| |
| |||||||
Log-Analyse und Auswertung: Bitte um logfile AuswertungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
21.11.2010, 14:21
| #1 |
| |  Bitte um logfile Auswertung Hallo liebe Gemeinde Könnte sich ein Spezi sich bitte mal mein logfile anschauen? Avira hat einige Funde angezeigt, z.Z. läuft er noch.... Explizit hab ich das Gefühl dass mein neu installierte Programm 'backburner' evtl. korupt ist, ebenso 'seachster', die ist zur IE Startseite mutiert  Vielen Dank im vorraus für eure Hilfe, chris Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:55:24, on 21.11.2010 Platform: Windows 7 (WinNT 6.00.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16671) Boot mode: Normal Running processes: C:\Program Files (x86)\Nikon\PictureProject\NkbMonitor.exe C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\QuickTime\qttask.exe C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe C:\Program Files (x86)\Verbindungsassistent\Verbindungsassistent.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Autodesk\3ds Max 2011\3dsmax.exe C:\Program Files (x86)\Autodesk\Backburner\manager.exe C:\Program Files (x86)\Autodesk\Backburner\monitor.exe C:\Program Files (x86)\Opera\opera.exe C:\Users\chrissiADMIN\Downloads\HiJackThis204.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchster.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\Searchster.Net\MinBHO.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: SignatureManagerBHO - {C6CC9344-BC12-4EA7-9E37-46D61866C771} - C:\Program Files (x86)\SM\SubsHelperBHO.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Searchster.Net - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\Searchster.Net\Searchster.Net.dll O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" O4 - Startup: DCIM - Verknüpfung.lnk = ? O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files (x86)\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O9 - Extra button: (no name) - {755B05A7-0770-4185-B5F6-E75A2CA527E2} - C:\Program Files (x86)\SM\SubsHelper.dll O9 - Extra 'Tools' menuitem: Signature Manager options - {755B05A7-0770-4185-B5F6-E75A2CA527E2} - C:\Program Files (x86)\SM\SubsHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{A557F4F9-5B2F-4AB6-A3B6-2E34D5AD00B1}: NameServer = 212.23.97.3 212.23.97.2 O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit (mi-raysat_3dsmax2011_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: WTGService - Unknown owner - C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe O23 - Service: WTService - Unknown owner - C:\Windows\System32\atwtusb.exe (file missing) -- End of file - 9276 bytes |
|
21.11.2010, 15:30
| #2 | |||
  | Bitte um logfile Auswertung Hallo
__________________Zitat:
Zitat:
Zitat:
?Erstelle nach dem Antivirscan bitte ein OTL Log und poste es hierher, dann sehen wir weiter. MFG
__________________ |
|
21.11.2010, 16:32
| #3 | |
| | Bitte um logfile Auswertung Hallo und Danke das du dich der Sache annimmst
__________________Kann ich die logs auch verspoilern? Würde nicht ganz so lang werden.... Zitat:
Backburner hab ich sehr neu auf dem Rechner Zuletzt noch das gewünschte OTL log OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.11.2010 16:07:04 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\chrissiADMIN\Documents 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 34,00% Memory free 7,00 Gb Paging File | 5,00 Gb Available in Paging File | 64,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 285,30 Gb Total Space | 136,08 Gb Free Space | 47,70% Space Free | Partition Type: NTFS Drive E: | 6,34 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 100,00 Mb Total Space | 70,35 Mb Free Space | 70,35% Space Free | Partition Type: NTFS Computer Name: CHRISSIADMIN-PC | User Name: chrissiADMIN | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\chrissiADMIN\Documents\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10k_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe () PRC - C:\Program Files (x86)\Verbindungsassistent\Verbindungsassistent.exe (WebToGo Mobile Internet GmbH) PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software) PRC - C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Autodesk\3ds Max 2011\3dsmax.exe (Autodesk, Inc.) PRC - C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.) PRC - C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) PRC - C:\Program Files (x86)\Autodesk\Backburner\manager.exe (Autodesk, Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\chrissiADMIN\Documents\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (WTService) -- C:\Windows\SysNative\atwtusb.exe () SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Akamai) -- c:\program files (x86)\common files\akamai\netsession_win_4176eef.dll () SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (WTGService) -- C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe () SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (mi-raysat_3dsmax2011_32) -- C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe () SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software) DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\walvhid.