02 11:24 . 2010-03-02 11:24 -------- d-----w- c:\programme\Microsoft Works 2010-03-02 11:22 . 2010-03-02 11:32 -------- d-----w- c:\programme\Microsoft.NET 2010-03-02 11:17 . 2010-03-02 11:17 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Microsoft Help 2010-03-02 11:17 . 2010-03-02 11:28 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-29 14:59 . 2009-11-22 15:19 -------- d-----w- c:\programme\CCleaner 2010-03-29 13:16 . 2006-01-27 01:01 509040 ----a-w- c:\windows\system32\perfh007.dat 2010-03-29 13:16 . 2006-01-27 01:01 102858 ----a-w- c:\windows\system32\perfc007.dat 2010-03-29 13:14 . 2010-03-29 13:14 2974276 ----a-w- c:\windows\Internet Logs\tvDebug.zip 2010-03-29 11:52 . 2009-11-14 17:04 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Skype 2010-03-29 10:56 . 2009-11-22 14:56 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2010-03-29 08:34 . 2010-02-14 10:59 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\QuickScan 2010-03-27 19:02 . 2010-01-25 15:44 -------- d-----w- c:\programme\Gemeinsame Dateien\Blizzard Entertainment 2010-03-27 16:39 . 2010-01-14 13:02 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\FOG Downloader 2010-03-27 09:24 . 2009-11-22 14:57 -------- d---a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP 2010-03-23 18:41 . 2010-01-15 14:19 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\vlc 2010-03-23 11:39 . 2009-11-15 13:08 -------- d-----w- c:\programme\rFactor_FUN 2010-03-23 09:52 . 2009-11-17 16:55 1 ------w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-03-22 20:57 . 2008-01-04 03:33 -------- d-----w- c:\programme\Google 2010-03-22 11:19 . 2009-11-22 14:56 -------- d-----w- c:\programme\Spybot - Search & Destroy 2010-03-20 17:57 . 2010-03-20 19:28 1275904 ----a-w- c:\windows\Internet Logs\xDB2.tmp 2010-03-20 12:01 . 2010-01-17 13:05 -------- d-----w- c:\programme\Hex-Editor MX 2010-03-02 15:19 . 2010-01-11 17:24 -------- d-----w- c:\programme\League of Legends 2010-03-02 12:17 . 2009-12-23 16:41 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\GetRightToGo 2010-03-02 11:29 . 2009-11-14 15:37 83128 ------w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT 2010-02-28 15:10 . 2010-02-07 15:02 -------- d-----w- c:\programme\TeamSpeak 3 Client 2010-02-23 13:55 . 2010-02-23 13:55 -------- d-----w- c:\programme\gPotato.eu 2010-02-19 18:31 . 2010-02-13 17:42 -------- d-----w- c:\programme\VirtualBus 2010-02-17 18:01 . 2009-11-15 16:31 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\teamspeak2 2010-02-14 15:56 . 2010-02-12 14:38 -------- d-----w- c:\programme\VBus2 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\programme\Trojan Remover 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Simply Super Software 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Simply Super Software 2010-02-14 09:02 . 2010-01-06 08:51 -------- d-----w- c:\programme\Steam 2010-02-12 17:24 . 2010-02-12 17:24 -------- d-----w- c:\programme\vBus 2.2.1 2010-02-12 14:47 . 2010-02-12 14:46 -------- d-----w- c:\programme\vBus 2010-02-08 15:25 . 2009-11-20 12:58 -------- d-----w- c:\programme\rFactor_F1DLM 2010-02-05 18:13 . 2010-02-05 12:07 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\HP 2010-02-05 12:08 . 2010-02-05 12:08 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\HP 2010-02-05 12:08 . 2010-02-05 12:02 127916 ----a-w- c:\windows\hpoins11.dat 2010-02-05 12:07 . 2010-02-05 12:06 -------- d-----w- c:\programme\Gemeinsame Dateien\HP 2010-02-05 12:07 . 2010-02-05 12:03 -------- d-----w- c:\programme\HP 2010-02-05 12:05 . 2010-02-05 12:05 -------- d-----w- c:\programme\Hewlett-Packard 2010-02-05 12:05 . 2010-02-05 12:05 -------- d-----w- c:\programme\Gemeinsame Dateien\Hewlett-Packard 2010-02-04 11:15 . 2009-12-30 20:00 -------- d-----w- c:\programme\ZModeler 2.1.1.-.Registrado 2010-02-01 17:31 . 2010-02-01 17:30 -------- d-----w- c:\programme\Euro Truck Simulator 2010-02-01 17:26 . 2010-01-30 18:07 -------- d-----w- c:\programme\Bus-Simulator 2008 Demo 2010-01-28 18:02 . 