| |
| |||||||
Log-Analyse und Auswertung: Kontrolle nach ImagewiederherstellungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.04.2010, 07:13
| #1 |
  |  Kontrolle nach Imagewiederherstellung Hallo und guten Morgen, Kurze Vorgeschichte: Ich hatte, ohne besonderen Grund, neu aufgesetzt.Direkt danach habe ich ein image erstellt.Nun bat meine Nichte ihre emails bei mir abrufen zu dürfen.Natürlich durfte sie.Nach ca. 15 Minuten kam sie zu mir und sagte: Da stimmt was nicht.  Desktop leergeräumt,Programme nicht mehr ausführbar,Internet nicht mehr erreichbar.  Was war passiert? Sie hatte "nur" eine mail von UPS geöffnet und eine exe im Anhang ausgeführt  (Merke:Lass niemals mehr jemanden an den Rechner, wenn du gerade als Administrator angemeldet bist!!!)Sie sagte noch:"Da ging so ein Warnfenster auf,irgendwas mit Virus.Ich hab auf ignorieren geklickt:War ja von UPS.  Nun hab ich nicht lange überlegt, und das image zurückgespielt. Ich wollte nur kontrollieren das nichts zurückgeblieben ist (Was ja eigentlich sowieso unmöglich sein sollte, hoffe ich) Betriebssystem ist Windows 7 64bit. Hier ein paar Logs: Code:
ATTFilter Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org
Datenbank Version: 3962
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
07.04.2010 10:00:11
mbam-log-2010-04-07 (10-00-11).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|K:\|)
Durchsuchte Objekte: 185132
Laufzeit: 16 Minute(n), 13 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter OTL Extras logfile created on: 08.04.2010 07:38:06 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Users\NonAdmin\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 76,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 75,65 Gb Free Space | 77,54% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 91,97 Gb Free Space | 94,18% Space Free | Partition Type: NTFS
Drive E: | 270,45 Gb Total Space | 249,04 Gb Free Space | 92,08% Space Free | Partition Type: NTFS
Drive F: | 166,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: HOMEOFFICE
Current User Name: Michael&Diana
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{23F108F0-BD12-A639-8C6E-BB1F7AF736C1}" = ccc-utility64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{6741B646-3DBE-AF40-75FA-959847831D9F}" = ATI Catalyst Install Manager
"HitmanPro35" = Hitman Pro 3.5
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{36D8A747-3FC1-121F-6C92-2F79A9B3172D}" = Catalyst Control Center Graphics Full New
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.20
"{89D16846-7491-A3C3-89D9-006906602FA2}" = Catalyst Control Center Graphics Previews Common
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8CDCDD72-388E-0A2A-4847-873C448033EA}" = Catalyst Control Center Graphics Previews Vista
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{BD60F72D-3F2F-4AE1-9C41-3CF75B2CA59A}" = DVR-Studio Pro 2
"{C8D55041-A13C-4620-8DF4-9C5A9C16908D}" = G Data TotalCare
"{DC3F66CA-9DFD-41EA-9D9E-FD86F1446A3D}" = Catalyst Control Center Core Implementation
"{E25BEA72-89F8-121D-5481-0347B9446673}" = ccc-core-static
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E288FAEB-D102-0ACA-DF6A-9BD3C90FA08B}" = Catalyst Control Center HydraVision Full
"{E4D35928-2C24-A87E-8240-CC7E25548F52}" = Catalyst Control Center Graphics Full Existing
"{E76CDA48-6FB1-49C5-0769-7B9444664056}" = Catalyst Control Center Graphics Light
"{EB3B36B9-E1F4-81BA-BEB5-4FB07D4CEE39}" = Catalyst Control Center InstallProxy
"{F5E0B89C-AABA-639D-B6F5-C3FB085FB120}" = CCC Help English
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.21
"Ashampoo Photo Commander 8_is1" = Ashampoo Photo Commander 8.1.0
"CCleaner" = CCleaner
"FileHippo.com" = FileHippo.com Update Checker
"Foxit Reader" = Foxit Reader
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"HijackThis" = HijackThis 2.0.2
"HitmanPro35" = Hitman Pro 3.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 3029
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 3029
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 3028
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 3058
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 7010
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 7040
Description =
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Windows Search Service | ID = 7042
Description =
Error - 07.04.2010 05:56:15 | Computer Name = Homeoffice | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3743,
Zeitstempel: 0x4bb4be02 Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.1113,
Zeitstempel: 0x4afcef8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00002ccd ID des fehlerhaften
Prozesses: 0x994 Startzeit der fehlerhaften Anwendung: 0x01cad6373cd52f00 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX Berichtskennung:
cde7576d-422b-11df-b50e-001fd05363e1
Error - 07.04.2010 06:41:03 | Computer Name = Homeoffice | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3743,
Zeitstempel: 0x4bb4be02 Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.1113,
Zeitstempel: 0x4afcef8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00002ccd ID des fehlerhaften
