| |
| |||||||
Log-Analyse und Auswertung: Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.10.2010, 16:11
| #1 |
 |  Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Hallo! Seit 2 Tagen erhalte ich immer wieder Meldungen von Norton, dass folgender Angriff erkannt wurde: HTTP Malicious Toolkit Variant Activity 13 Angreifender Computer: Mein eigener?! Agreifer-URL: bikleman.com/sex/inex.php?s=IBB@G Zieladresse: bikleman.com (80.156.86.78 80) Beschreibung des Datenverkehrs: TCP, Port 49178 Habe nun das Programm SUPERAntiSpyware mein System scannen lassen und folgenden Log erhalten: SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 10/14/2010 at 04:57 PM Application Version : 4.44.1000 Core Rules Database Version : 5682 Trace Rules Database Version: 3494 Scan type : Complete Scan Total Scan Time : 01:37:48 Memory items scanned : 795 Memory threats detected : 0 Registry items scanned : 9796 Registry threats detected : 0 File items scanned : 52369 File threats detected : 111 Adware.Tracking Cookie cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FQBFC2YY ] .doubleclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .apmebf.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .mediaplex.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .mediaplex.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .imrworldwide.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .imrworldwide.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .bs.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] track.effiliation.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adtech.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .webmasterplan.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .traffictrack.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .atdmt.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .atdmt.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .guj.122.2o7.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] track.webtrekk.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.zanox.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tracking.quisma.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] tracking.quisma.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adbrite.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .fastclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adviva.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .statcounter.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .4stats.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] www.zanox-affiliate.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .fastclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adinterax.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .adinterax.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .xiti.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .secmedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] rotator.adjuggler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] rotator.adjuggler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] track.effiliation.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.adserver01.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] adsrv.admediate.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] adsrv.admediate.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .bluestreak.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .zieltrack.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] studivz.adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .webmasterplan.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] www.etracker.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] track.adform.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] track.adform.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] .tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ] akamai.smartadserver.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] bc.youporn.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] cdn5.specificclick.net [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] content.oddcast.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] imagesrv.adition.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] media01.kyte.tv [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] objects.tremormedia.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] www.pornme.in [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] www.revenuewire.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] www.sexkiste.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ] C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[1].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[7].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[6].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[4].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[3].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[2].txt C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[5].txt mehrere Tracking Cookies. Was kann ich gegen den Hack Angriff tun? Habe in keinem Forum wirkliche Hilfen finden können. Wisst ihr, was zu tun ist? |
|
14.10.2010, 20:53
| #2 |
| /// Malwareteam   | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Schritt 2 Rootkit-Suche mit Gmer Was sind Rootkits? Wichtig: Bei jedem Rootkit-Scans soll/en:
Lade Dir Gmer von dieser Seite herunter (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Nun das Logfile in Code-Tags posten. |
|
15.10.2010, 16:03
| #3 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Hallo!
__________________ERstmal super lieben Dank für die rasche Unterstützung. Das gibt mir Hoffnung! Hier nun der neue Log:OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.10.2010 16:38:26 - Run 1 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Maike\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18975) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 73,63 Gb Free Space | 49,40% Space Free | Partition Type: NTFS Drive D: | 137,33 Gb Total Space | 136,19 Gb Free Space | 99,17% Space Free | Partition Type: NTFS Drive F: | 149,04 Gb Total Space | 148,83 Gb Free Space | 99,86% Space Free | Partition Type: NTFS Drive G: | 149,04 Gb Total Space | 148,95 Gb Free Space | 99,94% Space Free | Partition Type: NTFS Computer Name: MAIKESPC | User Name: Maike | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days ========== Processes (SafeList) ========== PRC - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe PRC - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe PRC - [2009.08.04 03:29:47 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe PRC - [2009.05.06 08:54:13 | 007,440,928 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.03.04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2009.02.21 06:08:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program files\P4G\BatteryLife.exe PRC - [2008.12.30 01:32:54 | 000,237,693 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe PRC - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe PRC - [2008.12.10 00:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe PRC - [2008.10.01 08:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe PRC - [2008.08.19 19:34:04 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe PRC - [2008.08.18 19:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe PRC - [2008.07.19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe PRC - [2008.04.01 08:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe PRC - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe PRC - [2005.07.07 00:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe ========== Modules (SafeList) ========== MOD - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe MOD - [2010.09.20 21:26:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\ASOEHOOK.DLL MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll MOD - [2009.07.12 10:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCR90.dll MOD - [2009.07.12 10:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCP90.dll MOD - [2008.01.21 04:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe -- (NIS) SRV - [2009.12.04 11:23:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009.08.04 03:03:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2009.08.04 03:03:05 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2008.12.08 17:01:58 | 000,533,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipswuio.sys -- (ipswuio) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2010.09.29 17:32:22 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101014.040\NAVEX15.SYS -- (NAVEX15) DRV - [2010.09.29 17:32:21 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101014.040\NAVENG.SYS -- (NAVENG) DRV - [2010.09.15 20:02:21 | 000,353,840 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101012.001\IDSvix86.sys -- (IDSVix86) DRV - [2010.09.01 00:57:04 | 000,692,272 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys -- (BHDrvx86) DRV - [2010.05.27 07:52:53 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2010.05.27 07:52:52 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2010.05.06 06:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS -- (SYMTDIv) DRV - [2010.04.29 07:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS -- (SymIRON) DRV - [2010.04.22 05:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS -- (SymEFA) DRV - [2010.04.22 04:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS -- (SRTSP) DRV - [2010.04.22 04:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL) DRV - [2010.02.26 02:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys -- (ccHP) DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV) DRV - [2009.12.30 15:58:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2009.12.30 15:58:16 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009.11.14 17:11:08 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2009.11.06 00:06:13 | 000,328,752 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS -- (SymDS) DRV - [2009.07.02 01:59:00 | 009,786,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.05.04 11:25:55 | 002,365,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2009.02.11 11:11:49 | 000,329,752 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2008.12.08 17:01:52 | 000,055,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr) DRV - [2008.08.11 04:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008.08.07 02:26:07 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008.07.29 00:53:46 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008.07.10 03:16:21 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio) DRV - [2008.06.25 00:55:12 | 000,047,104 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2008.06.03 08:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr) DRV - [2008.05.14 07:02:25 | 000,017,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid) DRV - [2008.05.14 07:02:23 | 000,100,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt) DRV - [2008.01.29 20:46:57 | 000,029,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwl2cap.sys -- (btwl2cap) DRV - [2008.01.21 04:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008.01.21 04:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008.01.21 04:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008.01.21 04:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008.01.21 04:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008.01.21 04:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008.01.21 04:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008.01.21 04:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008.01.21 04:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008.01.21 04:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008.01.21 04:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008.01.21 04:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008.01.21 04:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008.01.21 04:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008.01.21 04:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008.01.21 04:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008.01.21 04:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008.01.21 04:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008.01.21 04:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008.01.21 04:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007.12.19 02:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2007.12.06 12:12:47 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2007.08.11 05:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm) DRV - [2007.08.03 22:26:22 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio) DRV - [2007.07.30 20:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007.07.30 19:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2007.07.24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP) DRV - [2006.12.14 09:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor) DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006.11.02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006.11.02 09:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13" FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.29 FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.2 FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85 FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:3.