| |
| |||||||
Log-Analyse und Auswertung: HiJackThis Log wegen Werbeseiten-ProblemWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.06.2010, 08:18
| #1 |
| |  HiJackThis Log wegen Werbeseiten-Problem Hallo! Ich habe folgendes Problem: Wenn ich mit Firefox im Internet bin öffnen sich in unregelmäßigen Abständen und meistens wenn ich selber auf eine andere Seite gehe oder einen Link betätige völlig neue Fenster von Firefox im normalen Browser im Hintergrund mit Werbung. Habe HijackThis benutzt, weiß nun aber nicht weiter an was es liegen kann. Unten sind die Ergebnisse. Vielen Dank für die Hilfe! ----------------------------------------------------------------- Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\OEM04Mon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Join Air\UIExec.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE C:\Users\aaekos\AppData\Local\ljheearo.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Windows\System32\rundll32.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Windows\system32\wbem\unsecapp.exe C:\program files\mozilla firefox\firefox.exe C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\wuauclt.exe C:\program files\mozilla firefox\firefox.exe C:\Users\aaekos\Desktop\HiJackThis204.exe C:\Windows\system32\DllHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - (no file) O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s O4 - HKLM\..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking10\Ereg.ini O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [UIExec] "C:\Program Files\Join Air\UIExec.exe" O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Center Agent] C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_SB624.tmp" /EF "HKCU" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_S23F8.tmp" /EF "HKCU" O4 - HKCU\..\Run: [ljheearo] "c:\users\aaekos\appdata\local\ljheearo.exe" ljheearo O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file) O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB701\webserver\bin\win32\matlabserver.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: UGS-Lizenzserver (ugslmd) (UGS License Server (ugslmd)) - Macrovision Corporation - C:\Program Files\UGS\UGSLicensing\lmgrd.exe |
|
25.06.2010, 10:46
| #2 |
| /// Malware-holic   | HiJackThis Log wegen Werbeseiten-Problem ootl:
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt poste beide. |
|
25.06.2010, 11:07
| #3 |
| | HiJackThis Log wegen Werbeseiten-Problem Current Boot Mode: Normal
__________________Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\aaekos\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al) PRC - C:\Program Files\Join Air\UIExec.exe () PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia) PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe () PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe () PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe () PRC - C:\Program Files\UGS\UGSLicensing\ugslmd.exe () PRC - C:\Program Files\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation) PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe () PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) PRC - C:\Windows\OEM04Mon.exe (Creative Technology Ltd.) PRC - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock) PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION) PRC - C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) PRC - c:\MATLAB701\bin\win32\MATLAB.exe (The MathWorks Inc.) PRC - C:\MATLAB701\webserver\bin\win32\matlabserver.exe () ========== Modules (SafeList) ========== MOD - C:\Users\aaekos\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.) SRV - (UGS License Server (ugslmd)) UGS-Lizenzserver (ugslmd) -- C:\Program Files\UGS\UGSLicensing\lmgrd.exe (Macrovision Corporation) SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (EvtEng) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) SRV - (RegSrvc) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) SRV - (matlabserver) -- C:\MATLAB701\webserver\bin\win32\matlabserver.exe () ========== Driver Services (SafeList) ========== DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (Applied Networking Inc.) DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia) DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.) DRV - (TcUsb) -- C:\Windows\System32\drivers\tcusb.sys (UPEK Inc.) DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.) DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (AF15BDA) -- C:\Windows\System32\drivers\AF15BDA.sys (AfaTech ) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (OEM04Vid) -- C:\Windows\System32\drivers\OEM04Vid.sys (Creative Technology Ltd.) DRV - (OEM04Vfx) -- C:\Windows\System32\drivers\OEM04Vfx.sys (EyePower Games Pte. Ltd.) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Uim_IM) -- C:\Windows\System32\drivers\Uim_IM.sys (Paragon) DRV - (UimBus) -- C:\Windows\System32\drivers\UimBus.sys (Windows (R) 2000 DDK provider) DRV - (hotcore3) -- C:\Windows\system32\drivers\hotcore3.sys (Paragon Software Group) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC) DRV - (WINIO) -- C:\Windows\System32\winio.sys () DRV - (Sentinel) -- C:\Windows\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2 IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.16 12:12:49 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.01.24 21:56:14 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\program files\Mozilla Firefox\components [2010.06.24 09:14:12 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\program files\Mozilla Firefox\plugins [2010.06.24 09:14:12 | 000,000,000 | ---D | M] [2009.11.20 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla\Extensions [2010.06.24 21:19:28 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla\Firefox\Profiles\edqcq0xz.default\extensions [2010.06.19 01:17:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\aaekos\AppData\Roaming\Mozilla\Firefox\Profiles\edqcq0xz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.04.20 13:55:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009.06.09 10:32:57 | 000,000,000 | ---D | M] (Kwinzy) -- C:\Program Files\Mozilla Firefox\extensions\{52EF0988-5232-4465-86E7-6434B5891030} [2010.04.20 13:55:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2009.11.20 18:35:49 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2006.07.31 17:07:16 | 000,098,304 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll [2010.02.19 01:14:56 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.02.19 01:14:56 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2009.06.09 10:32:57 | 000,002,381 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\kwinzy119.xml [2010.02.19 01:14:56 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.02.19 01:14:56 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.02.19 01:14:56 | 000,000,801 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found. O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [DNS7reminder] C:\Program Files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [OEM04Mon.exe] C:\Windows\OEM04Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [UIExec] C:\Program Files\Join Air\UIExec.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [Center Agent] C:\Program Files\X-TENSIONS Multimedia\HyperMediaCenter\DTVR\Scheduled.exe () O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [EPSON Stylus DX4400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock) O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O24 - Desktop BackupWallPaper: C:\Users\aaekos\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{13942303-f159-11de-bd4a-fa1b4c8f428d}\Shell\AutoRun\command - "" = G:\SamsungSoftware\APPInst.exe -- File not found O33 - MountPoints2\{19e54bfb-a11b-11dd-b4df-0015c585e7eb}\Shell - "" = AutoRun O33 - MountPoints2\{19e54bfb-a11b-11dd-b4df-0015c585e7eb}\Shell\AutoRun\command - "" = F:\Setup.EXE -- File not found O33 - MountPoints2\{5bf939fc-bbde-11dd-a0ae-0015c585e7eb}\Shell - "" = AutoRun O33 - MountPoints2\{5bf939fc-bbde-11dd-a0ae-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found O33 - MountPoints2\{5bf939fd-bbde-11dd-a0ae-0015c585e7eb}\Shell - "" = AutoRun O33 - MountPoints2\{5bf939fd-bbde-11dd-a0ae-0015c585e7eb}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{afa272ba-b726-11dd-8c0e-0015c585e7eb}\Shell - "" = AutoRun O33 - MountPoints2\{afa272ba-b726-11dd-8c0e-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found O33 - MountPoints2\{afa272d9-b726-11dd-8c0e-0015c585e7eb}\Shell - "" = AutoRun O33 - MountPoints2\{afa272d9-b726-11dd-8c0e-0015c585e7eb}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found O33 - MountPoints2\{e9502098-70d4-11df-968e-f8e81ad8a133}\Shell - "" = AutoRun O33 - MountPoints2\{e9502098-70d4-11df-968e-f8e81ad8a133}\Shell\AutoRun\command - "" = F:\Install.exe -- File not found O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\SamsungSoftware\APPInst.exe -- File not found O33 - MountPoints2\I\Shell - "" = AutoRun O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2009.03.25 15:16:34 | 000,000,000 | ---D | M] NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: SENTINEL - C:\Windows\System32\snti386.dll (Rainbow Technologies, Inc.) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.lsgc - C:\Windows\System32\lsgc.dll (imc AG) Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.06.25 11:47:35 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\aaekos\Desktop\OTL.exe [2010.06.25 08:51:14 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\aaekos\Desktop\HiJackThis204.exe [2010.06.24 09:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2010.06.24 09:32:58 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2010.06.22 18:48:55 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Desktop\France [2010.06.21 08:54:53 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Desktop\Juni 2010.2 Soul jazz [2010.06.20 21:54:33 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml4a.dll [2010.06.19 01:17:38 | 000,000,000 | ---D | C] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers [2010.06.19 01:17:31 | 000,000,000 | ---D | C] -- C:\Users\aaekos\Documents\DVDVideoSoft [2010.06.16 12:44:02 | 000,544,768 | ---- | C] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe [2010.06.06 01:04:12 | 000,000,000 | ---D | C] -- C:\Users\aaekos\{6833305a-8ce8-4b9b-95c8-b377aaa82491} [2010.06.06 01:02:13 | 000,110,080 | ---- | C] (ZTE Corporation) -- C:\Windows\System32\drivers\ZTEusbnet.sys [2010.06.06 01:02:13 | 000,105,344 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbnmea.sys [2010.06.06 01:02:13 | 000,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbser6k.sys [2010.06.06 01:02:13 | 000,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys [2010.06.06 01:02:13 | 000,009,728 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\massfilter.sys [2010.06.06 01:01:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\SupportAppCB [2010.06.06 01:01:58 | 000,000,000 | ---D | C] -- C:\Program Files\Join Air [2009.06.16 14:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.06.25 11:52:57 | 004,718,592 | -HS- | M] () -- C:\Users\aaekos\ntuser.dat [2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat [2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat [2010.06.25 11:47:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\aaekos\Desktop\OTL.exe [2010.06.25 11:44:56 | 000,700,548 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.06.25 11:44:56 | 000,591,872 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.06.25 11:44:56 | 000,105,752 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.06.25 11:41:08 | 000,079,478 | ---- | M] () -- C:\Users\aaekos\AppData\Roaming\nvModes.001 [2010.06.25 11:40:55 | 000,000,092 | ---- | M] () -- C:\Users\aaekos\AppData\Local\wwswc.bat [2010.06.25 11:39:49 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job [2010.06.25 11:38:39 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.06.25 11:38:38 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.06.25 11:38:36 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.06.25 11:38:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.06.25 11:38:26 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys [2010.06.25 10:14:20 | 000,001,660 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.06.25 10:14:17 | 000,524,288 | -HS- | M] () -- C:\Users\aaekos\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2010.06.25 10:14:17 | 000,065,536 | -HS- | M] () -- C:\Users\aaekos\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.06.25 10:14:08 | 003,600,358 | -H-- | M] () -- C:\Users\aaekos\AppData\Local\IconCache.db [2010.06.25 08:51:18 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\aaekos\Desktop\HiJackThis204.exe [2010.06.24 23:16:04 | 001,408,590 | ---- | M] () -- C:\Users\aaekos\Desktop\IMGP0158.JPG [2010.06.24 13:17:41 | 001,175,460 | ---- | M] () -- C:\Users\aaekos\Desktop\Ausgew_hlte_Konzepte_PDP_2010_7406653.pdf [2010.06.24 12:22:25 | 000,021,858 | ---- | M] () -- C:\Users\aaekos\Desktop\Materialeigenschaften_PA_66.pdf [2010.06.24 09:33:02 | 000,001,081 | ---- | M] () -- C:\Users\aaekos\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk [2010.06.24 09:26:26 | 000,020,568 | ---- | M] () -- C:\Users\aaekos\Desktop\Schichtplan_Jubi_Rosenhöhe_Stand 24.06.10.pdf [2010.06.23 16:09:21 | 000,066,955 | ---- | M] () -- C:\Users\aaekos\Desktop\t_567_1.pdf [2010.06.23 13:24:51 | 000,026,897 | ---- | M] () -- C:\Users\aaekos\Desktop\gsm.mdl [2010.06.19 12:11:18 | 000,005,190 | -HS- | M] () -- C:\Users\aaekos\Desktop\Folder.jpg [2010.06.19 12:11:18 | 000,001,795 | -HS- | M] () -- C:\Users\aaekos\Desktop\AlbumArtSmall.jpg [2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat [2010.06.16 17:12:48 | 000,219,136 | ---- | M] () -- C:\Users\aaekos\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe [2010.06.08 18:45:19 | 011,040,765 | ---- | M] () -- C:\Users\aaekos\Desktop\Daimler%20Rettungskarten%2004_2010_de.pdf [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.06.24 23:16:20 | 001,408,590 | ---- | C] () -- C:\Users\aaekos\Desktop\IMGP0158.JPG [2010.06.24 13:17:40 | 001,175,460 | ---- | C] () -- C:\Users\aaekos\Desktop\Ausgew_hlte_Konzepte_PDP_2010_7406653.pdf [2010.06.24 12:22:25 | 000,021,858 | ---- | C] () -- C:\Users\aaekos\Desktop\Materialeigenschaften_PA_66.pdf [2010.06.24 09:33:02 | 000,001,081 | ---- | C] () -- C:\Users\aaekos\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk [2010.06.24 09:26:26 | 000,020,568 | ---- | C] () -- C:\Users\aaekos\Desktop\Schichtplan_Jubi_Rosenhöhe_Stand 24.06.10.pdf [2010.06.23 16:09:21 | 000,066,955 | ---- | C] () -- C:\Users\aaekos\Desktop\t_567_1.pdf [2010.06.23 10:07:13 | 000,026,897 | ---- | C] () -- C:\Users\aaekos\Desktop\gsm.mdl [2010.06.16 12:44:02 | 000,243,202 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat [2010.06.16 12:44:02 | 000,005,030 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat [2010.06.16 12:44:02 | 000,003,421 | ---- | C] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat [2010.06.08 18:45:19 | 011,040,765 | ---- | C] () -- C:\Users\aaekos\Desktop\Daimler%20Rettungskarten%2004_2010_de.pdf [2009.06.16 14:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll [2009.03.22 19:32:26 | 000,013,120 | ---- | C] () -- C:\Windows\System32\drivers\UimFIO.sys [2009.03.22 19:32:21 | 004,244,992 | ---- | C] () -- C:\Windows\System32\qtp-mt334.dll [2009.03.22 19:32:21 | 000,247,808 | ---- | C] () -- C:\Windows\System32\prgiso.dll [2009.03.22 19:32:21 | 000,013,824 | ---- | C] () -- C:\Windows\System32\wnaspi32.dll [2009.03.13 15:27:41 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009.03.13 15:27:41 | 000,383,238 | ---- | C] () -- C:\Windows\System32\libmp3lame-0.dll [2008.10.29 14:19:59 | 000,041,324 | ---- | C] () -- C:\Windows\System32\winio.sys [2008.10.29 14:19:54 | 000,000,157 | ---- | C] () -- C:\Windows\matlab.ini [2008.10.23 18:11:46 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI [2008.10.17 09:48:32 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2008.10.17 09:42:32 | 000,000,025 | ---- | C] () -- C:\Windows\CDE DX7400DEFGIPS.ini [2008.09.03 16:20:39 | 000,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys [2008.09.01 13:57:11 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini [2008.08.31 18:36:46 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2008.04.17 09:08:56 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll [2007.10.08 14:21:46 | 000,958,464 | ---- | C] () -- C:\Windows\System32\WLIHVUI.dll [2007.03.29 23:00:40 | 000,203,264 | ---- | C] () -- C:\Windows\System32\CddbCdda.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2005.05.06 20:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2003.01.07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI ========== LOP Check ========== [2010.06.19 01:17:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers [2009.02.11 16:46:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\EPSON [2009.01.11 22:21:56 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQ [2008.08.31 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQLite [2009.02.26 00:09:36 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Micrografx [2009.01.05 15:26:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nokia [2009.04.06 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nuance [2008.10.12 05:24:06 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\OpenOffice.org [2009.01.05 15:25:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PC Suite [2009.10.09 12:06:46 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PlayFirst [2009.09.23 20:35:52 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\uTorrent [2008.10.01 20:53:19 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\X-TENSIONS Multimedia [2010.06.25 11:39:49 | 000,000,416 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job [2010.06.25 10:14:20 | 000,032,600 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.05.04 18:06:59 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Adobe [2008.12.20 00:57:55 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Apple Computer [2008.09.03 16:19:30 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Corel [2008.09.01 11:00:32 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Creative [2009.06.09 10:24:10 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Digsby [2008.11.21 01:45:58 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DivX [2010.06.19 01:17:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\DVDVideoSoftIEHelpers [2009.02.11 16:46:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\EPSON [2008.08.31 18:39:34 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Hamachi [2009.01.11 22:21:56 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQ [2008.08.31 18:40:12 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\ICQLite [2008.08.31 18:12:55 