Prozesses: 0xc14 Startzeit der fehlerhaften Anwendung: 0x01cad63cc5611489 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX Berichtskennung:
0fb19039-4232-11df-b50e-001fd05363e1
Error - 07.04.2010 13:07:55 | Computer Name = Homeoffice | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3743,
Zeitstempel: 0x4bb4be02 Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.1113,
Zeitstempel: 0x4afcef8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00002ccd ID des fehlerhaften
Prozesses: 0x838 Startzeit der fehlerhaften Anwendung: 0x01cad66d32018080 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX Berichtskennung:
1b3ef824-4268-11df-a5b9-001fd05363e1
[ System Events ]
Error - 06.04.2010 11:14:53 | Computer Name = Homeoffice | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
Fehler beendet: %%-1073473535.
Error - 06.04.2010 11:14:53 | Computer Name = Homeoffice | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
Neustart des Diensts.
Error - 06.04.2010 14:18:28 | Computer Name = Homeoffice | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Server" wurde mit folgendem Fehler beendet: %%1062
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem
Fehler beendet: %%-1073473535.
Error - 07.04.2010 03:43:17 | Computer Name = Homeoffice | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
Neustart des Diensts.
Error - 07.04.2010 13:43:40 | Computer Name = Homeoffice | Source = BTHUSB | ID = 327696
Description = Die beiderseitige Authentifizierung zwischen dem lokalen Bluetooth-Adapter
und einem Gerät mit Bluetooth-Adapteradresse (00:22:fd:94:2f:67) ist fehlgeschlagen.
< End of report >
Code:
ATTFilter OTL logfile created on: 08.04.2010 07:38:06 - Run 1 OTL by OldTimer - Version 3.2.1.0 Folder = C:\Users\NonAdmin\Downloads 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 76,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,56 Gb Total Space | 75,65 Gb Free Space | 77,54% Space Free | Partition Type: NTFS Drive D: | 97,66 Gb Total Space | 91,97 Gb Free Space | 94,18% Space Free | Partition Type: NTFS Drive E: | 270,45 Gb Total Space | 249,04 Gb Free Space | 92,08% Space Free | Partition Type: NTFS Drive F: | 166,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: HOMEOFFICE Current User Name: Michael&Diana Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\NonAdmin\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG) PRC - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG) PRC - C:\Program Files (x86)\G Data\TotalCare\AVKTray\AVKTray.exe (G Data Software AG) PRC - C:\Program Files (x86)\G Data\TotalCare\AVK\AVKService.exe (G Data Software AG) PRC - C:\Program Files (x86)\WinTV\TVServer\CaptureGenUSB.exe (Hauppauge Computer Works) PRC - C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) ========== Modules (SafeList) ========== MOD - C:\Users\NonAdmin\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (WwanSvc) -- C:\Windows\SysNative\wwansvc.dll (Microsoft Corporation) SRV:64bit: - (WbioSrvc) -- C:\Windows\SysNative\wbiosrvc.dll (Microsoft Corporation) SRV:64bit: - (Power) -- C:\Windows\SysNative\umpo.dll (Microsoft Corporation) SRV:64bit: - (Themes) -- C:\Windows\SysNative\themeservice.dll (Microsoft Corporation) SRV:64bit: - (sppuinotify) -- C:\Windows\SysNative\sppuinotify.dll (Microsoft Corporation) SRV:64bit: - (SensrSvc) -- C:\Windows\SysNative\sensrsvc.dll (Microsoft Corporation) SRV:64bit: - (PNRPsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation) SRV:64bit: - (p2pimsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation) SRV:64bit: - (HomeGroupProvider) -- C:\Windows\SysNative\provsvc.dll (Microsoft Corporation) SRV:64bit: - (RpcEptMapper) -- C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation) SRV:64bit: - (PNRPAutoReg) -- C:\Windows\SysNative\pnrpauto.dll (Microsoft Corporation) SRV:64bit: - (HomeGroupListener) -- C:\Windows\SysNative\ListSvc.dll (Microsoft Corporation) SRV:64bit: - (FontCache) -- C:\Windows\SysNative\FntCache.dll (Microsoft Corporation) SRV:64bit: - (Dhcp) -- C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation) SRV:64bit: - (defragsvc) -- C:\Windows\SysNative\defragsvc.dll (Microsoft Corporation) SRV:64bit: - (bthserv) -- C:\Windows\SysNative\bthserv.dll (Microsoft Corporation) SRV:64bit: - (BDESVC) -- C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation) SRV:64bit: - (AxInstSV) -- C:\Windows\SysNative\AxInstSv.dll (Microsoft Corporation) SRV:64bit: - (AppIDSvc) -- C:\Windows\SysNative\appidsvc.dll (Microsoft Corporation) SRV:64bit: - (wbengine) -- C:\Windows\SysNative\wbengine.exe (Microsoft Corporation) SRV:64bit: - (sppsvc) -- C:\Windows\SysNative\sppsvc.exe (Microsoft Corporation) SRV:64bit: - (Fax) -- C:\Windows\SysNative\FXSSVC.exe (Microsoft Corporation) SRV - (getPlusHelper) getPlus(R) -- C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.) SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG) SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG) SRV - (AVKWCtl) -- C:\Program Files (x86)\G Data\TotalCare\AVK\AVKWCtlX64.exe (G Data Software AG) SRV - (AVKService) -- C:\Program Files (x86)\G Data\TotalCare\AVK\AVKService.exe (G Data Software AG) SRV - (VSS) -- C:\Windows\Vss [2009.07.14 05:20:14 | 000,000,000 | ---D | M] SRV - (MSDTC) -- C:\Windows\SysWOW64\Msdtc [2009.07.14 05:20:14 | 000,000,000 | ---D | M] SRV - (HomeGroupProvider) -- C:\Windows\SysWOW64\provsvc.