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0 FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6 FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.5 FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009050101 FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.10.02 13:25:36 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010.05.26 07:24:42 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010.01.27 10:36:29 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.13 20:34:20 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.13 20:34:19 | 000,000,000 | ---D | M] [2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Extensions [2010.10.14 15:00:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions [2010.09.27 18:03:03 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2010.07.26 20:31:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.10.13 15:16:48 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\finder@meingutscheincode.de [2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Maike\AppData\Roaming\Mozilla\FireFox\Profiles\n98g2py1.default\searchplugins\conduit.xml [2010.10.02 15:26:08 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009.08.23 08:50:01 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Program Files\mozilla firefox\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [2009.09.08 12:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2009.08.23 08:50:06 | 000,000,000 | ---D | M] (Session Manager) -- C:\Program Files\mozilla firefox\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30} [2009.08.23 08:50:07 | 000,000,000 | ---D | M] (Site Launcher) -- C:\Program Files\mozilla firefox\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67} [2009.09.08 12:52:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d} [2009.08.23 08:50:04 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Program Files\mozilla firefox\extensions\{398e77b8-2304-11dc-8314-0800200c9a66} [2010.04.26 08:12:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2009.08.23 08:50:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B} [2009.08.23 08:49:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} [2009.08.23 08:50:01 | 000,000,000 | ---D | M] (FoxTab) -- C:\Program Files\mozilla firefox\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2009.08.23 08:50:02 | 000,000,000 | ---D | M] (GooglePreview) -- C:\Program Files\mozilla firefox\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6} [2009.09.08 12:52:22 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\autopager@mozilla.org [2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de [2009.08.23 08:50:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\CompactMenuCE@Merci.chao [2009.08.23 08:50:03 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\lazarus@interclue.com [2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de [2009.09.08 12:52:23 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\printpdf@pavlov.net [2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\chrome [2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\defaults [2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\chrome [2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\defaults [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2009.11.13 17:39:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2009.11.13 17:39:34 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2009.11.13 17:39:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2009.11.13 17:39:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2009.11.13 17:39:34 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe () O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG O24 - Desktop BackupWallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 90 Days ========== [2010.10.15 16:34:50 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe [2010.10.14 17:35:49 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.10.14 17:29:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\Simply Super Software [2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover [2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Simply Super Software [2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software [2010.10.14 16:59:20 | 000,000,000 | ---D | C] -- C:\Users\Maike\Logs [2010.10.14 16:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch [2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\SUPERAntiSpyware.com [2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2010.10.14 15:13:40 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2010.10.13 21:57:14 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\Audible [2010.10.13 21:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\Audible [2010.10.13 20:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2010.10.13 20:35:29 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2010.10.13 20:33:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime [2010.10.13 15:19:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer [2010.10.13 15:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\vokabeltrainer [2010.10.13 15:16:57 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit [2010.10.04 18:09:49 | 000,000,000 | ---D | C] -- C:\Program Files\Joomla [2010.09.28 16:19:25 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\FireShot [2010.09.04 14:40:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\mirko [2010.09.02 17:55:39 | 000,000,000 | ---D | C] -- C:\Users\Maike\Phone Browser [2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Apple Computer [2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple Computer [2010.09.02 17:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010.09.02 17:12:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2010.09.02 17:12:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple [2010.09.02 17:11:57 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2010.08.30 14:32:45 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\gitarre_lehre [2010.08.12 14:36:46 | 000,000,000 | ---D | C] -- C:\Users\Maike\chords [2010.08.08 13:20:01 | 000,000,000 | ---D | C] -- C:\Program Files\Ankh [2010.08.08 13:15:17 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Ankh [2010.07.17 18:37:18 | 000,000,000 | ---D | C] -- C:\Users\Maike\homepage [2010.04.02 13:40:25 | 000,454,656 | ---- | C] (Simon Tatham) -- C:\Program Files\putty06.exe [2008.06.03 08:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys ========== Files - Modified Within 90 Days ========== [2010.10.15 16:41:16 | 002,162,502 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\Cat.DB [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe [2010.10.15 16:27:13 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.10.15 16:26:28 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.10.15 16:25:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.15 16:25:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.15 16:25:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.15 16:25:20 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys [2010.10.14 19:55:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.10.14 15:13:45 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010.10.14 14:42:53 | 001,750,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.10.13 20:36:48 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2010.10.13 15:18:54 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2010.10.11 17:15:18 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.10.11 17:15:18 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.10.11 