2009-11-24 15:21 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\ICQ 2010-01-25 19:24 . 2010-01-26 13:32 2440704 ----a-w- c:\windows\Internet Logs\xDB1.tmp 2010-01-11 17:22 . 2010-01-11 14:46 814143398 ------w- c:\programme\loleusetup.exe 2010-01-11 16:33 . 2010-02-14 10:59 789320 ------w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll 2010-01-11 16:32 . 2010-02-14 10:59 698184 ------w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll 2010-01-09 09:36 . 2010-01-08 19:36 38784 ------w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2010-01-03 10:42 . 2010-01-03 10:42 151552 ----a-w- c:\windows\system32\nvRegDev.dll 2009-12-31 16:50 . 2006-01-27 01:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-31 12:44 . 2006-01-27 02:17 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2007-08-13 22:46 . 2008-01-04 03:27 10896 ----a-w- c:\programme\ThinkVantage Fingerprint Software . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2009-01-02 10:06 365960 ------w- c:\programme\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\programme\AskBarDis\bar\bin\askBar.dll" [2009-01-02 365960] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552] "TVT Scheduler Proxy"="c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-11 540672] "SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-11-17 149280] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "LPManager"="c:\progra~1\THINKV~2\PrdCtr\LPMGR.exe" [2007-12-09 120096] "AMSG"="c:\programme\ThinkVantage\AMSG\Amsg.exe" [2007-02-01 419376] "cssauth"="c:\programme\Lenovo\Client Security Solution\cssauth.exe" [2007-08-03 2630968] "AVMWlanClient"="c:\programme\avmwlanstick\wlangui.exe" [2007-12-20 1748992] "avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "ZoneAlarm Client"="c:\programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 919280] "StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "Start WingMan Profiler"="c:\programme\Logitech\Gaming Software\LWEMon.exe" [2009-09-16 153608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\ HP Digital Imaging Monitor.lnk - c:\programme\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Printkey2000.lnk] path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Printkey2000.lnk backup=c:\windows\pss\Printkey2000.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2009-11-10 14:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon] 2005-04-13 13:34 49152 ----a-w- c:\windows\system32\ico.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2010-01-06 08:51 1217808 ----a-w- c:\programme\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Programme\\TeamViewer\\Version4\\TeamViewer.exe"= "c:\\Programme\\ICQ6.5\\ICQ.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Programme\\League of Legends\\Air\\LolClient.exe"= "c:\\Programme\\League of Legends\\Game\\League of Legends.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programme\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8370:TCP"= 8370:TCP:League of Legends Launcher "8370:UDP"= 8370:UDP:League of Legends Launcher "8372:TCP"= 8372:TCP:League of Legends Launcher "8372:UDP"= 8372:UDP:League of Legends Launcher "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14.11.2009 17:38 64160] R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16.09.2008 13:03 169312] R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [14.11.2009 17:06 108289] R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [24.11.2009 17:22 222456] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\programme\Lenovo\Rescue and Recovery\rrpservice.exe [11.07.2007 21:38 569344] R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\drivers\fwlanusbn.sys [04.01.2008 06:25 401920] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22.05.2007 16:59 30336] S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [22.03.2010 22:55 136176] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [03.07.2009 16:49 1029456] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 XDva289;XDva289;\??