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation) SRV - (vds) -- C:\Windows\SysWOW64\wbem\vds.mof () SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (HauppaugeTVServer) -- C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works) SRV - (G Data Tuner Service) -- C:\Program Files (x86)\G Data\TotalCare\AVKTuner\AVKTunerService.exe (G Data Software AG) ========== Driver Services (SafeList) ========== DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software) DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G DATA Software AG) DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG) DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG) DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (KSecPkg) -- C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (hwpolicy) -- C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation) DRV:64bit: - (FsDepends) -- C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (WIMMount) -- C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation) DRV:64bit: - (vhdmp) -- C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation) DRV:64bit: - (vdrvroot) -- C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (rdyboost) -- C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation) DRV:64bit: - (pcw) -- C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation) DRV:64bit: - (CNG) -- C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation) DRV:64bit: - (fvevol) -- C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation) DRV:64bit: - (rdpbus) -- C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation) DRV:64bit: - (RDPREFMP) -- C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation) DRV:64bit: - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation) DRV:64bit: - (WfpLwf) -- C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation) DRV:64bit: - (NdisCap) -- C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation) DRV:64bit: - (vwifibus) -- C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation) DRV:64bit: - (1394ohci) -- C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation) DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation) DRV:64bit: - (BthPan) Bluetooth-Gerät (PAN) -- C:\Windows\SysNative\drivers\bthpan.sys (Microsoft Corporation) DRV:64bit: - (BTHPORT) -- C:\Windows\SysNative\drivers\bthport.sys (Microsoft Corporation) DRV:64bit: - (RFCOMM) Bluetooth-Gerät (RFCOMM-Protokoll-TDI) -- C:\Windows\SysNative\drivers\rfcomm.sys (Microsoft Corporation) DRV:64bit: - (BthEnum) -- C:\Windows\SysNative\drivers\bthenum.sys (Microsoft Corporation) DRV:64bit: - (BTHUSB) -- C:\Windows\SysNative\drivers\BTHUSB.SYS (Microsoft Corporation) DRV:64bit: - (UmPass) -- C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation) DRV:64bit: - (mshidkmdf) -- C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation) DRV:64bit: - (WudfPf) -- C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation) DRV:64bit: - (MTConfig) -- C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation) DRV:64bit: - (CompositeBus) -- C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation) DRV:64bit: - (Beep) -- C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation) DRV:64bit: - (AppID) -- C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation) DRV:64bit: - (scfilter) -- C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation) DRV:64bit: - (discache) -- C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation) DRV:64bit: - (HidBatt) -- C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation) DRV:64bit: - (CmBatt) -- C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation) DRV:64bit: - (AcpiPmi) -- C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation) DRV:64bit: - (AmdPPM) -- C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (hcw95rc) -- C:\Windows\SysNative\drivers\hcw95rc.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (hcw95bda) -- C:\Windows\SysNative\drivers\hcw95bda.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (GearAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (NetBIOS) -- C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation) DRV - (mpsdrv) -- C:\Windows\SysWOW64\wbem\mpsdrv.mof () DRV - (Tcpip) -- C:\Windows\SysWOW64\wbem\tcpip.mof () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 07 44 A3 5F 59 A0 CA 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Ixquick - Deutsch" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.bing.com/?cc=de" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.45 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.04.06 16:45:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.04.06 17:14:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.04.06 16:46:51 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.04.06 17:14:09 | 000,000,000 | ---D | M] [2010.01.28 22:55:15 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Extensions [2010.01.28 22:55:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.04.07 11:05:56 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\b56vnmut.default\extensions [2010.01.28 22:39:35 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\b56vnmut.