17:15:18 | 000,128,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.10.11 17:15:18 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.10.02 15:39:41 | 000,000,600 | ---- | M] () -- C:\Users\Maike\AppData\Local\PUTTY.RND [2010.09.20 23:52:57 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\isolate.ini [2010.09.17 12:04:09 | 000,014,931 | ---- | M] () -- C:\Users\Maike\Documents\finnland.xlsx [2010.09.02 18:04:11 | 000,000,019 | ---- | M] () -- C:\Windows\SoundConverter.INI [2010.08.30 09:37:05 | 002,329,923 | R--- | M] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf ========== Files Created - No Company Name ========== [2010.10.14 17:28:38 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll [2010.10.14 17:28:38 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll [2010.10.14 17:28:38 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll [2010.10.14 17:28:37 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll [2010.10.14 15:13:45 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010.10.13 20:36:48 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2010.10.13 15:18:54 | 000,000,834 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2010.09.02 18:04:11 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI [2010.08.30 09:37:05 | 002,329,923 | R--- | C] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf [2010.08.30 09:35:42 | 000,014,931 | ---- | C] () -- C:\Users\Maike\Documents\finnland.xlsx [2010.05.31 16:01:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2010.05.18 13:31:29 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2010.05.01 13:59:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.04.29 20:39:38 | 000,000,680 | ---- | C] () -- C:\Users\Maike\AppData\Local\d3d9caps.dat [2010.04.26 08:25:00 | 000,000,600 | ---- | C] () -- C:\Users\Maike\AppData\Local\PUTTY.RND [2010.01.14 14:04:26 | 000,004,096 | -H-- | C] () -- C:\Users\Maike\AppData\Local\keyfile3.drm [2009.12.30 15:58:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2009.12.30 15:58:16 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2009.11.06 17:28:02 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll [2009.10.31 12:05:11 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2009.10.27 21:13:20 | 000,008,704 | ---- | C] () -- C:\Users\Maike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.10.02 13:17:58 | 000,001,161 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2009.09.12 12:40:31 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.09.12 10:58:15 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.09.01 10:39:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2009.08.30 15:32:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.08.19 20:00:02 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini [2009.08.04 03:03:20 | 000,004,352 | ---- | C] () -- C:\Windows\System32\cfgfx.ini [2009.08.04 03:03:20 | 000,000,735 | ---- | C] () -- C:\Windows\FF05_Render_Spk_Hp.ini [2009.08.04 03:03:20 | 000,000,508 | ---- | C] () -- C:\Windows\FF05_not_Spk_Hp.ini [2009.08.04 03:02:21 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL [2009.08.04 03:02:21 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL [2008.11.08 03:08:20 | 000,362,029 | ---- | C] () -- C:\Windows\System32\sqlite3.dll [2008.08.11 04:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2008.07.30 02:33:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll [2008.05.12 05:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2003.02.20 15:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI [2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll ========== LOP Check ========== [2010.08.08 13:15:17 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ankh [2010.05.18 13:04:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Atari [2010.09.29 17:55:38 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FileZilla [2010.09.28 16:19:25 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FireShot [2010.10.14 17:28:31 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Simply Super Software [2010.04.22 16:08:11 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SmartDraw [2010.03.16 20:18:23 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SparweltGutschein [2010.04.07 18:30:51 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Tific [2009.12.30 16:02:02 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ubisoft [2010.10.14 19:55:14 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2010.05.18 13:32:43 | 000,453,006 | ---- | M] () -- C:\AnalysisLog.sr0 [2009.03.12 04:11:47 | 000,000,023 | ---- | M] () -- C:\app3.LOG [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2008.04.16 13:27:17 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2007.04.04 21:01:54 | 000,000,019 | ---- | M] () -- C:\CA21.txt [2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2010.07.21 12:34:25 | 000,286,720 | ---- | M] () -- C:\Debug.txt [2009.08.04 03:45:04 | 000,019,994 | ---- | M] () -- C:\devlist.txt [2009.06.23 08:28:11 | 000,000,027 | ---- | M] () -- C:\Driver.20 [2009.08.03 13:48:21 | 000,000,769 | ---- | M] () -- C:\faclog.txt [2009.08.04 03:41:42 | 000,000,009 | ---- | M] () -- C:\Finish.log [2009.06.07 17:31:15 | 000,000,021 | ---- | M] () -- C:\Fix.log [2009.05.27 08:02:07 | 001,048,576 | RH-- | M] () -- C:\G60VxAS.BIN [2010.10.15 16:25:20 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys [2009.08.04 03:37:50 | 001,546,580 | ---- | M] () -- C:\if.log [2009.08.04 02:27:34 | 000,000,481 | ---- | M] () -- C:\igoogle_log.txt [2009.08.04 02:58:55 | 022,216,704 | ---- | M] () -- C:\inject.log [2009.08.04 02:58:55 | 019,533,351 | ---- | M] () -- C:\inject.log.txt [2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2008.08.08 09:22:19 | 000,000,030 | ---- | M] () -- C:\NERO.LOG [2009.01.07 11:16:08 | 000,000,030 | ---- | M] () -- C:\NIS2009.TXT [2007.03.16 01:18:45 | 000,000,025 | ---- | M] () -- C:\OFFICE2007_A.TXT [2010.10.15 16:25:18 | 3533,873,152 | -HS- | M] () -- C:\pagefile.sys [2009.08.03 14:34:44 | 000,000,146 | ---- | M] () -- C:\Pass.txt [2009.06.19 14:10:05 | 000,003,502 | ---- | M] () -- C:\Patch.LOG [2009.01.15 10:13:21 | 000,000,017 | ---- | M] () -- C:\READER_A.TXT [2009.03.31 05:04:29 | 000,000,022 | ---- | M] () -- C:\RECOVERY.DAT [2009.08.04 03:02:22 | 000,001,783 | ---- | M] () -- C:\RHDSetup.log [2010.07.21 12:36:42 | 000,000,166 | ---- | M] () -- C:\setup.log [2006.05.14 18:22:24 | 000,000,005 | ---- | M] () -- C:\store.log [2009.08.04 02:17:16 | 000,000,170 | ---- | M] () -- C:\SumHidd.txt [2009.08.04 02:16:22 | 000,000,098 | ---- | M] () -- C:\SumOS.txt [2010.07.01 15:27:15 | 000,002,433 | ---- | M] () -- C:\test.spr [2009.06.02 13:11:40 | 000,000,024 | ---- | M] () -- C:\v55.txt [2009.02.09 07:30:41 | 000,000,041 | ---- | M] () -- C:\WindowsLive_A.TXT < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2009.08.30 15:38:25 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2006.11.02 11:46:03 | 000,070,144 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNBPP3.DLL [2008.10.28 12:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp696.dll [2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll [2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll [2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > [2008.12.05 00:19:40 | 000,308,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2008.01.21 04:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini [2010.04.02 13:40:46 | 000,454,656 | ---- | M] (Simon Tatham) -- C:\Program Files\putty06.exe < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\user32.dll /md5 > [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll < MD5 for: EXPLORER.EXE > [2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2009.08.04 02:45:44 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2009.08.04 02:45:44 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: WININIT.EXE > [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-13 20:58:23 < End of report > |
|