\c:\windows\system32\XDva289.sys --> c:\windows\system32\XDva289.sys [?] --- Andere Dienste/Treiber im Speicher --- *Deregistered* - d3dswy *Deregistered* - WAM . Inhalt des "geplante Tasks" Ordners 2010-03-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 15:40] 2010-03-29 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job - c:\programme\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 14:54] 2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programme\Google\Update\GoogleUpdate.exe [2010-03-22 20:55] 2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programme\Google\Update\GoogleUpdate.exe [2010-03-22 20:55] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ mStart Page = hxxp://de.yahoo.com uInternet Connection Wizard,ShellNext = hxxp://notifier.avira.com/stats.php?id_not=231&url=https%3A%2F%2Favira.cleverbridge.com%2F30%2Fcookie%3Fx%2Dorigin%3Dnotifier%26x%2Dnotifier%3DCOMPHI_DE%26expiry%3D28%26redirec tto%3Dhttps%253a%252f%252favira.cleverbridge.com%252f30%252fpurl%2Dac-de uSearchURL,(Default) = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE: &Windows Live Search - c:\programme\Windows Live Toolbar\msntb.dll/search.htm IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ FF - component: c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll FF - plugin: c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Yahoo!\BrowserPlus\2.4.17\Plugins\npybrowserplus_2.4.17.dll FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - Entfernte verwaiste Registrierungseinträge - - - - AddRemove-vBus - c:\dokumente und einstellungen\Hendrik\Desktop\Busse\Uninstal.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net Rootkit scan 2010-03-29 17:54 Windows 5.1.2600 Service Pack 3 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG08.00.00.01WORKSTATION"="CFC58FC27893C15F6317EC485E175DD66CA4D7A9AEAE5152E4539E0AE0D12016FB7B09A8E8914A056A6AC32C524A3DCBD0455341E9A64E67AD28 9B04F76E4FFDDCA3774208A4257BAC055E7FCAFC7C0FFDEC195AF918FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC7 4CA6A0AC4980AC7933C038D530D6EB3452C038D530D6EB34528EDD5E5BE2F6E667BFA5716741DC32A662B46EAB123CBC2BFC3A0965958121541E9762E17D7BE34455C3302CFAF9D1D2DEBA E6AF7DACEACF63436A9CF2D1DC8EC8054C9C232A8D4E0A6A25E21550B463AD57F00184CB093A3C2E058C668277ACD8A0901D0576ED18D4D83111A1CCBAD864681527AB306E835E94AA6608 79DFF806E266586AAE2F43EB82158EB4CC644C5EFE3C807666185764C40EAB6C8FADD54DF6EB94181B2087CF91770A69A3DA68B960383EF26E24F52D42C933AF1296396DBC23EDDC74B0AD 3F6263025C99E6ECD8073B68AD3DD6325CC2592972417AABEAC66F550A69F793BF05C5CC3068F9ACDF9F5BD539B9197759309B8A5853D8C98E5E9B8DF29C302D1BBEF191093F258E3B8B17 B5AD40F53F4E2BD62B0870D5C5E4FCD42EF023B57FDE061ECF92C19F0E18E14B8AA4A11E1AAB8333B12E35BBE4BCD3AD24DF078CA55A0AE5557985C33B686ABC29BCA0E3AEA3C2BC197934 7780ABC599ADA147D9CC252A45C86E1891B8E22312BB1975C133ADA0E3AF9EEF190688E973DF9AD4653916F921A229752C3E023D57BEDF4D5173068DFC97D465D5F5708C77223216A03FCB C3BD2F61135916039FFA063CC6D251A92B40C8577D0666C3AC48AED6651BC9A604470FD55784A0686251B5DBF6AB40DDD0CA8D659BA70025FD6998778F8B574CE84BB8471DBD50F7541149 72646249A7871C05C314DA807E67C6C00A59CB7AA6593BF27C3235AD3D75570D378D2307540F1A213AAFE5B87A06ACDF067559D761EC6F5B3E5BC3D2857C21A2E2603EAB715A8B2A93ACAF 8D8A29CB826910D62B6DF0A1E2DA50E36EE153538036C2277AD20E1E3920BAC57A61D13A87B34609C202E4EF4D24B835462A9534F1718A75CB8F86603E32005A0AF8BA71226AAADA0116FC 5C35EE37F82F7796F011DD05E60C0352C87BA39340DE8B4DCE5B9643D9DBE8A2CD06155D1895A7DB17D2C3F1D8BA4CB12E08CE8472AE9AA9138F4389B8DDF9F20F8074319B77DE1D1B7C73 85506E4E9D4E4E93D38BC06A24646C82ECCBA38EBDCE3AEEAFB36A81C9D326BEE776CCB0C0498C5574CE750243CC76E7CC8D6130879D9B6A47331439827DBE7D3494935DF622D67BD1203B AEC3B7868D811DDCAC08F2604E598FAFF59D378808FB1D9205D5C214F2C708190013F7470E55BBF0142DAA1C0CBE658D69A304193FC1A12E9AA177FDA9A7B2A7C956" . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\Ati2evxx.dll . Zeit der Fertigstellung: 2010-03-29 17:58:54 ComboFix-quarantined-files.txt 2010-03-29 15:58 Vor Suchlauf: 19 Verzeichnis(se), 92.270.776.320 Bytes frei Nach Suchlauf: 21 Verzeichnis(se), 90.861.027.328 Bytes frei WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 2B2B8165203AE015D4A85E4028942755 |