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (moufiltr) -- C:\Windows\SysNative\drivers\moufiltr.sys (Windows (R) Codename Longhorn DDK provider) DRV - (hwdatacard) -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchster.net/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A9 14 F9 6B 99 70 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2010.10.02 11:28:27 | 000,002,719 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 sams.nikonimaging.com O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 3dns.adobe.com O1 - Hosts: 127.0.0.1 3dns-1.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-5.adobe.com O1 - Hosts: 127.0.0.1 hh-software.com O1 - Hosts: 36 more lines... O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll (SimplyGen) O2 - BHO: (ShowBarObj Class) - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\Searchster.Net\MinBHO.dll () O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (SignatureManagerBHO) - {C6CC9344-BC12-4EA7-9E37-46D61866C771} - C:\Program Files (x86)\SM\SubsHelperBHO.dll (SM Technologies) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Searchster.Net) - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\Searchster.Net\Searchster.Net.dll (Searchster.Net Company) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [] File not found O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [MacroKeyManager] C:\Windows\SysNative\WTMKM.exe () O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation) O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - Startup: C:\Users\chrissiADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCIM - Verknüpfung.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra 'Tools' menuitem : Signature Manager options - {755B05A7-0770-4185-B5F6-E75A2CA527E2} - C:\Program Files (x86)\SM\SubsHelper.dll (SM Technologies) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.11.17 01:39:22 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ] O32 - AutoRun File - [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2008.06.02 17:16:48 | 000,000,045 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{1e8ca56d-c41e-11df-b5b7-a69fccb42486}\Shell - "" = AutoRun O33 - MountPoints2\{1e8ca56d-c41e-11df-b5b7-a69fccb42486}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\{1e8ca58b-c41e-11df-b5b7-a69fccb42486}\Shell - "" = AutoRun O33 - MountPoints2\{1e8ca58b-c41e-11df-b5b7-a69fccb42486}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\{86c7fbea-c825-11df-b65e-f31f9a7561f2}\Shell - "" = AutoRun O33 - MountPoints2\{86c7fbea-c825-11df-b65e-f31f9a7561f2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\{86c7fc0b-c825-11df-b65e-f31f9a7561f2}\Shell - "" = AutoRun O33 - MountPoints2\{86c7fc0b-c825-11df-b65e-f31f9a7561f2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\{c2c298cf-bebe-11df-a966-fb2cd1c337f1}\Shell - "" = AutoRun O33 - MountPoints2\{c2c298cf-bebe-11df-a966-fb2cd1c337f1}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\{c2c298fd-bebe-11df-a966-fb2cd1c337f1}\Shell - "" = AutoRun O33 - MountPoints2\{c2c298fd-bebe-11df-a966-fb2cd1c337f1}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.04.24 00:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.11.21 16:05:06 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\chrissiADMIN\Documents\OTL.exe [2010.11.21 12:57:16 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\AppData\Local\backburner [2010.11.21 12:48:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Searchster.Net [2010.11.21 12:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SM [2010.11.17 02:12:17 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\3dsMax [2010.11.17 02:09:17 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\AppData\Local\Autodesk [2010.11.17 01:46:59 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\Inventor [2010.11.17 01:44:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Autodesk Shared [2010.11.17 01:43:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Autodesk [2010.11.17 01:43:47 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll [2010.11.17 01:43:47 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll [2010.11.17 01:43:47 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll [2010.11.17 01:43:47 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll [2010.11.17 01:43:47 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll [2010.11.17 01:43:47 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll [2010.11.17 01:43:46 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll [2010.11.17 01:43:46 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2010.11.17 01:43:46 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll [2010.11.17 01:43:46 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2010.11.17 01:43:45 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll [2010.11.17 01:43:45 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2010.11.17 01:43:45 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll [2010.11.17 01:43:45 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll [2010.11.17 01:43:45 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll [2010.11.17 01:43:45 