15.10.2010, 17:05
| #4 |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Und wo bleibt der Rest?  |
|
16.10.2010, 11:57
| #5 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" HIer der Rest - Sorry - musste gestern noch schnell weg... <code> GMER Logfile: Code:
ATTFilter GMER 1.0.15.15315 - hxxp://www.gmer.net
Rootkit scan 2010-10-16 12:48:13
Windows 6.0.6002 Service Pack 2
Running: 9gni6flu.exe; Driver: C:\Users\Maike\AppData\Local\Temp\kxlcypoc.sys
---- System - GMER 1.0.15 ----
SSDT 93745108 ZwAlertResumeThread
SSDT 9373E118 ZwAlertThread
SSDT 93AA08C0 ZwAllocateVirtualMemory
SSDT 89180C68 ZwAlpcConnectPort
SSDT 937AD120 ZwAssignProcessToJobObject
SSDT 93AB0B00 ZwCreateMutant
SSDT 93AB5D78 ZwCreateSymbolicLinkObject
SSDT 93A9EA90 ZwCreateThread
SSDT 937A0068 ZwDebugActiveProcess
SSDT 93AA0A98 ZwDuplicateObject
SSDT 93AA02A0 ZwFreeVirtualMemory
SSDT 93750068 ZwImpersonateAnonymousToken
SSDT 9374B068 ZwImpersonateThread
SSDT 891FDA48 ZwLoadDriver
SSDT 93AA0180 ZwMapViewOfSection
SSDT 9374F128 ZwOpenEvent
SSDT 93AA0CF8 ZwOpenProcess
SSDT 90FDA120 ZwOpenProcessToken
SSDT 9378F118 ZwOpenSection
SSDT 93AA0BA8 ZwOpenThread
SSDT 93AB4A78 ZwProtectVirtualMemory
SSDT 931FDE00 ZwResumeThread
SSDT 90FE7578 ZwSetContextThread
SSDT 93AA1EB8 ZwSetInformationProcess
SSDT 9379E110 ZwSetSystemInformation
SSDT 93789120 ZwSuspendProcess
SSDT 931F9068 ZwSuspendThread
SSDT 90FCDEC8 ZwTerminateProcess
SSDT 91BF8110 ZwTerminateThread
SSDT 90FE63A8 ZwUnmapViewOfSection
SSDT 93AA05B0 ZwWriteVirtualMemory
SSDT 93AB4258 ZwCreateThreadEx
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 11D 828EB880 8 Bytes [08, 51, 74, 93, 18, E1, 73, ...] {OR [ECX+0x74], DL; XCHG EBX, EAX; SBB CL, AH; JAE 0xffffffffffffff9b}
.text ntkrnlpa.exe!KeSetEvent + 131 828EB894 4 Bytes [C0, 08, AA, 93] {ROR BYTE [EAX], 0xaa; XCHG EBX, EAX}
.text ntkrnlpa.exe!KeSetEvent + 13D 828EB8A0 4 Bytes [68, 0C, 18, 89]
.text ntkrnlpa.exe!KeSetEvent + 191 828EB8F4 4 Bytes [20, D1, 7A, 93] {AND CL, DL; JP 0xffffffffffffff97}
.text ntkrnlpa.exe!KeSetEvent + 1F5 828EB958 4 Bytes [00, 0B, AB, 93] {ADD [EBX], CL; STOSD ; XCHG EBX, EAX}
.text ...
.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0xA68F3300, 0x3B6D8, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0xA6939300, 0x1BEE, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\firefox.exe[3332] ntdll.dll!RtlEncodeSystemPointer + 873 76E1938B 10 Bytes JMP 011E003A
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add@001370ac8176 0x24 0xC7 0x7A 0x7B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add@00236cf48a41 0x95 0x25 0x9C 0xE7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add@001370ac8176 0x24 0xC7 0x7A 0x7B ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add@00236cf48a41 0x95 0x25 0x9C 0xE7 ...
---- Files - GMER 1.0.15 ----
File C:\ADSM_PData_0150 0 bytes
File C:\ADSM_PData_0150\DB 0 bytes
File C:\ADSM_PData_0150\DB\SI.db 624 bytes
File C:\ADSM_PData_0150\DB\UL.db 16 bytes
File C:\ADSM_PData_0150\DB\VL.db 16 bytes
File C:\ADSM_PData_0150\DB\WAL.db 2048 bytes
File C:\ADSM_PData_0150\DB\_avt 512 bytes
File C:\ADSM_PData_0150\DragWait.exe 315392 bytes executable
File C:\ADSM_PData_0150\_avt 512 bytes
File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86 0 bytes
File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\AsDsm.sys 29752 bytes executable
File C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\_avt 512 bytes
---- EOF - GMER 1.0.15 ----
</code> |
|
16.10.2010, 14:28
| #6 |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Schritt 1
Code:
ATTFilter :OTL
O4 - HKLM..\Run: [] File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
:commands
[emptytemp]
[purity]
Schritt 2 ESET Online Scanner Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
|
|
16.10.2010, 23:41
| #7 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Hier die beiden Logs: <code> All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Arbeit ->Temp folder emptied: 25845064 bytes ->Temporary Internet Files folder emptied: 3738960 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 137987954 bytes ->Flash cache emptied: 1081 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Maike ->Temp folder emptied: 456264862 bytes ->Temporary Internet Files folder emptied: 116774110 bytes ->Java cache emptied: 52477785 bytes ->FireFox cache emptied: 222502194 bytes ->Flash cache emptied: 3406 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 23618153 bytes RecycleBin emptied: 341052468 bytes Total Files Cleaned = 1.316,00 mb OTL by OldTimer - Version 3.2.15.2 log created on 10162010_165031 Files\Folders moved on Reboot... Registry entries deleted on Reboot... </code> <code> ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=604da2f81aceea478a84209f697855ad # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-10-16 06:28:33 # local_time=2010-10-16 08:28:33 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=3588 16777214 85 88 1750114 26822611 0 0 # compatibility_mode=5892 16776574 100 95 35601785 124775309 0 0 # compatibility_mode=8192 67108863 100 0 913 913 0 0 # scanned=243771 # found=0 # cleaned=0 # scan_time=11132 </code> |
|
17.10.2010, 19:03
| #8 |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Ich würde mir noch gerne eine zweitmeinung einholen mit einem Onlinescan: Schritt 1 Temp File Cleaner Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Schritt 2 Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
Schritt 3 Kommen von Norton noch Meldungen? |
|
18.10.2010, 14:40
| #9 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Hallo Swiss, habe ein Problembeo Kaspersky - der Download der Signaturen dauert bei mir extrem lange!!! Habe nun bereits 3 Std gedownloaded und bin immer noch bei nur 28%....Habe nun abgebrochen. Gibt es hier nicht noch eine andere Möglichkeit? Ja, die Meldung von Norton kommt nach wie vor! Grüße |
|
19.10.2010, 16:15
| #10 | |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Downloade Dir bitte RKUnhookerLE und speichere die Datei auf deinem Desktop.
