![]() |
|
Plagegeister aller Art und deren Bekämpfung: tr/dropper.gen blockiert die WebsucheWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #3 |
![]() | ![]() tr/dropper.gen blockiert die Websuche Extras
__________________OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 18.12.2010 11:52:40 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\michaela\Eigene Dateien Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.014,00 Mb Total Physical Memory | 352,00 Mb Available Physical Memory | 35,00% Memory free 1,00 Gb Paging File | 0,00 Gb Available in Paging File | 44,00% Paging File free Paging file location(s): C:\pagefile.sys 200 200 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 14,31 Gb Total Space | 5,39 Gb Free Space | 37,70% Space Free | Partition Type: NTFS Computer Name: APRICUM | User Name: michaela | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .txt [@ = txtfile] -- C:\Programme\JGsoft\EditPadPro6\EditPadPro.exe (Just Great Software) [HKEY_USERS\S-1-5-21-2050875467-2829944441-1276351408-1006\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- Reg Error: Key error. File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. txtfile [open] -- "C:\Programme\JGsoft\EditPadPro6\EditPadPro.exe" "%1" (Just Great Software) Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Programme\Google\Google Talk\googletalk.exe" = C:\Programme\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google) "C:\Programme\Dell Video Chat\DellVideoChat.exe" = C:\Programme\Dell Video Chat\DellVideoChat.exe:*:Enabled:SightSpeed -- (Dell Inc. and SightSpeed Inc.) "C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" = C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Disabled:Main program for Octoshape client -- File not found "C:\Programme\Sony Ericsson\SEMC OMSI Module\SEMC OMSI Module.exe" = C:\Programme\Sony Ericsson\SEMC OMSI Module\SEMC OMSI Module.exe:*:Enabled:SEMC OMSI Module -- () ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{065A7AFE-195D-4DFB-A4B2-A83842C0F79F}" = Wireless Select Switch "{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only) "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{34BDF3BF-AA61-42E7-8818-C16A304910FC}" = Emma Core "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{543A4F31-9590-416A-A621-42CEB4C6A694}" = Battery Meter "{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector "{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2 "{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software "{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU "{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU) "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.5 - Deutsch "{AC76BA86-7AD7-1031-7B44-A81300000003}_814" = KB408682 "{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader "{B840FAB0-0E67-4DD9-A93C-A92BA7DF9625}" = Dell Box.net Launcher "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software) "{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 1.60.13 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack "{FEF06E73-A519-4510-8CF3-B66041B91D8A}" = EMSC "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Advanced Audio FX Engine" = Advanced Audio FX Engine "Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9 "AudibleDownloadManager" = Audible Download Manager "AudibleManager" = AudibleManager "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Creative OA004" = Integrated Webcam Driver (1.00.03.0720) "Dell Video Chat" = Dell Video Chat (remove only) "Dell Webcam Central" = Dell Webcam Central "EditPad Pro 6" = JGsoft EditPad Pro 6 DE DEMO 6.4.3 "FeedReader_is1" = FeedReader "GoToAssist" = GoToAssist 8.0.0.514 "HDMI" = Intel(R) Graphics Media Accelerator Driver "InstallShield_{065A7AFE-195D-4DFB-A4B2-A83842C0F79F}" = Wireless Select Switch "InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694}" = Battery Meter "IrfanView" = IrfanView (remove only) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU "Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mobile Partner" = Mobile Partner "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "PDFCreator Toolbar" = PDFCreator Toolbar "SearchAssist" = SearchAssist "SEMC OMSI Module" = SEMC OMSI Module "Sweepi_is1" = Sweepi 5.4.00 "SynTPDeinstKey" = Dell Touchpad "Totalcmd" = Total Commander (Remove or Repair) "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9 "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 25.09.2010 07:02:10 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung acrord32.exe, Version 8.1.0.137, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x24002aa0. Error - 03.10.2010 15:11:56 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3909, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 10.10.2010 11:14:57 