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Identities [2008.08.31 22:58:38 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\InstallShield [2008.08.31 23:42:22 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Intel [2008.08.31 23:49:11 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Macromedia [2008.10.29 14:19:44 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\MathWorks [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Media Center Programs [2009.02.26 00:09:36 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Micrografx [2010.05.12 20:24:28 | 000,000,000 | --SD | M] -- C:\Users\aaekos\AppData\Roaming\Microsoft [2009.11.20 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Mozilla [2008.08.31 18:56:43 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nero [2009.01.05 15:26:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nokia [2009.04.06 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Nuance [2008.10.12 05:24:06 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\OpenOffice.org [2009.01.05 15:25:07 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PC Suite [2009.10.09 12:06:46 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\PlayFirst [2008.12.16 12:13:53 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Real [2010.04.16 00:45:50 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\Skype [2010.04.16 00:45:04 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\skypePM [2009.09.23 20:35:52 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\uTorrent [2008.08.31 18:51:58 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\WinRAR [2008.10.01 20:53:19 | 000,000,000 | ---D | M] -- C:\Users\aaekos\AppData\Roaming\X-TENSIONS Multimedia < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys [2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys [2007.02.21 21:49:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys [2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008.09.02 10:27:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [1999.10.02 12:24:46 | 000,017,408 | ---- | M] () MD5=1363337A5301619F00F8033835EF30E9 -- C:\MATLAB701\sys\perl\win32\site\lib\auto\Win32\EventLog\EventLog.dll < MD5 for: IASTOR.SYS > [2007.04.26 07:23:58 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Drivers\storage\R154200\iastor.sys < MD5 for: IASTORV.SYS > [2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll [2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys [2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys [2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvstor.inf_f48b8337\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll [2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll < MD5 for: USERINIT.EXE > [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe < MD5 for: WS2IFSL.SYS > [2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys [2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2008.10.23 17:55:13 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.01.19 09:38:03 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2008.01.19 09:36:10 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:24051EFF @Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\words:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\projekte:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\movies:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\aktuelles:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\aaekos\Documents\Aktien:Roxio EMC Stream @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:1A60DE96 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F35A93AD < End of report > |
|
25.06.2010, 11:52
| #4 |
| /// Malware-holic | HiJackThis Log wegen Werbeseiten-Problem hör bitte auf die köpfe der logs weg zu lassen, poste das komplett! spybot kann unsere arbeit stören, deinstaliere es, starte neu. Fixen mit OTL • Starte bitte die OTL.exe. Vista-User mit Rechtsklick "als Administrator starten" • Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found. O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found. O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al) [2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat [2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat [2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat [2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe :Files C:\Users\aaekos\AppData\Local\ljheearo.exe :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument dieses posten |
|
25.06.2010, 12:11
| #5 |
