| |
| |||||||
Log-Analyse und Auswertung: Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bitWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.12.2010, 22:52
| #1 |
| |  Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Vor kurzem Win7 installiert. Original (unsaubere Quellen dafür fallen also aus, dass die hale drin ist weiss ich). Cmd verlangsamt das system stark, kann jedoch beendet werden und kommt nich wieder bis zum neustart. Hoffe meine Logs sind i.O., falls nicht: bittebitte nicht schlagen,stelle sofort neue rein. Bin für jede Hilfe dankbar. Malwarebytes: Infizierte Dateien: c:\Windows\reset.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. (Vermutlich kalter Kafee, früherer Scan: Infizierte Dateien: c:\Windows.old\program files\Visions\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully. c:\Windows.old\program files\Visions\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.) 1 Benutzer, trotzdem für alle gescannt da ich noch ein ungenutztes profil angelegt habe mit \user auf C:\OTL Logfile: OTL EXTRAS Logfile: Code:
ATTFilter OTL logfile created on: 08.12.2010 22:23:33 - Run 2 OTL by OldTimer - Version 3.2.17.3 Folder = D:\sicher.infekt\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Country: ***** | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 37,36 Gb Total Space | 17,02 Gb Free Space | 45,56% Space Free | Partition Type: NTFS Drive D: | 195,31 Gb Total Space | 53,35 Gb Free Space | 27,32% Space Free | Partition Type: NTFS Computer Name: **** | User Name:*****| Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2010.12.08 22:03:18 | 000,575,488 | ---- | M] (OldTimer Tools) -- D:\sicher.infekt\Downloads\OTL.exe PRC - [2010.10.27 07:13:18 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.10.27 07:13:18 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\plugin-container.exe PRC - [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.07.14 02:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.07.14 02:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sppsvc.exe PRC - [2009.07.14 02:14:12 | 000,100,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe ========== Modules (SafeList) ========== MOD - [2010.12.08 22:03:18 | 000,575,488 | ---- | M] (OldTimer Tools) -- D:\sicher.infekt\Downloads\OTL.exe MOD - [2010.08.21 06:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll MOD - [2009.07.14 02:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll MOD - [2009.07.14 02:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll MOD - [2009.07.14 02:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll MOD - [2009.07.14 02:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll MOD - [2009.07.14 02:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll MOD - [2009.07.14 02:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll MOD - [2009.07.14 02:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll MOD - [2009.07.14 02:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll ========== Win32 Services (SafeList) ========== SRV - [2009.07.14 02:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc) SRV - [2009.07.14 02:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc) SRV - [2009.07.14 02:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power) SRV - [2009.07.14 02:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes) SRV - [2009.07.14 02:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify) SRV - [2009.07.14 02:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc) SRV - [2009.07.14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc) SRV - [2009.07.14 02:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider) SRV - [2009.07.14 02:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 02:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener) SRV - [2009.07.14 02:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009.07.14 02:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp) SRV - [2009.07.14 02:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc) SRV - [2009.07.14 02:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC) SRV - [2009.07.14 02:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX-Installer (AxInstSV) SRV - [2009.07.14 02:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc) SRV - [2009.07.14 02:14:30 | 000,009,216 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\regedt32.exe -- (.EsetTrialReset) SRV - [2009.07.14 02:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\sppsvc.exe -- (sppsvc) ========== Driver Services (SafeList) ========== DRV - [2010.12.07 14:11:20 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2010.03.17 01:01:53 | 011,597,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.12.11 08:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg) DRV - [2009.07.14 02:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide) DRV - [2009.07.14 02:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci) DRV - [2009.07.14 02:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx) DRV - [2009.07.14 02:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs) DRV - [2009.07.14 02:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320) DRV - [2009.07.14 02:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas) DRV - [2009.07.14 02:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata) DRV - [2009.07.14 02:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc) DRV - [2009.07.14 02:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata) DRV - [2009.07.14 02:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide) DRV - [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor) DRV - [2009.07.14 02:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid) DRV - [2009.07.14 02:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960) DRV - [2009.07.14 02:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS) DRV - [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV) DRV - [2009.07.14 02:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR) DRV - [2009.07.14 02:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI) DRV - [2009.07.14 02:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC) DRV - [2009.07.14 02:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2) DRV - [2009.07.14 02:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp) DRV - [2009.07.14 02:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas) DRV - [2009.07.14 02:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy) DRV - [2009.07.14 02:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor) DRV - [2009.07.14 02:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx) DRV - [2009.07.14 02:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD) DRV - [2009.07.14 02:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends) DRV - [2009.07.14 02:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid) DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus) DRV - [2009.07.14 02:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp) DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt) DRV - [2009.07.14 02:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot) DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount) DRV - [2009.07.14 02:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide) DRV - [2009.07.14 02:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300) DRV - [2009.07.14 02:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost) DRV - [2009.07.14 02:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx) DRV - [2009.07.14 02:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4) DRV - [2009.07.14 02:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw) DRV - [2009.07.14 02:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2) DRV - [2009.07.14 02:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor) DRV - [2009.07.14 02:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG) DRV - [2009.07.14 01:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2009.07.14 01:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus) DRV - [2009.07.14 01:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP) DRV - [2009.07.14 00:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2) DRV - [2009.07.14 00:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf) DRV - [2009.07.14 00:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap) DRV - [2009.07.14 00:52:04 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vwififlt.sys -- (vwififlt) DRV - [2009.07.14 00:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus) DRV - [2009.07.14 00:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\1394ohci.sys -- (1394ohci) DRV - [2009.07.14 00:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass) DRV - [2009.07.14 00:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf) DRV - [2009.07.14 00:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig) DRV - [2009.07.14 00:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus) DRV - [2009.07.14 00:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID) DRV - [2009.07.14 00:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter) DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap) DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.14 00:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache) DRV - [2009.07.14 00:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi) DRV - [2009.07.14 00:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM) DRV - [2009.07.13 23:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2009.07.13 23:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm) DRV - [2009.07.13 23:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer) DRV - [2009.07.13 23:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm) DRV - [2009.07.13 23:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo) DRV - [2009.07.13 23:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp) DRV - [2009.07.13 23:02:52 | 000,139,776 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rt86win7.sys -- (RTL8167) DRV - [2009.07.13 23:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x) DRV - [2009.07.13 23:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv) DRV - [2009.07.13 23:02:48 | 001,131,008 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX) DRV - [2009.07.13 23:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv) DRV - [2009.02.17 18:11:30 | 000,024,232 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV - [2007.02.16 01:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C 89 18 57 8B 95 CB 01 [binary data] IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\S-1-5-21-2482665182-1041115505-3392647256-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.06 23:12:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.07 14:33:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.12.06 23:12:43 | 000,000,000 | ---D | M] -- D:\Users\Marcus\AppData\Roaming\Mozilla\Extensions [2010.12.08 07:44:43 | 000,000,000 | ---D | M] -- D:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pvz2faws.default\extensions [2010.12.06 23:28:47 | 000,000,000 | ---D | M] (WOT) -- D:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pvz2faws.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2010.12.06 23:28:47 | 000,000,000 | ---D | M] (Adblock Plus) -- D:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\pvz2faws.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.12.06 23:28:47 | 000,000,000 | ---D | M] (No name found) -- D:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pvz2faws.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} [2010.12.07 11:48:24 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.12.07 08:56:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.12.07 08:56:29 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.12.07 11:51:33 | 000,001,021 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 ar.atwola.com O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O2 - BHO: (PDFXChange 4.0 IE Plugin) - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Programme\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (PDFXChange 4.0 IE Plugin) - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Programme\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware) O4 - HKLM..\Run: [Chew7Hale] C:\Windows\System32\hale.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a1f9d154-0203-11e0-afd8-0021709b6132}\Shell - "" = AutoRun O33 - MountPoints2\{a1f9d154-0203-11e0-afd8-0021709b6132}\Shell\AutoRun\command - "" = F:\SETUP.EXE -- File not found O33 - MountPoints2\{a1f9d154-0203-11e0-afd8-0021709b6132}\Shell\configure\command - "" = F:\SETUP.EXE -- File not found O33 - MountPoints2\{a1f9d154-0203-11e0-afd8-0021709b6132}\Shell\install\command - "" = F:\SETUP.EXE -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.12.08 19:50:47 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Roaming\Malwarebytes [2010.12.08 19:50:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.12.08 19:50:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.12.08 19:50:30 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.12.08 19:50:30 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.12.07 21:34:03 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio [2010.12.07 21:34:03 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DESIGNER [2010.12.07 14:46:37 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010.12.07 14:38:11 | 000,032,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msonpmon.dll [2010.12.07 14:33:14 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Works [2010.12.07 14:29:29 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.12.07 14:29:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET [2010.12.07 14:24:56 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 8 [2010.12.07 14:23:05 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Local\Microsoft Help [2010.12.07 14:23:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.12.07 14:23:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2010.12.07 14:10:40 | 000,000,000 | ---D | C] -- D:\Users\******\AppData\Roaming\DAEMON Tools Lite [2010.12.07 12:05:00 | 000,000,000 | ---D | C] -- D:\sicher.infekt\Documents\GUILD WARS [2010.12.07 12:00:30 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite [2010.12.07 11:55:51 | 000,000,000 | ---D | C] -- C:\ProgramData\SlySoft [2010.12.07 11:51:11 | 000,000,000 | ---D | C] -- C:\Programme\ICQ-Banner-Remover [2010.12.07 11:48:20 | 000,000,000 | -H-D | C] -- C:\Programme\InstallShield Installation Information [2010.12.07 11:48:19 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ [2010.12.07 11:47:04 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Local\AOL [2010.12.07 09:02:21 | 000,055,576 | ---- | C] (Tracker Software Products Ltd.) -- C:\Windows\System32\pxc40pm.dll [2010.12.07 09:02:13 | 000,000,000 | ---D | C] -- C:\Programme\Tracker Software [2010.12.07 08:56:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.12.07 08:56:50 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.12.07 08:56:40 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.12.07 08:56:40 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.12.07 08:56:40 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.12.07 08:56:40 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.12.07 08:56:27 | 000,000,000 | ---D | C] -- C:\Programme\Java [2010.12.07 08:41:43 | 000,000,000 | ---D | C] -- C:\Programme\Freeware PDF Unlocker [2010.12.07 00:35:16 | 000,000,000 | ---D | C] -- D:\Users\****\AppData\Roaming\smc [2010.12.07 00:01:57 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET [2010.12.06 23:12:34 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Roaming\Mozilla [2010.12.06 23:12:34 | 000,000,000 | ---D | C] -- D:\Users\******\AppData\Local\Mozilla [2010.12.06 23:12:28 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2010.12.06 23:03:29 | 000,000,000 | ---D | C] -- D:\Users\******\AppData\Local\NeoSmart_Technologies [2010.12.06 23:01:28 | 000,000,000 | ---D | C] -- D:\Users\****\AppData\Roaming\foobar2000 [2010.12.06 22:35:38 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Roaming\Macromedia [2010.12.06 22:35:38 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Roaming\Adobe [2010.12.06 22:35:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed [2010.12.06 22:24:27 | 000,000,000 | ---D | C] -- D:\Users\****\AppData\Roaming\WinRAR [2010.12.06 22:24:15 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR [2010.12.06 22:21:31 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe [2010.12.06 22:21:31 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll [2010.12.06 22:21:31 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll [2010.12.06 22:11:19 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys [2010.12.06 22:10:14 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.12.06 22:10:14 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.12.06 22:10:10 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.12.06 22:10:00 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.12.06 22:10:00 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.12.06 22:09:59 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.12.06 22:09:59 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.12.06 22:09:58 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.12.06 22:09:58 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.12.06 22:09:56 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.12.06 22:09:56 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.12.06 22:09:56 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.12.06 22:09:56 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.12.06 22:09:55 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.12.06 22:09:45 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CertEnroll.dll [2010.12.06 22:09:44 | 000,507,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe [2010.12.06 22:09:44 | 000,442,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe [2010.12.06 22:09:29 | 000,197,632 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\ir32_32.dll [2010.12.06 22:09:29 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll [2010.12.06 22:09:21 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll [2010.12.06 22:09:21 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll [2010.12.06 22:09:18 | 001,037,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll [2010.12.06 22:09:17 | 000,133,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ksecpkg.sys [2010.12.06 22:09:05 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2010.12.06 22:09:02 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2010.12.06 22:09:02 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll [2010.12.06 22:09:02 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll [2010.12.06 22:09:01 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2010.12.06 22:08:49 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010.12.06 22:08:48 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.12.06 22:08:41 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll [2010.12.06 22:08:40 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2010.12.06 22:08:36 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll [2010.12.06 22:08:35 | 000,363,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\StructuredQuery.dll [2010.12.06 22:08:33 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2010.12.06 22:08:33 | 000,427,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.12.06 22:07:46 | 000,000,000 | ---D | C] -- D:\sicher.infekt\Documents\Studium [2010.12.06 22:06:53 | 000,000,000 | ---D | C] -- D:\sicher.infekt\Documents\Grün [2010.12.06 22:06:41 | 000,000,000 | ---D | C] -- D:\sicher.infekt\Documents\PU [2010.12.06 21:59:48 | 000,000,000 | R--D | C] -- D:\Users\****\Searches [2010.12.06 21:59:40 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Roaming\Identities [2010.12.06 21:59:38 | 000,000,000 | R--D | C] -- D:\Users\*******\Contacts [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\******\Vorlagen [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\****\AppData\Local\Verlauf [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\*******\AppData\Local\Temporary Internet Files [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\Hans\Startmenü [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\Hans\SendTo [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\*****\Recent [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\****\Netzwerkumgebung [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\*******\Lokale Einstellungen [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\sicher.infekt\Documents\Eigene Videos [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\sicher.infekt\Documents\Eigene Musik [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\******\Eigene Dateien [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\sicher.infekt\Documents\Eigene Bilder [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\******\Druckumgebung [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\******\Cookies [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\****\AppData\Local\Anwendungsdaten [2010.12.06 21:59:26 | 000,000,000 | -HSD | C] -- D:\Users\*******\Anwendungsdaten [2010.12.06 21:59:25 | 000,000,000 | --SD | C] -- D:\Users\*******\AppData\Roaming\Microsoft [2010.12.06 21:59:25 | 000,000,000 | R--D | C] -- D:\Users\Wurst\Links [2010.12.06 21:59:25 | 000,000,000 | -H-D | C] -- D:\Users\Wurst\AppData [2010.12.06 21:59:25 | 000,000,000 | ---D | C] -- D:\Users\****\AppData\Local\Temp [2010.12.06 21:59:25 | 000,000,000 | ---D | C] -- D:\Users\*****\AppData\Local\Microsoft [2010.12.06 21:59:25 | 000,000,000 | ---D | C] -- D:\Users\******\AppData\Roaming\Media Center Programs [2010.12.06 21:58:30 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.12.06 21:58:30 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010.12.06 21:58:30 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.12.06 21:46:34 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010.12.06 21:06:04 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2010.12.06 20:58:12 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2010.12.06 20:58:04 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2010.12.06 20:42:20 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2010.12.06 20:34:49 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2010.12.06 20:31:50 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2010.12.06 20:30:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2010.12.06 20:21:30 | 000,000,000 | ---D | C] -- C:\Windows.old [2010.12.05 23:16:51 | 004,513,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvwgf2um.dll [2010.12.05 23:16:51 | 000,223,848 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvumdshim.dll [2010.12.05 23:16:51 | 000,056,424 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll [2010.12.05 23:16:50 | 015,235,688 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll [2010.12.05 23:16:49 | 011,597,416 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys [2010.12.05 23:16:49 | 002,908,264 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvencodemft.dll [2010.12.05 23:16:49 | 000,316,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdecodemft.dll [2010.12.05 23:16:49 | 000,088,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvinit.dll [2010.12.05 23:16:48 | 009,393,256 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll [2010.12.05 23:16:48 | 004,029,544 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll [2010.12.05 23:16:48 | 002,647,144 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll [2010.12.05 23:16:48 | 002,009,704 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll [2010.12.05 23:16:47 | 011,647,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll [2010.12.05 23:16:47 | 001,299,048 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll [2010.12.05 23:16:47 | 000,215,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcod1910.dll [2010.12.05 23:16:47 | 000,215,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcod.dll [2010.12.05 23:16:47 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd [2010.12.05 23:16:45 | 000,795,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpinst.exe [2010.11.09 12:30:56 | 000,000,000 | ---D | C] -- D:\sicher.infekt\Documents\GuildWars1 ========== Files - Modified Within 30 Days ========== [2010.12.08 22:24:10 | 001,310,720 | -HS- | M] () -- D:\Users\*\NTUSER.DAT [2010.12.08 21:51:17 | 001,472,002 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.12.08 21:51:17 | 000,643,866 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.12.08 21:51:17 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.12.08 21:51:17 | 000,126,394 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.12.08 21:51:17 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.12.08 21:46:57 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.12.08 21:46:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.12.08 21:46:46 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys [2010.12.08 21:45:59 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.12.08 21:45:59 | 000,009,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.12.08 21:45:56 | 002,238,391 | -H-- | M] () -- D:\Users\*\AppData\Local\IconCache.db [2010.12.08 19:50:33 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.12.08 10:16:42 | 000,108,248 | ---- | M] () -- D:\Users\*\AppData\Local\GDIPFONTCACHEV1.DAT [2010.12.07 21:52:52 | 000,000,162 | -H-- | M] () -- D:\sicher.infekt\Desktop\~$minar Bindegewee.docx [2010.12.07 21:51:40 | 000,409,952 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.12.07 21:29:08 | 000,000,478 | ---- | M] () -- C:\Windows\win.ini [2010.12.07 14:19:22 | 000,000,355 | ---- | M] () -- D:\sicher.infekt\Desktop\Computer.lnk [2010.12.07 14:11:20 | 000,691,696 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys [2010.12.07 12:04:49 | 000,012,844 | ---- | M] () -- D:\sicher.infekt\Desktop\GW.lnk [2010.12.07 08:57:10 | 000,000,696 | ---- | M] () -- C:\Users\Public\Desktop\JDownloader.lnk [2010.12.07 08:56:29 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.12.07 08:56:29 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.12.07 08:56:29 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.12.07 08:56:28 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.12.06 23:32:18 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2010.12.06 23:00:53 | 000,000,698 | ---- | M] () -- C:\Users\Public\Desktop\foobar2000.lnk [2010.12.06 22:38:23 | 000,000,846 | ---- | M] () -- D:\sicher.infekt\Desktop\Eigene Bilder.lnk [2010.12.06 22:38:23 | 000,000,836 | ---- | M] () -- D:\sicher.infekt\Desktop\Eigene Videos.lnk [2010.12.06 22:38:23 | 000,000,829 | ---- | M] () -- D:\sicher.infekt\Desktop\Eigene Musik - Verknüpfung.lnk [2010.12.06 22:38:23 | 000,000,825 | ---- | M] () -- D:\sicher.infekt\Desktop\Downloads.lnk [2010.12.06 22:37:30 | 000,000,622 | ---- | M] () -- D:\sicher.infekt\Desktop\Jonas.lnk [2010.12.06 22:37:14 | 000,000,512 | ---- | M] () -- D:\sicher.infekt\Desktop\Lokaler Datenträger (D).lnk [2010.12.06 22:26:26 | 000,524,288 | -HS- | M] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms [2010.12.06 22:26:26 | 000,524,288 | -HS- | M] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms [2010.12.06 22:26:26 | 000,065,536 | -HS- | M] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf [2010.12.06 22:25:17 | 000,000,802 | ---- | M] () -- D:\sicher.infekt\Desktop\Secret Maryo Chronicles.lnk [2010.12.06 21:59:26 | 000,000,020 | -HS- | M] () -- D:\Users\*\ntuser.ini [2010.12.06 20:53:04 | 000,004,734 | ---- | M] () -- C:\Windows\System32\cwlog.dtl [2010.12.06 20:52:45 | 002,169,856 | -HS- | M] () -- C:\Windows\System32\hale.exe [2010.12.06 20:35:56 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf [2010.12.06 20:34:21 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.12.02 18:58:11 | 000,028,672 | ---- | M] () -- D:\sicher.infekt\Documents\EasyBCD Backup (12-02-2010).bcd [2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.11.16 16:07:37 | 000,016,569 | ---- | M] () -- D:\sicher.infekt\Documents\Finanzreport_Nr.10_vom_01.11.2010416732.pdf [2010.11.16 16:07:31 | 000,017,946 | ---- | M] () -- D:\sicher.infekt\Documents\Finanzreport_Nr.09_vom_01.10.2010191149.pdf ========== Files Created - No Company Name ========== [2010.12.08 19:50:33 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.12.07 21:52:52 | 000,000,162 | -H-- | C] () -- D:\sicher.infekt\Desktop\~$minar Bindegewee.docx [2010.12.07 14:19:22 | 000,000,355 | ---- | C] () -- D:\sicher.infekt\Desktop\Computer.lnk [2010.12.07 14:11:20 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2010.12.07 12:04:49 | 000,012,844 | ---- | C] () -- D:\sicher.infekt\Desktop\GW.lnk [2010.12.07 08:57:10 | 000,000,696 | ---- | C] () -- C:\Users\Public\Desktop\JDownloader.lnk [2010.12.06 23:00:53 | 000,000,698 | ---- | C] () -- C:\Users\Public\Desktop\foobar2000.lnk [2010.12.06 22:38:23 | 000,000,846 | ---- | C] () -- D:\sicher.infekt\Desktop\Eigene Bilder.lnk [2010.12.06 22:38:23 | 000,000,836 | ---- | C] () -- D:\sicher.infekt\Desktop\Eigene Videos.lnk [2010.12.06 22:38:23 | 000,000,829 | ---- | C] () -- D:\sicher.infekt\Desktop\Eigene Musik - Verknüpfung.lnk [2010.12.06 22:38:23 | 000,000,825 | ---- | C] () -- D:\sicher.infekt\Desktop\Downloads.lnk [2010.12.06 22:37:30 | 000,000,622 | ---- | C] () -- D:\sicher.infekt\Desktop\Jonas.lnk [2010.12.06 22:37:14 | 000,000,512 | ---- | C] () -- D:\sicher.infekt\Desktop\Lokaler Datenträger (D).lnk [2010.12.06 22:26:26 | 002,238,391 | -H-- | C] () -- D:\Users\John\AppData\Local\IconCache.db [2010.12.06 22:25:17 | 000,000,802 | ---- | C] () -- D:\sicher.infekt\Desktop\Secret Maryo Chronicles.lnk [2010.12.06 22:11:02 | 000,108,248 | ---- | C] () -- D:\Users\*\AppData\Local\GDIPFONTCACHEV1.DAT [2010.12.06 21:59:26 | 000,524,288 | -HS- | C] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms [2010.12.06 21:59:26 | 000,524,288 | -HS- | C] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms [2010.12.06 21:59:26 | 000,262,144 | -HS- | C] () -- D:\Users\*\ntuser.dat.LOG2 [2010.12.06 21:59:26 | 000,262,144 | -HS- | C] () -- D:\Users\*\ntuser.dat.LOG1 [2010.12.06 21:59:26 | 000,065,536 | -HS- | C] () -- D:\Users\*\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf [2010.12.06 21:59:26 | 000,000,020 | -HS- | C] () -- D:\Users\*\ntuser.ini [2010.12.06 21:59:25 | 001,310,720 | -HS- | C] () -- D:\Users\*\NTUSER.DAT [2010.12.06 20:53:01 | 000,004,734 | ---- | C] () -- C:\Windows\System32\cwlog.dtl [2010.12.06 20:52:45 | 002,169,856 | -HS- | C] () -- C:\Windows\System32\hale.exe [2010.12.06 20:46:53 | 001,472,002 | ---- | C] () -- C:\Windows\System32\PerfStringBackup.INI [2010.12.06 20:34:21 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.12.05 23:16:49 | 000,007,772 | ---- | C] () -- C:\Windows\System32\nvinfo.pb [2010.12.02 18:58:11 | 000,028,672 | ---- | C] () -- D:\sicher.infekt\Documents\EasyBCD Backup (12-02-2010).bcd [2010.11.16 16:07:36 | 000,016,569 | ---- | C] () -- D:\sicher.infekt\Documents\Finanzreport_Nr.10_vom_01.11.2010416732.pdf [2010.11.16 16:07:31 | 000,017,946 | ---- | C] () -- D:\sicher.infekt\Documents\Finanzreport_Nr.09_vom_01.10.2010191149.pdf [2010.11.14 17:26:49 | 000,000,256 | ---- | C] () -- D:\sicher.infekt\Documents\SFR_Uebertrag_privat.pdf [2009.07.14 05:41:57 | 000,000,174 | -HS- | C] () -- C:\Programme\desktop.ini [2009.07.14 03:04:57 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini [2009.07.14 03:04:23 | 000,000,478 | ---- | C] () -- C:\Windows\win.ini [2009.07.14 03:04:23 | 000,000,219 | ---- | C] () -- C:\Windows\system.ini [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.07.13 22:40:44 | 000,027,097 | ---- | C] () -- C:\Windows\System32\country.sys [2009.07.13 22:40:43 | 000,042,809 | ---- | C] () -- C:\Windows\System32\KEY01.SYS [2009.07.13 22:40:43 | 000,042,537 | ---- | C] () -- C:\Windows\System32\KEYBOARD.SYS [2009.07.13 22:40:41 | 000,009,029 | ---- | C] () -- C:\Windows\System32\ANSI.SYS [2009.07.13 22:40:40 | 000,004,768 | ---- | C] () -- C:\Windows\System32\HIMEM.SYS [2009.07.13 22:40:39 | 000,029,274 | ---- | C] () -- C:\Windows\System32\NTDOS412.SYS [2009.07.13 22:40:35 | 000,029,370 | ---- | C] () -- C:\Windows\System32\NTDOS411.SYS [2009.07.13 22:40:31 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS404.SYS [2009.07.13 22:40:27 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS804.SYS [2009.07.13 22:40:23 | 000,027,866 | ---- | C] () -- C:\Windows\System32\NTDOS.SYS [2009.07.13 22:40:19 | 000,035,536 | ---- | C] () -- C:\Windows\System32\NTIO412.SYS [2009.07.13 22:40:17 | 000,035,776 | ---- | C] () -- C:\Windows\System32\NTIO411.SYS [2009.07.13 22:40:15 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO404.SYS [2009.07.13 22:40:13 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO804.SYS [2009.07.13 22:40:11 | 000,033,952 | ---- | C] () -- C:\Windows\System32\NTIO.SYS [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\System32\msjetoledb40.dll [2009.07.13 21:29:46 | 000,013,312 | ---- | C] () -- C:\Windows\System32\win87em.dll [2009.06.10 22:39:59 | 000,060,124 | ---- | C] () -- C:\Windows\System32\tcpmon.ini ========== LOP Check ========== [2010.12.07 14:19:16 | 000,000,000 | ---D | M] -- D:\Users\kevin1\AppData\Roaming\DAEMON Tools Lite [2010.12.07 14:42:13 | 000,000,000 | ---D | M] -- D:\Users\Frieda1\AppData\Roaming\foobar2000 [2010.12.08 19:18:33 | 000,000,000 | ---D | M] -- D:\Users\Berthold1\AppData\Roaming\smc [2009.07.14 05:53:46 | 000,005,920 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > --- --- ---OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 08.12.2010 22:23:33 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = D:\sicher.infekt\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,36 Gb Total Space | 17,02 Gb Free Space | 45,56% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 53,35 Gb Free Space | 27,32% Space Free | Partition Type: NTFS
Computer Name: **** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{010C0B4A-DC93-4BB4-893B-BDDE95355A3E}" = Freeware PDF Unlocker
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{8707686F-F61F-43AC-98A2-F219158F4424}" = PDF-XChange Pro 4.0
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CloneCD" = CloneCD
"ENTERPRISE" = Microsoft Office Enterprise 2007
"foobar2000" = foobar2000 v1.0.3
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"WinRAR archiver" = WinRAR
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2482665182-1041115505-3392647256-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Guild Wars" = GUILD WARS
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 06.12.2010 17:26:19 | Computer Name = PC | Source = EventSystem | ID = 4621
Description =
Error - 07.12.2010 09:11:07 | Computer Name = PC | Source = VSS | ID = 8194
Description =
Error - 07.12.2010 09:20:38 | Computer Name = PC | Source = VSS | ID = 8194
Description =
Error - 07.12.2010 16:26:14 | Computer Name = PC | Source = MsiInstaller | ID = 10005
Description =
Error - 07.12.2010 16:27:02 | Computer Name = PC | Source = VSS | ID = 8194
Description =
[ System Events ]
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000
Millisekunden durchgeführt: Neustart des Diensts.
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Enumeratordienst für tragbare Geräte" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 08.12.2010 04:13:07 | Computer Name = PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework"
wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen
werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 08.12.2010 04:16:08 | Computer Name = PC | Source = Service Control Manager | ID = 7034
Description = Dienst "ICQ Service" wurde unerwartet beendet. Dies ist bereits 1
Mal passiert.