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.01.28 23:01:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\b56vnmut.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} [2010.04.07 11:05:57 | 000,001,595 | ---- | M] () -- C:\Users\Michael&Diana\AppData\Roaming\Mozilla\FireFox\Profiles\b56vnmut.default\searchplugins\ixquick---deutsch.xml [2010.04.07 11:14:39 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010.04.07 11:14:39 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} [2010.04.06 17:13:48 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll [2010.04.06 16:45:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.04.06 16:45:54 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.04.06 16:45:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.04.06 16:45:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.04.06 16:45:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\TotalCare\Webfilter\AVKWebIEx64.dll (G Data Software AG) O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\TotalCare\Webfilter\AVKWebIE.dll (G Data Software AG) O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\TotalCare\Webfilter\AVKWebIEx64.dll (G Data Software AG) O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\TotalCare\Webfilter\AVKWebIE.dll (G Data Software AG) O4 - HKLM..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files (x86)\G Data\TotalCare\AVKTray\AVKTray.exe (G Data Software AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysNative\wshbth.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.08 07:35:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\trend micro [2010.04.08 07:35:12 | 000,000,000 | ---D | C] -- C:\rsit [2010.04.07 11:15:23 | 000,106,224 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys [2010.04.07 11:08:37 | 000,074,184 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys [2010.04.07 11:08:18 | 000,042,952 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys [2010.04.07 11:08:08 | 000,126,312 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARASpi64.dll [2010.04.07 11:08:08 | 000,019,496 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys [2010.04.07 11:08:01 | 000,034,760 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys [2010.04.07 11:07:59 | 000,048,584 | ---- | C] (G DATA Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys [2010.04.07 11:07:46 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA [2010.04.07 11:07:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data [2010.04.07 11:07:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G DATA [2010.04.07 11:06:29 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\Downloaded Installations [2010.04.07 11:04:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010.04.07 07:41:04 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2010.04.07 07:39:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2010.04.07 07:39:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI [2010.04.06 22:10:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2010.04.06 19:48:01 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Malwarebytes [2010.04.06 19:47:55 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.04.06 19:47:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.04.06 19:47:53 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.04.06 19:47:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.04.06 19:45:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Hitman Pro [2010.04.06 19:45:31 | 000,000,000 | ---D | C] -- C:\Programme\Hitman Pro 3.5 [2010.04.06 19:44:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hitman Pro 3.5 [2010.04.06 17:36:12 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.04.06 17:30:50 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Haenlein-Software [2010.04.06 17:30:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVR-Compress [2010.04.06 17:30:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVR-Studio Pro 2 [2010.04.06 17:15:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileHippo.com [2010.04.06 17:13:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2010.04.06 17:13:24 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.04.06 17:13:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.04.06 17:13:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.04.06 17:13:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2010.04.06 17:08:03 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS [2010.04.06 17:08:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NOS [2010.04.06 16:44:42 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2010.04.06 16:41:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2010.04.06 16:41:09 