|
29.03.2010, 18:32
| #7 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, Scripten mit Combofix
Code:
ATTFilter http://www.trojaner-board.de/84211-tr-agent-ruo-c-windows-system32-winevpn-dll.html
Collect::[100]
C:\WINDOWS\System32\winevpn.dll
C:\windows\system32\mvfs32.dll
C:\windows\system32\drivers\d3dswy.sys
Driver::
d3dswy
Folder::
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Jr26Jp16EA
Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann Nachdem das Log im Notepad aufgegenagen ist, erscheint ein Popup, stelle sicher dass du eine Internet verbindung hast, da das Programm versuchen wird, Dateien zur weiteren Analyse hochzuladen. MfG myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
29.03.2010, 19:14
| #8 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll So dann kommt hier was neues: ComboFix 10-03-28.03 - Hendrik 29.03.2010 19:38:10.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2047.1208 [GMT 2:00] ausgeführt von:: c:\dokumente und einstellungen\Hendrik\Desktop\ComboFix.exe Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Hendrik\Desktop\CFScript.txt AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} file zipped: c:\windows\system32\drivers\d3dswy.sys . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\dokumente und einstellungen\All Users\Anwendungsdaten\Jr26Jp16EA c:\dokumente und einstellungen\All Users\Anwendungsdaten\Jr26Jp16EA\PCGWIN32.LI5 c:\windows\system32\drivers\d3dswy.sys . ((((((((((((((((((((((((((((((((((((((( Treiber/Dienste ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_D3DSWY -------\Service_d3dswy ((((((((((((((((((((((( Dateien erstellt von 2010-02-28 bis 2010-03-29 )))))))))))))))))))))))))))))) . 2010-03-29 10:39 . 2010-03-29 10:39 -------- d-----w- c:\programme\OSAM 2010-03-27 14:36 . 2010-03-27 14:36 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Atari 2010-03-27 14:36 . 2010-03-27 14:36 43520 ------w- c:\windows\system32\CmdLineExt03.dll 2010-03-27 14:35 . 2010-03-27 14:35 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Leadertech 2010-03-27 14:27 . 2010-03-27 14:27 -------- d-----w- c:\programme\Atari 2010-03-22 21:00 . 2010-03-22 21:00 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google 2010-03-22 20:55 . 2010-03-22 20:57 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Temp 2010-03-22 20:55 . 2010-03-22 20:55 -------- d-----w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google 2010-03-22 08:48 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe 2010-03-20 12:13 . 2010-03-20 12:13 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\NFS Underground 2 2010-03-18 16:29 . 2010-03-18 16:29 -------- d-----w- c:\programme\sixteen tons entertainment 2010-03-02 11:34 . 2010-03-02 11:35 -------- d-----w- c:\programme\Microsoft Small Business 2010-03-02 11:30 . 2010-03-02 11:32 -------- d-----w- c:\programme\Microsoft SQL Server 2010-03-02 11:24 . 2010-03-02 11:24 -------- d-----w- c:\programme\Microsoft Works 2010-03-02 11:22 . 2010-03-02 11:32 -------- d-----w- c:\programme\Microsoft.NET 2010-03-02 11:17 . 2010-03-02 11:17 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Microsoft Help 2010-03-02 11:17 . 2010-03-02 11:28 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-29 17:16 . 2009-11-15 09:05 -------- d-----w- c:\programme\rFactor_ALMS 2010-03-29 14:59 . 2009-11-22 15:19 -------- d-----w- c:\programme\CCleaner 2010-03-29 13:16 . 2006-01-27 01:01 509040 ------w- c:\windows\system32\perfh007.dat 2010-03-29 13:16 . 2006-01-27 01:01 102858 ------w- c:\windows\system32\perfc007.dat 2010-03-29 13:14 . 2010-03-29 13:14 2974276 ----a-w- c:\windows\Internet Logs\tvDebug.zip 2010-03-29 11:52 . 2009-11-14 17:04 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Skype 2010-03-29 10:56 . 2009-11-22 14:56 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2010-03-29 08:34 . 2010-02-14 10:59 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\QuickScan 2010-03-27 19:02 . 