Zitat:
|
|
20.10.2010, 11:44
| #11 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows Vista Version 6.0.6002 (Service Pack 2) Number of processors #2 ============================================== >Drivers ============================================== 0x8EC0C000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 9789440 bytes (NVIDIA Corporation, NVIDIA Windows Kernel Mode Driver, Version 186.31 ) 0x82801000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System) 0x82801000 PnpManager 3903488 bytes 0x82801000 RAW 3903488 bytes 0x82801000 WMIxWDM 3903488 bytes 0x90209000 C:\Windows\system32\drivers\RTKVHDA.sys 2359296 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver) 0x9FC00000 Win32k 2109440 bytes 0x9FC00000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Mehrbenutzer-Win32-Treiber) 0x92202000 C:\Windows\system32\DRIVERS\snp2uvc.sys 1753088 bytes (-, UVC Camera Streaming Driver) 0xAAE00000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101019.039\NAVEX15.SYS 1368064 bytes (Symantec Corporation, AV Engine) 0x8AE07000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT-Dateisystemtreiber) 0x8AA78000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver) 0x8AC0F000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver) 0x8FC0B000 C:\Windows\system32\DRIVERS\athr.sys 946176 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver) 0x804D2000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Codeintegritätsmodul) 0xA7603000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x920B0000 C:\Windows\System32\Drivers\dump_iaStor.sys 897024 bytes 0x82E07000 C:\Windows\system32\DRIVERS\iaStor.sys 897024 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32) 0x8AD14000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor) 0x92004000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver) 0x8FA0B000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x8FB10000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x918F3000 C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys 520192 bytes (Symantec Corporation, Common Client Hash Provider Driver) 0x80606000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic) 0x8AA07000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x80408000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library) 0x91972000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP-Protokollstapel) 0x91861000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver) 0xAAF8F000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101019.001\IDSvix86.sys 372736 bytes (Symantec Corporation, IDS Core Driver) 0x90571000 C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS 364544 bytes (Symantec Corporation, Network Dispatch Driver) 0x8F564000 C:\Windows\system32\DRIVERS\itecir.sys 360448 bytes (ITE Tech. Inc. , ITE Consumer IR Driver for eHome) 0xA76FB000 C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS 356352 bytes (Symantec Corporation, Symantec AutoProtect) 0x82F62000 C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS 352256 bytes (Symantec Corporation, Symantec Data Store) 0x8FD71000 C:\Windows\system32\DRIVERS\rixdptsk.sys 335872 bytes (REDC, RICOH XD SM Driver) 0xA6AA0000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver) 0x9FE50000 C:\Windows\System32\ATMFD.DLL 311296 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0x80738000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x900B7000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x8068F000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI-Treiber für NT) 0xA6AEE000 C:\Windows\system32\DRIVERS\atksgt.sys 274432 bytes 0x80491000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver) 0x80792000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver) 0x8FAC3000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x901A5000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x8ABAE000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem) 0xA6A27000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x8AF17000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volumeschattenkopie-Treiber) 0x9005D000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x82BBA000 ACPI_HAL 208896 bytes 0x82BBA000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x82F20000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Dateisystem-Filter-Manager) 0x900FF000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x8F5BC000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver) 0x8FB9D000 C:\Windows\system32\DRIVERS\SynTP.sys 192512 bytes (Synaptics, Inc., Synaptics Touchpad Driver) 0x90449000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x82FC2000 C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS 184320 bytes (Symantec Corporation, Symantec Extended File Attributes) 0x8AB83000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x9000E000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library) 0x921A6000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0xA6B39000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xA6A78000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x8AF67000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache) 0x806E6000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT-Plug & Play PCI-Enumerator) 0x90476000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0x905CA000 C:\Windows\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library) 0x807D3000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x8FCF2000 C:\Windows\system32\DRIVERS\Rtlh86.sys 139264 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS6 32-bit Driver ) 0x90183000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS) 0x8AF9F000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll) 0x805DB000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x904F1000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0x9015A000 C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS 126976 bytes (Symantec Corporation, Iron Driver) 0xA6A08000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x82EEA000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension) 0x918BF000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver) 0x919DF000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver) 0x8ACF9000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x9218B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA-Filtertreiber zur Dateivirtualisierung) 0x8FD32000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0x8ADC4000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x8FBCC000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xA6A60000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x918DC000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x8ABE9000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x9052D000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xAAF70000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver) 0x90131000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS-Paketplaner) 0x9055B000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver) 0x901EB000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x805C6000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0xAAF4E000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101019.039\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine) 