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll [2010.04.06 16:41:09 | 000,422,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll [2010.04.06 16:41:09 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc.dll [2010.04.06 16:41:09 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_isv.dll [2010.04.06 16:41:09 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_isv.exe [2010.04.06 16:41:09 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate.exe [2010.04.06 16:41:09 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp.exe [2010.04.06 16:41:09 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp_isv.exe [2010.04.06 16:41:08 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_isv.exe [2010.04.06 16:41:08 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate.exe [2010.04.06 16:41:08 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp.exe [2010.04.06 16:41:08 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp_isv.exe [2010.04.06 16:41:08 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll [2010.04.06 16:41:08 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll [2010.04.06 16:41:08 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp_isv.dll [2010.04.06 16:41:08 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp.dll [2010.04.06 16:41:07 | 000,960,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll [2010.04.06 16:41:07 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll [2010.04.06 16:41:06 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll [2010.04.06 16:41:06 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll [2010.04.06 16:41:06 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2010.04.06 16:41:06 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax [2010.04.06 16:41:06 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2010.04.06 16:41:05 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2010.04.06 16:41:05 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2010.04.06 16:41:05 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2010.04.06 16:41:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2010.04.06 16:41:05 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2010.04.06 16:41:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2010.04.06 16:31:27 | 001,572,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll [2010.04.06 16:31:27 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll [2010.04.06 16:31:27 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iyuv_32.dll [2010.04.06 16:31:27 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvidc32.dll [2010.04.06 16:31:27 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msyuv.dll [2010.04.06 16:31:27 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrle32.dll [2010.04.06 16:31:26 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2010.04.06 16:31:26 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\avifil32.dll [2010.04.06 16:31:26 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mciavi32.dll [2010.04.06 16:31:26 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsbyuv.dll [2010.04.06 16:31:25 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2010.04.06 16:23:18 | 001,192,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll [2010.04.06 16:23:18 | 001,026,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstime.dll [2010.04.06 16:23:18 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstime.dll [2010.04.06 16:23:17 | 000,977,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2010.04.06 16:23:17 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll [2010.04.06 16:23:17 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iedkcs32.dll [2010.04.06 16:23:17 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll [2010.04.06 16:23:17 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll ========== Files - Modified Within 30 Days ========== [2010.04.08 07:38:57 | 000,786,432 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT [2010.04.08 07:23:14 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.08 07:23:14 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.08 07:20:24 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.04.08 07:20:24 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.04.08 07:20:24 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.04.08 07:20:24 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.04.08 07:20:24 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.04.08 07:16:10 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.04.08 07:16:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.08 07:16:02 | 3218,939,904 | -HS- | M] () -- C:\hiberfil.sys [2010.04.07 11:45:59 | 001,621,184 | -H-- | M] () -- C:\Users\Michael&Diana\AppData\Local\IconCache.db [2010.04.07 11:17:34 | 000,007,605 | ---- | M] () -- C:\Users\Michael&Diana\AppData\Local\Resmon.ResmonCfg [2010.04.07 11:15:23 | 000,106,224 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys [2010.04.07 11:13:39 | 000,048,584 | ---- | M] (G DATA Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys [2010.04.07 11:13:36 | 000,034,760 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys [2010.04.07 11:08:37 | 000,074,184 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys [2010.04.07 11:08:32 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TMContainer00000000000000000002.regtrans-ms [2010.04.07 11:08:32 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TMContainer00000000000000000001.regtrans-ms [2010.04.07 11:08:32 | 000,065,536 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TM.blf [2010.04.07 11:08:18 | 000,042,952 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys [2010.04.07 11:05:33 | 000,000,782 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100407_110531.reg [2010.04.07 07:43:00 | 000,000,156 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100407_074256.reg [2010.04.07 07:20:21 | 000,019,016 | ---- | M] () -- C:\Windows\SysNative\drivers\hitmanpro35.sys [2010.04.06 19:47:58 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.06 19:45:31 | 000,001,978 | ---- | M] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk [2010.04.06 17:35:47 | 000,001,472 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173544.reg [2010.04.06 17:35:38 | 000,000,454 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173535.reg [2010.04.06 17:35:26 | 000,033,000 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173522.reg [2010.04.06 17:17:49 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TMContainer00000000000000000002.regtrans-ms [2010.04.06 17:17:49 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TMContainer00000000000000000001.regtrans-ms [2010.04.06 17:17:49 | 000,065,536 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TM.blf [2010.04.06 17:13:18 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deploytk.dll [2010.04.06 17:13:18 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.04.06 17:13:18 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.04.06 17:13:18 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.03.30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.03.30 00:45:56 | 000,024,664 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys ========== Files Created - No Company Name ========== [2010.04.07 11:17:34 | 000,007,605 | ---- | C] () -- C:\Users\Michael&Diana\AppData\Local\Resmon.ResmonCfg [2010.04.07 11:05:32 | 000,000,782 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100407_110531.reg [2010.04.07 09:43:07 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TMContainer00000000000000000002.regtrans-ms [2010.04.07 09:43:07 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TMContainer00000000000000000001.regtrans-ms [2010.04.07 09:43:07 | 000,065,536 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{0cbd0e05-4219-11df-b8cd-001fd05363e1}.TM.blf [2010.04.07 09:42:04 | 3218,939,904 | -HS- | C] () -- C:\hiberfil.sys [2010.04.07 07:42:58 | 000,000,156 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100407_074256.reg [2010.04.06 19:47:58 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.06 19:45:39 | 000,019,016 | ---- | C] () -- C:\Windows\SysNative\drivers\hitmanpro35.sys [2010.04.06 19:44:33 | 000,001,978 | ---- | C] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk [2010.04.06 17:35:45 | 000,001,472 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173544.reg [2010.04.06 17:35:37 | 000,000,454 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173535.reg [2010.04.06 17:35:24 | 000,033,000 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100406_173522.reg [2010.04.06 17:14:31 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TMContainer00000000000000000002.regtrans-ms [2010.04.06 17:14:31 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TMContainer00000000000000000001.regtrans-ms [2010.04.06 17:14:31 | 000,065,536 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{07fd4738-418f-11df-92f3-001fd05363e1}.TM.blf [2010.01.28 23:30:18 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI [2010.01.28 23:29:25 | 000,006,245 | ---- | C] () -- C:\Windows\HCWPNP.INI [2010.01.28 23:09:08 | 000,003,584 | ---- | C] () -- C:\Users\Michael&Diana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.01.28 22:19:04 | 000,786,432 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT [2010.01.28 22:19:04 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2010.01.28 22:19:04 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2010.01.28 22:19:04 | 000,262,144 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.dat.LOG1 [2010.01.28 22:19:04 | 000,065,536 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2010.01.28 22:19:04 | 000,000,020 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.ini [2010.01.28 22:19:04 | 000,000,000 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.dat.LOG2 [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll < End of report > WW
__________________ "Inter Arma Enim Silent Leges" |
|
08.04.2010, 07:45
| #2 |
  | Kontrolle nach Imagewiederherstellung Das sieht an sich recht gut aus. Denke bitte daran alle Passworte zu aendern, denn Passworte klauen machen diese "rechnung.pdf.exe" Trojaner, oder wie man sie auch nennen moechte, als erstes.