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll [2010.11.17 01:43:44 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll [2010.11.17 01:43:44 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll [2010.11.17 01:43:44 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll [2010.11.17 01:43:44 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll [2010.11.17 01:43:43 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll [2010.11.17 01:43:43 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll [2010.11.17 01:43:41 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll [2010.11.17 01:43:41 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll [2010.11.17 01:40:57 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\AppData\Roaming\Autodesk [2010.11.17 01:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Autodesk [2010.11.17 01:39:22 | 000,000,000 | ---D | C] -- C:\Autodesk [2010.11.15 21:30:23 | 000,000,000 | ---D | C] -- C:\tmp [2010.11.15 19:49:16 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\para.xvid [2010.11.15 19:48:02 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\Inception.DVDRiP.LD.German.iNTERNAL.XViD-Pleaders [2010.11.15 19:47:41 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\Neil_Diamond-Dreams-2010-DOH [2010.11.15 19:43:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KeePass Password Safe [2010.11.15 19:37:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PWGen [2010.11.10 23:42:16 | 000,000,000 | R--D | C] -- C:\Users\chrissiADMIN\Documents\Scanned Documents [2010.11.10 23:42:16 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Documents\Fax [2010.11.10 23:38:10 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Desktop\gulli modeGodMode.{ED7BA470-8E54-465E-825C-99712043E01C} [2010.11.10 14:38:48 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\AppData\Local\Microsoft Games [2010.11.07 15:51:29 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Desktop\para.xvid [2010.11.07 11:26:06 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\Desktop\Gulli wallpaper [2010.11.07 10:50:35 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gdiplus.dll [2010.11.07 10:50:35 | 001,060,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71.dll [2010.11.07 10:50:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Power Presenter RE II [2010.11.07 10:46:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free Notes & Office Ink [2010.11.07 10:43:26 | 000,007,680 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\drivers\moufiltr.sys [2010.11.07 10:43:14 | 000,007,552 | ---- | C] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\walvhid.sys [2010.11.07 10:43:13 | 000,000,000 | ---D | C] -- C:\Windows\vhid [2010.11.07 10:43:05 | 000,000,000 | ---D | C] -- C:\Windows\udtablet [2010.11.07 10:42:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Tablet [2010.11.07 10:42:49 | 000,000,000 | ---D | C] -- C:\Windows\calib_da [2010.10.30 18:18:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2010.10.30 00:51:12 | 000,653,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mp4sdecd.dll.bak [2010.10.30 00:51:12 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfds.dll.bak [2010.10.30 00:51:12 | 000,223,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mp43decd.dll.bak [2010.10.30 00:51:12 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mp3dmod.dll.bak [2010.10.30 00:51:11 | 002,643,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll.bak [2010.10.30 00:51:11 | 001,307,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2adec.dll.bak [2010.10.30 00:48:15 | 000,839,680 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\Windows\SysWow64\lameACM.acm [2010.10.30 00:48:15 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2010.10.30 00:48:15 | 000,151,552 | ---- | C] (fccHandler) -- C:\Windows\SysWow64\ac3acm.acm [2010.10.30 00:48:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\K-Lite Codec Pack [2010.10.30 00:41:17 | 015,307,067 | ---- | C] ( ) -- C:\Users\chrissiADMIN\Desktop\K-Lite_Codec_Pack_640_Full.exe [2010.10.27 17:12:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared [2010.10.27 17:11:55 | 000,024,416 | R--- | C] (Adobe Systems Inc.) -- C:\Windows\SysNative\AdobePDFUI.dll [2010.10.27 17:08:46 | 000,052,568 | R--- | C] (Adobe Systems Inc) -- C:\Windows\SysNative\AdobePDF.dll [2010.10.27 16:06:03 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll [2010.10.27 16:06:03 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll [2010.10.27 16:06:03 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll [2010.10.27 16:06:03 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax [2010.10.27 16:06:03 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax [2010.10.27 16:06:03 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2010.10.27 16:06:03 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2010.10.27 16:04:46 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys [2010.10.26 19:10:38 | 000,000,000 | ---D | C] -- C:\Users\chrissiADMIN\AppData\Local\ElevatedDiagnostics [2010.10.22 16:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDex [2010.09.24 18:02:36 