0x805B2000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x8FD5D000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver) 0x900A3000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver) 0x8FDC3000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042-Anschlusstreiber) 0x921DA000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x90147000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0x8AF8E000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x90092000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x80478000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Plattformspezifischer Hardwarefehlertreiber) 0x8FD4C000 C:\Windows\system32\DRIVERS\rimmptsk.sys 69632 bytes (REDC, RICOH SD Driver) 0x82F52000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x904A6000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library) 0x923E8000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x80782000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager) 0x8FD14000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0x8ADEF000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver) 0x8AFEA000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver) 0x923D9000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver) 0x8AF58000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0x8070D000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver) 0x8F5EB000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x8FB01000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x80729000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver) 0x8FD24000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0x9FE40000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver) 0x90038000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome) 0x905EF000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x90544000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x82F12000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x923C2000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x923AE000 C:\Windows\system32\DRIVERS\STREAM.SYS 53248 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0) 0x90050000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x80682000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR) 0xA76EB000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x904E5000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x8FAAC000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver) 0x9049B000 C:\Windows\system32\DRIVERS\hidir.sys 45056 bytes (Microsoft Corporation, Infrared Miniport Driver for Input Devices) 0x8FDDE000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Tastaturklassentreiber) 0x8FDEB000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mausklassentreiber) 0x90522000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x8FBEF000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8FBE4000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x8AFD6000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x8FAB8000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0x82FB8000 C:\Windows\System32\Drivers\AsDsm.sys 40960 bytes (Windows (R) Codename Longhorn DDK provider, Data Security Manager Driver) 0x8071F000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver) 0x923CF000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x82F08000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver) 0x90046000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0x921D0000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x901E1000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0xA76E1000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x90179000 C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect) 0xAAF86000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver) 0x8AFC0000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver) 0x904CE000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0x904BD000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID-Tastaturfiltertreiber) 0xAAF62000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0x90552000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x9FE20000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x8AFE1000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x806D5000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x82EE2000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8FC00000 C:\Windows\system32\DRIVERS\ATKACPI.sys 32768 bytes (ATK0100, ATK0100 ACPI Utility) 0x80489000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x8FDD6000 C:\Windows\system32\DRIVERS\kbfiltr.sys 32768 bytes ( , Keyboard Filter Driver) 0x904C6000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID-Mausfiltertreiber) 0x806DE000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x90512000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x9051A000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8AF50000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x923F8000 C:\Program Files\ATKGFNEX\ASMMAP.sys 28672 bytes (-, -) 0x904DE000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x904B6000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0x80401000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0x904D7000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x923BB000 C:\Windows\system32\DRIVERS\sncduvc.SYS 28672 bytes (-, USBCAMD for Sonix UVC) 0x8FDF6000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0x90200000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS) 0xA6B34000 C:\Windows\system32\DRIVERS\lirsgt.sys 20480 bytes 0x8FDFC000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x8071C000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0xA6B31000 C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys 12288 bytes 0x8F562000 C:\Windows\system32\DRIVERS\nvBridge.kmd 8192 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 186.31 ) 0x8FC08000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x8FDE9000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) ============================================== >Stealth ============================================== |
|
20.10.2010, 12:43
| #12 |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Betreibst Du selber eine Internetseite und hast evtl auf anderen Seiten Werbebanner gesetzt? |
|
21.10.2010, 14:09
| #13 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Ja, die Internetseite www.griechen-farm.de. Aber ich betreibe keine Werbebanner auf anderen Seiten... Gruß Maike |
|
21.10.2010, 18:50
| #14 |
| /// Malwareteam | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**  
|
|
25.10.2010, 17:34
| #15 |
| | Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" Combofix Logfile: Code:
ATTFilter ComboFix 10-10-24.06 - Maike 25.10.2010 17:56:51.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.1807 [GMT 2:00]
ausgeführt von:: c:\users\Maike\Desktop\Combo-Fix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Maike\AppData\Local\TempDIR
c:\windows\system32\sqlite3.dll
.
((((((((((((((((((((((( Dateien erstellt von 2010-09-25 bis 2010-10-25 ))))))))))))))))))))))))))))))
.