__________________
__________________ |
|
08.04.2010, 08:15
| #3 |
| | Kontrolle nach Imagewiederherstellung Hy Ralf.
__________________Danke für die Antwort.Das hört sich ja schon mal gut an. Habe noch eine Frage: Dieses Image betrifft nur die Systempartition.Zwei andere Partitionen blieben unangetastet.Diese enthalten eigentlich nur mp3 und Bilddateien. Könnten diese auch irgendwie kompromittiert worden sein? Hier noch ein Log von Gdata: Code:
ATTFilter Virenprüfung mit G Data AntiVirus
Version 20.2.4.1 (22.12.2009)
Virensignaturen vom
Startzeit: 07.04.2010 19:54:09
Engine(s): Engine A, Engine B
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein
Prüfung der Systembereiche...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Zugriff verweigert: pagefile.sys
Pfad: C:
Zugriff verweigert: hiberfil.sys
Pfad: C:
Zugriff verweigert: EtwRTDiagLog.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: EtwRTEventLog-Application.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: EtwRTEventLog-System.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: EtwRTEventlog-Security.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: EtwRTMsMpPsSession7.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: EtwRTUBPM.etl
Pfad: C:\Windows\System32\LogFiles\WMI\RtBackup
Zugriff verweigert: edb.log
Pfad: C:\Windows\System32\catroot2
Zugriff verweigert: catdb
Pfad: C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}
Zugriff verweigert: catdb
Pfad: C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
Zugriff verweigert: NTUSER.DAT
Pfad: C:\Windows\ServiceProfiles\NetworkService
Zugriff verweigert: NTUSER.DAT.LOG1
Pfad: C:\Windows\ServiceProfiles\NetworkService
Zugriff verweigert: NTUSER.DAT.LOG2
Pfad: C:\Windows\ServiceProfiles\NetworkService
Zugriff verweigert: NTUSER.DAT
Pfad: C:\Windows\ServiceProfiles\LocalService
Zugriff verweigert: NTUSER.DAT.LOG1
Pfad: C:\Windows\ServiceProfiles\LocalService
Zugriff verweigert: NTUSER.DAT.LOG2
Pfad: C:\Windows\ServiceProfiles\LocalService
Zugriff verweigert: lastalive0.dat
Pfad: C:\Windows\ServiceProfiles\LocalService\AppData\Local
Zugriff verweigert: lastalive1.dat
Pfad: C:\Windows\ServiceProfiles\LocalService\AppData\Local
Zugriff verweigert: edb.log
Pfad: C:\Windows\security\database
Zugriff verweigert: edbtmp.log
Pfad: C:\Windows\security\database
Zugriff verweigert: secedit.sdb
Pfad: C:\Windows\security\database
Zugriff verweigert: tmp.edb
Pfad: C:\Windows\security\database
Zugriff verweigert: NTUSER.DAT
Pfad: C:\Users\NonAdmin
__________________ |
|
08.04.2010, 18:05
| #4 | |
| | Kontrolle nach ImagewiederherstellungZitat:
__________________ MfG Ralf |
|
08.04.2010, 18:20
| #5 |
| | Kontrolle nach Imagewiederherstellung Wunderbar. Dann danke ich die für deine Hilfe und wünsche noch einen schönen Abend. WW
__________________ "Inter Arma Enim Silent Leges" |
|
| Themen zu Kontrolle nach Imagewiederherstellung |
| 5 minuten, adblock, administrator, adobe, anhang ausgeführt, authentifizierung, autorun, bho, c:\windows\system32\rundll32.exe, components, error, exe, explorer, firefox 3.6.3, firefox.exe, flash player, fontcache, format, g data, hdaudio.sys, hijack, hijackthis, hitman pro, home, home premium, install.exe, internet, kaspersky, langs, location, logfile, malwarebytes' anti-malware, mozilla, mozilla thunderbird, neustart, oldtimer, otl logfile, otl.exe, plug-in, programdata, realtek, registry, rundll, saver, searchplugins, security, server, shell32.dll, shortcut, software, syswow64, ups, webcheck, windows |
Linear-Darstellung