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\chrissiADMIN\AppData\Roaming\pcouffin.sys ========== Files - Modified Within 30 Days ========== [2010.11.21 16:03:24 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\chrissiADMIN\Documents\OTL.exe [2010.11.20 22:03:01 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.11.20 22:03:01 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.11.20 22:03:01 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.11.20 22:03:01 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.11.20 22:03:01 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.11.20 15:29:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.11.20 00:54:23 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.11.20 00:54:23 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.11.20 00:46:46 | 2960,523,264 | -HS- | M] () -- C:\hiberfil.sys [2010.11.17 01:46:34 | 000,002,067 | ---- | M] () -- C:\Users\Public\Desktop\Autodesk 3ds Max 2011 32-bit.lnk [2010.11.15 21:04:51 | 000,001,053 | ---- | M] () -- C:\Users\chrissiADMIN\Desktop\blender - Verknüpfung.lnk [2010.11.15 19:43:38 | 000,001,056 | ---- | M] () -- C:\Users\chrissiADMIN\Desktop\KeePass.lnk [2010.11.15 19:37:09 | 000,000,960 | ---- | M] () -- C:\Users\Public\Desktop\PWGen.lnk [2010.11.12 01:10:23 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLbx.DAT [2010.11.07 10:50:38 | 000,001,063 | ---- | M] () -- C:\Users\Public\Desktop\Power Presenter RE II.lnk [2010.11.07 10:46:28 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\Office Ink.lnk [2010.11.07 10:46:28 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\Free Notes.lnk [2010.11.05 00:56:22 | 000,081,584 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.10.30 00:43:48 | 015,307,067 | ---- | M] ( ) -- C:\Users\chrissiADMIN\Desktop\K-Lite_Codec_Pack_640_Full.exe [2010.10.28 05:42:39 | 004,844,672 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.10.24 17:48:16 | 021,877,344 | ---- | M] () -- C:\Users\chrissiADMIN\Documents\Adobe Photoshop Tutorial HD - Creating a ChalkBoard Teil 1-3 - Leslie Nayibe.flv [2010.10.23 09:34:28 | 000,000,546 | ---- | M] () -- C:\Users\chrissiADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCIM - Verknüpfung.lnk [2010.10.22 18:45:30 | 000,001,630 | ---- | M] () -- C:\Users\chrissiADMIN\Desktop\07StefanWaggershausenEndloserSommer.html [2010.10.22 18:45:29 | 004,617,709 | ---- | M] () -- C:\Users\chrissiADMIN\Desktop\07StefanWaggershausenEndloserSommer.flv ========== Files Created - No Company Name ========== [2010.11.17 01:46:34 | 000,002,067 | ---- | C] () -- C:\Users\Public\Desktop\Autodesk 3ds Max 2011 32-bit.lnk [2010.11.15 21:04:51 | 000,001,053 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\blender - Verknüpfung.lnk [2010.11.15 19:43:38 | 000,001,056 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\KeePass.lnk [2010.11.15 19:37:09 | 000,000,960 | ---- | C] () -- C:\Users\Public\Desktop\PWGen.lnk [2010.11.07 10:50:38 | 000,001,063 | ---- | C] () -- C:\Users\Public\Desktop\Power Presenter RE II.lnk [2010.11.07 10:46:28 | 000,000,808 | ---- | C] () -- C:\Users\Public\Desktop\Office Ink.lnk [2010.11.07 10:46:28 | 000,000,808 | ---- | C] () -- C:\Users\Public\Desktop\Free Notes.lnk [2010.11.07 10:43:11 | 000,010,251 | ---- | C] () -- C:\Windows\SysNative\Default_2.ini [2010.11.07 10:43:11 | 000,009,868 | ---- | C] () -- C:\Windows\SysNative\Default_1.ini [2010.11.07 10:43:11 | 000,000,653 | ---- | C] () -- C:\Windows\SysNative\MKProfile.ini [2010.11.07 10:43:06 | 002,772,543 | R--- | C] () -- C:\Windows\help.pdf [2010.11.07 10:42:49 | 000,008,229 | ---- | C] () -- C:\Windows\aiptbl.ini [2010.10.30 00:48:17 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2010.10.30 00:48:16 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2010.10.30 00:48:15 | 000,790,528 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2010.10.30 00:48:15 | 000,134,144 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2010.10.30 00:48:15 | 000,000,414 | ---- | C] () -- C:\Windows\SysWow64\lame_acm.xml [2010.10.30 00:48:14 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2010.10.30 00:45:01 | 000,606,208 | ---- | C] () -- C:\Windows\SysNative\CoreAAC.ax [2010.10.24 17:56:20 | 021,877,344 | ---- | C] () -- C:\Users\chrissiADMIN\Documents\Adobe Photoshop Tutorial HD - Creating a ChalkBoard Teil 1-3 - Leslie Nayibe.flv [2010.10.23 09:38:52 | 000,000,546 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCIM - Verknüpfung.lnk [2010.10.22 18:45:30 | 000,010,076 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\Skin.swf [2010.10.22 18:45:30 | 000,009,038 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\FLVPlayer.swf [2010.10.22 18:45:30 | 000,001,630 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\07StefanWaggershausenEndloserSommer.html [2010.10.22 18:45:09 | 004,617,709 | ---- | C] () -- C:\Users\chrissiADMIN\Desktop\07StefanWaggershausenEndloserSommer.flv [2010.10.19 18:25:53 | 000,000,132 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Adobe GIF Format CS5 Prefs [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Digital Mono [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Digital