2010-01-25 15:44 -------- d-----w- c:\programme\Gemeinsame Dateien\Blizzard Entertainment 2010-03-27 16:39 . 2010-01-14 13:02 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\FOG Downloader 2010-03-27 09:24 . 2009-11-22 14:57 -------- d---a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP 2010-03-23 18:41 . 2010-01-15 14:19 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\vlc 2010-03-23 11:39 . 2009-11-15 13:08 -------- d-----w- c:\programme\rFactor_FUN 2010-03-22 20:57 . 2008-01-04 03:33 -------- d-----w- c:\programme\Google 2010-03-22 11:19 . 2009-11-22 14:56 -------- d-----w- c:\programme\Spybot - Search & Destroy 2010-03-20 17:57 . 2010-03-20 19:28 1275904 ----a-w- c:\windows\Internet Logs\xDB2.tmp 2010-03-20 12:01 . 2010-01-17 13:05 -------- d-----w- c:\programme\Hex-Editor MX 2010-03-02 15:19 . 2010-01-11 17:24 -------- d-----w- c:\programme\League of Legends 2010-03-02 12:17 . 2009-12-23 16:41 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\GetRightToGo 2010-03-02 11:29 . 2009-11-14 15:37 83128 ------w- c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT 2010-03-01 15:40 . 2010-02-14 09:12 15688 ------w- c:\windows\system32\lsdelete.exe 2010-02-28 15:10 . 2010-02-07 15:02 -------- d-----w- c:\programme\TeamSpeak 3 Client 2010-02-23 13:55 . 2010-02-23 13:55 -------- d-----w- c:\programme\gPotato.eu 2010-02-19 18:31 . 2010-02-13 17:42 -------- d-----w- c:\programme\VirtualBus 2010-02-17 18:01 . 2009-11-15 16:31 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\teamspeak2 2010-02-14 15:56 . 2010-02-12 14:38 -------- d-----w- c:\programme\VBus2 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\programme\Trojan Remover 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Simply Super Software 2010-02-14 09:15 . 2010-02-14 09:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Simply Super Software 2010-02-14 09:02 . 2010-01-06 08:51 -------- d-----w- c:\programme\Steam 2010-02-12 17:24 . 2010-02-12 17:24 -------- d-----w- c:\programme\vBus 2.2.1 2010-02-12 14:47 . 2010-02-12 14:46 -------- d-----w- c:\programme\vBus 2010-02-08 15:25 . 2009-11-20 12:58 -------- d-----w- c:\programme\rFactor_F1DLM 2010-02-05 18:13 . 2010-02-05 12:07 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\HP 2010-02-05 12:08 . 2010-02-05 12:08 -------- d-----w- c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\HP 2010-02-05 12:08 . 2010-02-05 12:02 127916 ------w- c:\windows\hpoins11.dat 2010-02-05 12:07 . 2010-02-05 12:06 -------- d-----w- c:\programme\Gemeinsame Dateien\HP 2010-02-05 12:07 . 2010-02-05 12:03 -------- d-----w- c:\programme\HP 2010-02-05 12:05 . 2010-02-05 12:05 -------- d-----w- c:\programme\Hewlett-Packard 2010-02-05 12:05 . 2010-02-05 12:05 -------- d-----w- c:\programme\Gemeinsame Dateien\Hewlett-Packard 2010-02-04 11:15 . 2009-12-30 20:00 -------- d-----w- c:\programme\ZModeler 2.1.1.-.Registrado 2010-02-01 17:31 . 2010-02-01 17:30 -------- d-----w- c:\programme\Euro Truck Simulator 2010-02-01 17:26 . 2010-01-30 18:07 -------- d-----w- c:\programme\Bus-Simulator 2008 Demo 2010-01-25 19:24 . 2010-01-26 13:32 2440704 ----a-w- c:\windows\Internet Logs\xDB1.tmp 2010-01-11 17:22 . 2010-01-11 14:46 814143398 ------w- c:\programme\loleusetup.exe 2010-01-03 10:42 . 2010-01-03 10:42 151552 ------w- c:\windows\system32\nvRegDev.dll 2009-12-31 16:50 . 2006-01-27 01:00 353792 ------w- c:\windows\system32\drivers\srv.sys 2009-12-31 12:44 . 2006-01-27 02:17 86327 ------w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2007-08-13 22:46 . 2008-01-04 03:27 10896 ------w- c:\programme\ThinkVantage Fingerprint Software . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2009-01-02 10:06 365960 ------w- c:\programme\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\programme\AskBarDis\bar\bin\askBar.dll" [2009-01-02 365960] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552] "TVT Scheduler Proxy"="c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-11 540672] "SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-11-17 149280] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "LPManager"="c:\progra~1\THINKV~2\PrdCtr\LPMGR.exe" [2007-12-09 120096] "AMSG"="c:\programme\ThinkVantage\AMSG\Amsg.exe" [2007-02-01 419376] "cssauth"="c:\programme\Lenovo\Client Security Solution\cssauth.exe" [2007-08-03 2630968] "AVMWlanClient"="c:\programme\avmwlanstick\wlangui.exe" [2007-12-20 1748992] "avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "ZoneAlarm Client"="c:\programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 919280] "StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "Start WingMan Profiler"="c:\programme\Logitech\Gaming Software\LWEMon.exe" [2009-09-16 153608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\ HP Digital Imaging Monitor.lnk - c:\programme\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Printkey2000.lnk] path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Printkey2000.lnk backup=c:\windows\pss\Printkey2000.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2009-11-10 14:39 5244216 ------w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon] 2005-04-13 13:34 49152 ------w- c:\windows\system32\ico.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2010-01-06 08:51 1217808 ------w- c:\programme\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Programme\\TeamViewer\\Version4\\TeamViewer.exe"= "c:\\Programme\\ICQ6.5\\ICQ.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Programme\\League of Legends\\Air\\LolClient.exe"= "c:\\Programme\\League of Legends\\Game\\League of Legends.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Programme\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Programme\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programme\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8370:TCP"= 8370:TCP:League of Legends Launcher "8370:UDP"= 8370:UDP:League of Legends Launcher "8372:TCP"= 8372:TCP:League of Legends Launcher "8372:UDP"= 8372:UDP:League of Legends Launcher "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14.11.2009 17:38 64160] R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16.09.2008 13:03 169312] R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [14.11.2009 17:06 108289] R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [24.11.2009 17:22 222456] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [03.07.2009 16:49 1029456] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\programme\Lenovo\Rescue and Recovery\rrpservice.exe [11.07.2007 21:38 569344] R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\drivers\fwlanusbn.sys [04.01.2008 06:25 401920] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22.05.2007 16:59 30336] S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [22.03.2010 22:55 136176] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 XDva289;XDva289;\??\c:\windows\system32\XDva289.sys --> c:\windows\system32\XDva289.sys [?] . Inhalt des "geplante Tasks" Ordners 2010-03-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 15:40] 2010-03-29 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job - c:\programme\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 14:54] 2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\programme\Google\Update\GoogleUpdate.exe [2010-03-22 20:55] 2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\programme\Google\Update\GoogleUpdate.exe [2010-03-22 20:55] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ mStart Page = hxxp://de.yahoo.com uInternet Connection Wizard,ShellNext = hxxp://notifier.avira.com/stats.php?id_not=231&url=https%3A%2F%2Favira.cleverbridge.com%2F30%2Fcookie%3Fx%2Dorigin%3Dnotifier%26x%2Dnotifier%3DCOMPHI_DE%26expiry%3D28%26redirec tto%3Dhttps%253a%252f%252favira.cleverbridge.com%252f30%252fpurl%2Dac-de uSearchURL,(Default) = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE: &Windows Live Search - c:\programme\Windows Live Toolbar\msntb.dll/search.htm IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ FF - component: c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll FF - plugin: c:\dokumente und einstellungen\Hendrik\Anwendungsdaten\Mozilla\Firefox\Profiles\mwnt3kk0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\dokumente und einstellungen\Hendrik\Lokale Einstellungen\Anwendungsdaten\Yahoo!