2010-10-25 16:12 . 2010-10-25 16:17 -------- d-----w- c:\users\Maike\AppData\Local\temp
2010-10-25 16:12 . 2010-10-25 16:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-25 16:12 . 2010-10-25 16:12 -------- d-----w- c:\users\Arbeit\AppData\Local\temp
2010-10-18 10:24 . 2010-10-18 10:24 -------- d-----w- c:\windows\Sun
2010-10-17 11:32 . 2010-10-17 11:32 -------- d-sh--w- c:\programdata\System Restore
2010-10-16 15:07 . 2010-10-16 15:07 -------- d-----w- c:\program files\ESET
2010-10-16 14:50 . 2010-10-16 14:50 -------- d-----w- C:\_OTL
2010-10-14 15:28 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-10-14 15:28 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-10-14 15:28 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-10-14 15:28 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-10-14 15:28 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-10-14 15:28 . 2010-10-14 15:42 -------- d-----w- c:\program files\Trojan Remover
2010-10-14 15:28 . 2010-10-14 15:28 -------- d-----w- c:\users\Maike\AppData\Roaming\Simply Super Software
2010-10-14 15:28 . 2010-10-14 15:28 -------- d-----w- c:\programdata\Simply Super Software
2010-10-14 14:59 . 2010-10-20 10:43 -------- d-----w- c:\users\Maike\Logs
2010-10-14 14:41 . 2010-10-14 14:41 -------- d-----w- c:\programdata\WindowsSearch
2010-10-14 13:13 . 2010-10-14 13:13 -------- d-----w- c:\users\Maike\AppData\Roaming\SUPERAntiSpyware.com
2010-10-14 13:13 . 2010-10-14 13:13 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-10-14 13:13 . 2010-10-14 13:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-10-13 19:57 . 2010-10-13 19:57 -------- d-----w- c:\program files\Audible
2010-10-13 18:36 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-13 18:36 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-10-13 18:35 . 2010-10-13 18:35 -------- d-----w- c:\program files\iPod
2010-10-13 18:35 . 2010-10-13 18:36 -------- d-----w- c:\program files\iTunes
2010-10-13 13:23 . 2010-09-13 13:56 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-13 13:23 . 2010-09-13 13:56 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-13 13:23 . 2010-08-31 15:46 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-10-13 13:23 . 2010-08-31 15:46 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-10-13 13:23 . 2010-09-06 16:20 125952 ----a-w- c:\windows\system32\srvsvc.dll
2010-10-13 13:23 . 2010-09-06 13:45 304128 ----a-w- c:\windows\system32\drivers\srv.sys
2010-10-13 13:23 . 2010-09-06 13:45 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-13 13:23 . 2010-09-06 16:19 17920 ----a-w- c:\windows\system32\netevent.dll
2010-10-13 13:23 . 2010-09-06 13:45 145408 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-10-13 13:22 . 2010-08-10 15:53 274944 ----a-w- c:\windows\system32\schannel.dll
2010-10-13 13:19 . 2010-10-13 13:19 -------- d-----w- c:\programdata\Vokabel Trainer
2010-10-13 13:18 . 2010-10-13 13:18 -------- d-----w- c:\program files\vokabeltrainer
2010-10-13 13:16 . 2010-10-13 13:16 -------- d-----w- c:\program files\Conduit
2010-10-13 13:12 . 2010-08-31 13:27 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-10-13 13:12 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
2010-10-13 13:09 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-13 13:07 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-10-04 16:09 . 2010-10-04 16:15 -------- d-----w- c:\program files\Joomla
2010-09-29 15:26 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-29 15:26 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 14:19 . 2010-09-28 14:19 -------- d-----w- c:\users\Maike\AppData\Roaming\FireShot
2010-09-25 18:02 . 2010-09-26 09:13 -------- d-----w- c:\windows\system32\drivers\NIS\1108000.005
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 14:11 . 2010-09-17 06:06 128000 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-10 03:15 . 2010-08-10 03:15 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 03:15 . 2010-08-10 03:15 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-07-27 16:44 . 2010-07-27 16:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 16:44 . 2010-07-27 16:44 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2010-07-27 16:44 . 2010-07-27 16:44 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-07-27 16:44 . 2010-07-27 16:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-04-02 11:40 . 2010-04-02 11:40 454656 ----a-w- c:\program files\putty06.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-06 7440928]
"VolPanel"="c:\program files\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-29 237693]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-08-19 159744]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-08-04 33136]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Audible Download Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
backup=c:\windows\pss\Audible Download Manager.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-08-04 01:29 47672 ----a-w- c:\windows\AsScrProlog.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLLEntry]
2009-02-26 19:07 14848 ----a-w- c:\windows\System32\AmbRunE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-09-28 14:04 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-25 07:41 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
2010-07-05 10:49 1167296 ----a-w- c:\program files\Trojan Remover\Trjscan.exe
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-08-04 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-08-04 79360]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1108000.005\SYMDS.SYS [2009-11-05 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [2010-08-31 692272]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1108000.005\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101021.003\IDSvix86.sys [2010-10-19 353840]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1108000.005\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS [2010-05-06 339504]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-27 102448]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-12-19 54784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~3\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programme\Real Player\Netscape6\nppl3260.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprjplug.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
MSConfigStartUp-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
**************************************************************************
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien:
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'Explorer.exe'(3424)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-10-25 18:24:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-10-25 16:23
Vor Suchlauf: 9 Verzeichnis(se), 74.360.156.160 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 73.951.416.320 Bytes frei
- - End Of File - - 0A674F12552A37260CCA035983A4576E
|
|
| Themen zu Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" |
| angriff, appdata, computer, detected, erkannt, firefox, flash player, folge, forum, hack, hackangriff, log, logfile auswerten, macromedia, malicious, microsoft, mozilla, norton, port, programm, roaming, scan, superantispyware, system, tcp, toolkit variant, variant, windows |
Textbox.
.
Button.
Linear-Darstellung