Light [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Digital Basic [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Dialogs [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Devices [2010.10.03 17:17:41 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Developer Tools [2010.10.03 17:17:41 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT [2010.10.03 17:17:41 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT [2010.10.03 17:17:41 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT [2010.10.03 17:17:41 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Equalizer [2010.10.03 17:17:41 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Enhance Timing [2010.10.03 17:17:41 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Electric Clav [2010.10.03 16:54:07 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Dance [2010.10.03 16:54:07 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Contents [2010.10.03 16:54:07 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLds.DAT [2010.10.03 16:54:07 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Desktop Pictures [2010.09.24 18:03:02 | 000,000,034 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\pcouffin.log [2010.09.24 18:02:36 | 000,099,384 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\inst.exe [2010.09.24 18:02:36 | 000,007,859 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\pcouffin.cat [2010.09.24 18:02:36 | 000,001,167 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\pcouffin.inf [2010.09.13 22:20:24 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Internet Plug-Ins [2010.09.13 22:20:24 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Services [2010.09.13 21:43:35 | 000,000,000 | ---- | C] () -- C:\ProgramData\Images [2010.09.13 21:43:35 | 000,000,000 | ---- | C] () -- C:\ProgramData\Components [2010.09.13 21:08:57 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Database [2010.09.13 21:08:57 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Core Data Application [2010.09.13 21:08:57 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT [2010.09.13 21:08:57 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Dictionaries [2010.09.13 20:36:49 | 000,000,268 | RH-- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\Importer [2010.09.12 23:45:49 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLbx.DAT [2010.09.12 23:30:05 | 000,000,000 | ---- | C] () -- C:\Users\chrissiADMIN\AppData\Roaming\chrtmp [2010.04.21 16:22:50 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll [2010.04.21 16:22:50 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2008.12.19 16:15:58 | 004,338,246 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll ========== LOP Check ========== [2010.10.13 21:36:21 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\AdvancedPhotoshop [2010.10.17 11:26:29 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Advanced_Photoshop [2010.11.17 02:12:17 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Autodesk [2010.09.24 16:51:52 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Desktopicon [2010.10.22 14:53:59 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\FreeFLVConverter [2010.10.19 10:07:04 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\NexusFont [2010.10.03 19:18:55 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Nikon [2010.09.13 02:19:22 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Opera [2010.10.19 17:42:46 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.10.01 23:29:10 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\VDownloader [2010.11.17 17:59:23 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Verbindungsassistent [2010.09.24 21:05:14 | 000,000,000 | ---D | M] -- C:\Users\chrissiADMIN\AppData\Roaming\Vso [2009.07.14 06:08:49 | 000,021,546 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > MfG, chris Geändert von monk3y (21.11.2010 um 16:43 Uhr) |
|
21.11.2010, 16:52
| #4 |
| | Bitte um logfile Auswertung Hallo bei Verwendung von Keygens und Cracks gibt hier am Board keine Bereinigung des Systems, nur die Empfehlung der Neuinstallation. Ändere nach der Neuinstallation oder von einem sauberen System aus alle deine Pass- und Kennwörter. Wenn du eine Sicherung deiner Daten durchführen möchtest, lass die Finger von ausführbare Dateien und Dateien aus unsicheren Quellen wie P2P. Musik, Videos, Bilder und Officedateien können i.d.R. problemlos gesichert werden, sollten aber vor dem wiederverwenden mit einem aktuellem Antivirenprogramm überprüft werden. MFG
__________________ Kein Support per PN - Bitte im Forum posten. Wenn du das Forum unterstützen möchtest Genitiv ins Wasser, weil es dativ ist   http://www.vivaconagua.org/ |
|
21.11.2010, 17:00
| #5 |
| | Bitte um logfile Auswertung Danke für die Hilfe, ich mach mal an die Arbeit. MfG |
|
| Themen zu Bitte um logfile Auswertung |
| 32-bit, adobe, antivir, antivir guard, auswertung, avg, bho, desktop, explorer, hijack, hijackthis, hängen, internet, internet explorer, logfile, logfile auswertung, lsass.exe, microsoft, neu, opera, pdf, programm, software, syswow64, updates, windows |
Linear-Darstellung