\BrowserPlus\2.4.17\Plugins\npybrowserplus_2.4.17.dll FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net Rootkit scan 2010-03-29 20:01 Windows 5.1.2600 Service Pack 3 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG08.00.00.01WORKSTATION"="CFC58FC27893C15F6317EC485E175DD66CA4D7A9AEAE5152E4539E0AE0D12016FB7B09A8E8914A056A6AC32C524A3DCBD0455341E9A64E67AD28 9B04F76E4FFDDCA3774208A4257BAC055E7FCAFC7C0FFDEC195AF918FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC7 4CA6A0AC4980AC7933C038D530D6EB3452C038D530D6EB34528EDD5E5BE2F6E667BFA5716741DC32A662B46EAB123CBC2BFC3A0965958121541E9762E17D7BE34455C3302CFAF9D1D2DEBA E6AF7DACEACF63436A9CF2D1DC8EC8054C9C232A8D4E0A6A25E21550B463AD57F00184CB093A3C2E058C668277ACD8A0901D0576ED18D4D83111A1CCBAD864681527AB306E835E94AA6608 79DFF806E266586AAE2F43EB82158EB4CC644C5EFE3C807666185764C40EAB6C8FADD54DF6EB94181B2087CF91770A69A3DA68B960383EF26E24F52D42C933AF1296396DBC23EDDC74B0AD 3F6263025C99E6ECD8073B68AD3DD6325CC2592972417AABEAC66F550A69F793BF05C5CC3068F9ACDF9F5BD539B9197759309B8A5853D8C98E5E9B8DF29C302D1BBEF191093F258E3B8B17 B5AD40F53F4E2BD62B0870D5C5E4FCD42EF023B57FDE061ECF92C19F0E18E14B8AA4A11E1AAB8333B12E35BBE4BCD3AD24DF078CA55A0AE5557985C33B686ABC29BCA0E3AEA3C2BC197934 7780ABC599ADA147D9CC252A45C86E1891B8E22312BB1975C133ADA0E3AF9EEF190688E973DF9AD4653916F921A229752C3E023D57BEDF4D5173068DFC97D465D5F5708C77223216A03FCB C3BD2F61135916039FFA063CC6D251A92B40C8577D0666C3AC48AED6651BC9A604470FD55784A0686251B5DBF6AB40DDD0CA8D659BA70025FD6998778F8B574CE84BB8471DBD50F7541149 72646249A7871C05C314DA807E67C6C00A59CB7AA6593BF27C3235AD3D75570D378D2307540F1A213AAFE5B87A06ACDF067559D761EC6F5B3E5BC3D2857C21A2E2603EAB715A8B2A93ACAF 8D8A29CB826910D62B6DF0A1E2DA50E36EE153538036C2277AD20E1E3920BAC57A61D13A87B34609C202E4EF4D24B835462A9534F1718A75CB8F86603E32005A0AF8BA71226AAADA0116FC 5C35EE37F82F7796F011DD05E60C0352C87BA39340DE8B4DCE5B9643D9DBE8A2CD06155D1895A7DB17D2C3F1D8BA4CB12E08CE8472AE9AA9138F4389B8DDF9F20F8074319B77DE1D1B7C73 85506E4E9D4E4E93D38BC06A24646C82ECCBA38EBDCE3AEEAFB36A81C9D326BEE776CCB0C0498C5574CE750243CC76E7CC8D6130879D9B6A47331439827DBE7D3494935DF622D67BD1203B AEC3B7868D811DDCAC08F2604E598FAFF59D378808FB1D9205D5C214F2C708190013F7470E55BBF0142DAA1C0CBE658D69A304193FC1A12E9AA177FDA9A7B2A7C956" . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(940) c:\windows\system32\Ati2evxx.dll . ------------------------ Weitere laufende Prozesse ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\programme\Avira\AntiVir Desktop\avguard.exe c:\programme\avmwlanstick\WlanNetService.exe c:\programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe c:\programme\Java\jre6\bin\jqs.exe c:\programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\windows\system32\oodag.exe c:\windows\system32\HPZipm12.exe c:\programme\lenovo\system update\suservice.exe c:\programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe c:\programme\Lenovo\Rescue and Recovery\rrservice.exe c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe c:\programme\Lenovo\Rescue and Recovery\ADM\IUService.exe c:\windows\system32\wdfmgr.exe c:\programme\Gemeinsame Dateien\Lenovo\Logger\logmon.exe c:\programme\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\windows\RTHDCPL.EXE c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE c:\programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\programme\HP\Digital Imaging\bin\hpqnrs08.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Zeit der Fertigstellung: 2010-03-29 20:10:46 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2010-03-29 18:10 ComboFix2.txt 2010-03-29 15:58 Vor Suchlauf: 20 Verzeichnis(se), 76.146.253.824 Bytes frei Nach Suchlauf: 21 Verzeichnis(se), 74.427.826.176 Bytes frei - - End Of File - - 0F6B3D8BB8903A2F28D9A44ABC1D07E5 |
|
29.03.2010, 19:28