Error - 08.12.2010 04:29:54 | Computer Name = PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Eset Trial Reset erreicht.
Error - 08.12.2010 04:29:54 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Eset Trial Reset" wurde aufgrund folgenden Fehlers nicht
gestartet: %%1053
Error - 08.12.2010 13:49:50 | Computer Name = PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?08.?12.?2010 um 18:48:03 unerwartet heruntergefahren.
< End of report >
Geändert von Men (08.12.2010 um 23:05 Uhr) |
|
09.12.2010, 12:04
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bitZitat:
 Wieso hast du nicht formatiert?
__________________ |
|
09.12.2010, 12:28
| #3 |
| | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Hatte mit dem alten System keine Probleme und einen aktuellen Schutz.... die zwei sachen in Win.old sind vermutlich bloß Fehlalarme (visions evtl wegen mangelnder signatur) gewesen bzw. nicht relevant da keines der beiden seit der Neuinstallation ausgeführt wurde.
__________________Habe Einige alte Programmdatein behalten um manche konfigurationen und skripte nachträglich noch übernehmen zu können. Klar, hätte man auch extern sichern können. Probleme währen bei sichern der alten Systemordner vermutlich die selben gewesen. Möchte ja jetzt bloß sichergehen dass alle trojaner von der aktuellen Installation runterkommen. Tippe bzgl. CMD auf irgend eine fehlerhafte stapelverarbeitung, die ich sicher in den Griff bekomme über eingrenzen der Startdienste. Allerdings währe da ja noch der gemeldete Trojaner vom aktuellen System. Mache mir etwas Sorgen dass sich da noch was versteckt. Kenne mich nicht so gut aus und würde evtl auch etwas offensichtliches Übersehen. Was kann man da tun? Aktueller Malwarebytes-Scan von heute schaut bisher gut aus. |
|
09.12.2010, 12:33
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Poste die Malwarebytes Logs bitte mal komplett, so ein halber Kram macht hinten und vorne einfach keinen Sinn!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
14.12.2010, 23:54
| #5 |
| | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Dankeschön fürs drüberschauen  . Habe noch ein wenig herumgedoktort. Problem gelöst:habe den Systemstart radikal ausgemistet: cmd lief vermutlich wegen einer fehlerhaft installierten unerwünschten icq-toolbar/bannerfunktion o.Ä. Amok in Endlosschleife.  Seit diese Einträge entfernt und PIDGIN als neuer Messenger drauf ist - alles wunderbar. Ein manuelles Treiberupdate der GRAKA hat zudem noch die vermehrte hitzeentwicklung seit win7 behoben. Ausgiebig mit div Produkten gescannt, sogut es nuneinmal geht, System scheint sauber, läuft gut. |
|
15.12.2010, 11:59
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Das Log von MBAM wollte ich aber trotzdem vollständig sehen.
__________________ --> Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit |
|
16.12.2010, 22:40
| #7 |
| | Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit Alles klar, da sind Sie: NR.1 Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Datenbank Version: 5273 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 08.12.2010 21:45:32 mbam-log-2010-12-08 (21-45-32).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 256526 Laufzeit: 1 Stunde(n), 37 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Windows.old\program files\Visions\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully. c:\Windows.old\program files\Visions\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully. --------------------------------------------------------------------- einer der Späteren, (C= System, den anderen log inkl. D: zum zweiten mal find ich grad nich, steht das selbe drin): Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Datenbank Version: 5273 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 09.12.2010 13:28:49 mbam-log-2010-12-09 (13-28-49).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 232111 Laufzeit: 1 Stunde(n), 27 Minute(n), 11 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) grüße |
|
| Themen zu Hohe CPU Last, Cmd.exe startet unaufgerufen bei Systemstart, Win7 32bit |
| adblock, antivirus, autorun, bho, corp./icp, cpu, defender, desktop, error, eset nod32, excel.exe, explorer, firefox, fontcache, format, helper, hohe cpu, install.exe, installation, location, logfile, media center, microsoft office word, mozilla, msiinstaller, nvlddmkm.sys, nvstor.sys, object, oldtimer, otl logfile, plug-in, port, programdata, realtek, registry, saver, scan, searchplugins, security, senden, shell32.dll, software, sptd.sys, system, tracker, trojan.dropper.pgen, webcheck, win7 cmd hohe last, windows, windows.old |
Linear-Darstellung