| | HiJackThis Log wegen Werbeseiten-Problem All processes killed Error: Unable to interpret <PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context! Error: Unable to interpret <O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.> in the current context! Error: Unable to interpret <O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.> in the current context! Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat> in the current context! Error: Unable to interpret <[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat> in the current context! Error: Unable to interpret <[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat> in the current context! Error: Unable to interpret <[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe> in the current context! ========== FILES ========== File\Folder C:\Users\aaekos\AppData\Local\ljheearo.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: aaekos ->Flash cache emptied: 0 bytes User: All Users User: Default User: Default User User: Guest User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: aaekos ->Temp folder emptied: 1418621 bytes ->Java cache emptied: 51816413 bytes ->FireFox cache emptied: 33085966 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes User: Guest ->Temp folder emptied: 55835 bytes ->FireFox cache emptied: 3000492 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 20326619 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 105,00 mb OTL by OldTimer - Version 3.2.7.0 log created on 06252010_130650 Files\Folders moved on Reboot... C:\Windows\temp\hsperfdata_AAEKOS-PC$\2204 moved successfully. File\Folder C:\Windows\temp\TMP0000003076F9B4DDD137D18B not found! Registry entries deleted on Reboot... |
|
25.06.2010, 12:55
| #6 |
| /// Malware-holic | HiJackThis Log wegen Werbeseiten-Problem kannst du noch mal das neue otl script probieren: :OTL PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found. O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found. O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al) O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al) [2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat [2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat [2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat [2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe :Files :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] |
|
25.06.2010, 13:11
| #7 |
| | HiJackThis Log wegen Werbeseiten-Problem All processes killed Error: Unable to interpret <PRC - C:\Users\aaekos\AppData\Local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.> in the current context! Error: Unable to interpret <O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found.> in the current context! Error: Unable to interpret <O3 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.> in the current context! Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <O4 - HKU\S-1-5-21-1010361158-786125660-3080747173-1000..\Run: [ljheearo] c:\users\aaekos\appdata\local\ljheearo.exe (al)> in the current context! Error: Unable to interpret <[2010.06.25 11:52:43 | 000,003,421 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo.dat> in the current context! Error: Unable to interpret <[2010.06.25 11:52:33 | 000,005,030 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_navps.dat> in the current context! Error: Unable to interpret <[2010.06.17 14:44:54 | 000,243,202 | ---- | M] () -- C:\Users\aaekos\AppData\Local\ljheearo_nav.dat> in the current context! Error: Unable to interpret <[2010.06.16 12:44:02 | 000,544,768 | ---- | M] (al) -- C:\Users\aaekos\AppData\Local\ljheearo.exe> in the current context! ========== FILES ========== ========== COMMANDS ========== [EMPTYFLASH] User: aaekos ->Flash cache emptied: 405 bytes User: All Users User: Default User: Default User User: Guest User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: aaekos ->Temp folder emptied: 1418794 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 21549254 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes User: Guest ->Temp folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes RecycleBin emptied: 399045 bytes Total Files Cleaned = 22,00 mb OTL by OldTimer - Version 3.2.7.0 log created on 06252010_140144 Files\Folders moved on Reboot... File\Folder C:\Windows\temp\hsperfdata_AAEKOS-PC$\1360 not found! Registry entries deleted on Reboot... |
|
25.06.2010, 13:23
| #8 |
| /// Malware-holic | HiJackThis Log wegen Werbeseiten-Problem downloade dir navilog1.exe Navilog1 - Accueil führe das programm aus. wähle e für englisch und dann den automatik modus aus, programm erstellt ein log, das posten. |
|
| Themen zu HiJackThis Log wegen Werbeseiten-Problem |
| adobe, bho, browser, converter, defender, desktop, dll, excel, firefox, hijack, hijackthis, internet, internet explorer, mozilla, mp3, pdf, plug-in, problem, programdata, registry, rundll, server, software, system, temp, windows |
Linear-Darstellung