| #9 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, wie gehts dem rechner? Der Upload scheint nicht funkioniert zu haben. Navigiere bitte zu C:\qoobox\quarantine und suche [100]Submit_<datum und uhrzeit>.zip, gehe dann auf diese seite und folge den Anweisungen um die Datei hochzuladen. lg myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
29.03.2010, 19:38
| #10 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, Zustand des Rechners: Ich habs leider vergessen zu sagen aber seit heute morgen fährt der Rechner nicht mehr korrekt hoch es kommt ein schwarzer Bildschirm wo Error Boot Sequnce steht. Nachdem ich F2 gedrückt hat fährt er dann doch hoch, zum Glück. Hinzu kommt dass die Uhrzeit immer verstellt ist wenn ich den PC das erste Mal am Tag hochfahre. Es könnte sein dass der PC etwas langsamer geworden ist, das kann aber auch nur Einbildung sein. Wie siehts denn bis jetzt aus? Denkst du es gibt ne Chance dass ich Windows nicht neu installiern muss? Datei ist nun auch hochgeladen aber wie kommst du/ich daran? MfG |
|
29.03.2010, 19:50
| #11 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, wann ist das passiert? Vor dem ComboFix ausführen, nach dem ersten durchlauf? nach dem 2.? Mache bitte noch einen Scan mit Malwarebytes Anti-Malware. MfG myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
29.03.2010, 19:52
| #12 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Wenn du das Hochfahren meinst das is schon seit heute morgen und da war ich hier noch gar nicht registriert heißt schon vor den ganzen Vorgängen. So Malware hat nichts gefunden :O : Malwarebytes' Anti-Malware 1.44 Datenbank Version: 3929 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 29.03.2010 21:02:56 mbam-log-2010-03-29 (21-02-56).txt Scan-Methode: Quick-Scan Durchsuchte Objekte: 134658 Laufzeit: 5 minute(s), 9 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Geändert von Microprose (29.03.2010 um 20:04 Uhr) |
|
29.03.2010, 22:28
| #13 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, Lade dir diese Datei -> mbr.exe direkt auf das Laufwerk wo dein Betriebssystem installiert ist (also auf c: ) und führe sie aus. Auf c:\ wir dann ein mbr.log angelegt, öffne dieses mit dem Editor, kopiere den Text ab und füge ihn in deinen Beitrag ein. MfG myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
30.03.2010, 09:17
| #14 |
| | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi Also ich schilder mal eben was passiert ist: Immernoch fährt der Computer nicht korrekt hoch und die Uhrzeit ist schon wieder verstellt, ABER ich habe eben den Browser geöffnet und es AntiVir hat sich nicht gemeldet. Hinzu kommt dass winevpn nicht mehr existiert. Ich glaube die Datei wurde sonst nämlich immer dann erstellt wenn ich das erste Mal am Tag den Browser öffnete. Ich weiß zwar nich ob das wirklich ne gute Nachricht ist bin aber trotzdem schon ein wenig happy  Hier das Ergebnis, das Programm scheint wohl auch nichts gefunden zu haben: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK MfG |
|
30.03.2010, 09:56
| #15 |
| /// TB-Ausbilder | TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll Hi, könntest du im BIOS mal überprüfen welche Uhrzeit eingestellt und die gegebenenfalls korrigieren. Lass mich wissen ob das Problem damit behoben ist. Es sieht so aus als ob wir die Dateien entfernt hätten. Lass bitte mal noch nen vollen Scan mit Avira laufen und poste das Ergebnis hier. lg myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
| Themen zu TR/Agent.ruo in C:/WINDOWS/System32/winevpn.dll |
| 7-zip, ad-aware, antivir guard, antivirus, ask toolbar, ask.com, avgnt.exe, avira, bho, browser, c:\windows\system32\rundll32.exe, components, desktop, desktop.ini, diagnostics, erste mal, firefox, fontcache, gupdate, helper, hewlett packard, internet, internet explorer, jusched.exe, lenovo, logfile, malware, mozilla, mssql, plug-in, proxy, registry, registry key, security, server, shortcut, software, stick, super, symantec, system, tcp/ip, thinkvantage registry monitor service, updates, windows, windows xp |
Textbox.
.
Linear-Darstellung