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3909, fehlgeschlagenes Modul npswf32.dll, Version 10.0.42.34, Fehleradresse 0x0009cd0b. Error - 10.10.2010 11:15:30 | Computer Name = APRICUM | Source = Application Error | ID = 1001 Description = Fehlerhafter Speicherbereich 2057028658. Error - 24.10.2010 08:47:28 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3937, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 25.10.2010 15:06:25 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3937, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 02.11.2010 10:58:35 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3951, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 10.12.2010 17:43:12 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3951, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 15.12.2010 01:14:03 | Computer Name = APRICUM | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3989, fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b. Error - 18.12.2010 01:59:04 | Computer Name = APRICUM | Source = crypt32 | ID = 131083 Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> ist fehlgeschlagen mit dem Fehler: Die Daten sind unzulässig. . < End of report > OTL OTL Logfile: Code:
ATTFilter OTL logfile created on: 18.12.2010 11:52:40 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\michaela\Eigene Dateien Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.014,00 Mb Total Physical Memory | 352,00 Mb Available Physical Memory | 35,00% Memory free 1,00 Gb Paging File | 0,00 Gb Available in Paging File | 44,00% Paging File free Paging file location(s): C:\pagefile.sys 200 200 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 14,31 Gb Total Space | 5,39 Gb Free Space | 37,70% Space Free | Partition Type: NTFS Computer Name: APRICUM | User Name: michaela | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\michaela\Eigene Dateien\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - c:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\Gemeinsame Dateien\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe (Sony Ericsson Mobile Communications) PRC - C:\Programme\Gemeinsame Dateien\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe (Sony Ericsson Mobile Communications) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB) PRC - C:\Programme\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe () PRC - C:\Programme\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) PRC - C:\Programme\JGsoft\EditPadPro6\EditPadPro.exe (Just Great Software) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\Wireless Select Switch\WLSS.exe (Dell) PRC - C:\Programme\Battery Meter\BTMeter.exe (Dell) PRC - C:\Programme\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\michaela\Eigene Dateien\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\BtMmHook.dll (Broadcom Corporation.) MOD - C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll () ========== Win32 Services (SafeList) ========== SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (EmmaDevMgmtSvc) -- C:\Programme\Gemeinsame Dateien\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe (Sony Ericsson Mobile Communications) SRV - (EmmaUpdMgmtSvc) -- C:\Programme\Gemeinsame Dateien\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe (Sony Ericsson Mobile Communications) SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe () SRV - (GoToAssist) -- C:\Programme\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.) SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Programme\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (UsbserFilt) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys File not found DRV - (upperdev) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys File not found DRV - (pccsmcfd) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys File not found DRV - (nmwcdc) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys File not found DRV - (nmwcd) -- C:\WINDOWS\System32\drivers\ccdcmb.sys File not found DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (ggsemc) -- C:\WINDOWS\system32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications) DRV - (ggflt) -- C:\WINDOWS\system32\drivers\ggflt.sys (Sony Ericsson Mobile Communications) DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (btwmodem) -- C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (OA004Vid) -- C:\WINDOWS\system32\drivers\OA004Vid.sys (Creative Technology Ltd.) DRV - (OA004Ufd) -- C:\WINDOWS\system32\drivers\OA004Ufd.sys (Creative Technology Ltd.) DRV - (OA004Afx) -- C:\WINDOWS\system32\drivers\OA004Afx.sys (Creative Technology Ltd.) DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation) DRV - (JMCR) -- C:\WINDOWS\system32\drivers\jmcr.sys (JMicron Technology Corp.) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (EMSC) -- C:\WINDOWS\system32\DRIVERS\EMSC.SYS () DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mavideniz.gen.tr IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3081203 IE - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledItems: toolbar@alexa.com:1.4.9 FF - prefs.js..extensions.enabledItems: {902D2C4A-457A-4EF9-AD43-7014562929FF}:0.4.5 FF - prefs.js..extensions.enabledItems: {2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}:2.1.106 FF - prefs.js..extensions.enabledItems: {a0faa0a4-f1a7-4098-9a74-21efc3a92372}:4.0.1 FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.7.3 FF - prefs.js..extensions.enabledItems: {DA3A89AB-2DCA-4a29-8FEA-3C9E79BBF113}:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: support@pdfcreator-toolbar.org:1.0 FF - prefs.js..extensions.enabledItems: {455D905A-D37C-4643-A9E2-F6FEFAA0424A}:0.8.13 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.12 14:30:32 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.12 14:30:32 | 000,000,000 | ---D | M] [2008.12.11 21:13:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Extensions [2010.12.18 08:08:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions [2010.07.25 07:41:32 | 000,000,000 | ---D | M] (Googlepedia) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{1ABADB6E-DC4B-11DA-9F70-791A9CD9513E} [2010.05.01 04:56:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.14 07:33:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} [2009.11.12 06:45:56 | 000,000,000 | ---D | M] (RefControl) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{455D905A-D37C-4643-A9E2-F6FEFAA0424A} [2009.01.01 19:05:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605} [2010.05.01 04:56:10 | 000,000,000 | ---D | M] (Context Search) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF} [2010.11.17 20:50:25 | 000,000,000 | ---D | M] (DictionarySearch) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{a0faa0a4-f1a7-4098-9a74-21efc3a92372} [2009.09.01 23:02:29 | 000,000,000 | ---D | M] (Web Developer) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2009.10.14 05:57:22 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\{DA3A89AB-2DCA-4a29-8FEA-3C9E79BBF113} [2010.05.01 04:56:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\toolbar@alexa.com [2010.12.14 20:42:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\extensions\twitternotifier@naan.net [2009.06.03 19:23:54 | 000,002,164 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla\Firefox\Profiles\ki4es5mc.default\searchplugins\bing.xml [2010.12.18 08:08:34 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.08.22 08:16:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.03.29 16:58:26 | 000,028,472 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\atgpcdec.dll [2010.03.29 16:58:27 | 000,185,216 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\atgpcext.dll [2010.03.29 16:59:45 | 000,099,200 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\ieatgpc.dll [2010.03.29 16:58:24 | 000,061,824 | ---- | M] (WebEx Communications, Inc) -- C:\Programme\Mozilla Firefox\plugins\npatgpc.dll [2010.08.22 08:15:02 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.09.26 11:08:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.26 11:08:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.26 11:08:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.26 11:08:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.26 11:08:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.12.18 06:06:38 | 000,003,448 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 94.76.227.20 www.google.com.tr O1 - Hosts: 94.76.227.20 www.google.co.uk O1 - Hosts: 94.76.227.20 www.google.ca O1 - Hosts: 94.76.227.20 www.google.com.br O1 - Hosts: 94.76.227.20 www.google.co.il O1 - Hosts: 94.76.227.20 www.google.com.ar O1 - Hosts: 94.76.227.20 www.google.com.my O1 - Hosts: 94.76.227.20 www.google.gr O1 - Hosts: 94.76.227.20 www.google.com.ph O1 - Hosts: 94.76.227.20 www.google.com.tw O1 - Hosts: 94.76.227.20 www.google.co.id O1 - Hosts: 94.76.227.20 www.google.co.in O1 - Hosts: 94.76.227.20 www.google.com.au O1 - Hosts: 94.76.227.20 www.google.ru O1 - Hosts: 94.76.227.20 www.google.co.nz O1 - Hosts: 94.76.227.20 www.google.com.pk O1 - Hosts: 94.76.227.20 www.google.dk O1 - Hosts: 94.76.227.20 www.google.pt O1 - Hosts: 94.76.227.20 www.google.es O1 - Hosts: 94.76.227.20 www.google.se O1 - Hosts: 94.76.227.20 www.google.de O1 - Hosts: 94.76.227.20 www.google.com.hk O1 - Hosts: 94.76.227.20 www.google.fr O1 - Hosts: 94.76.227.20 www.google.co.jp O1 - Hosts: 58 more lines... O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Dell\BAE\BAE.dll (Dell Inc.) O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O3 - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BTMeter] C:\Programme\Battery Meter\BTMeter.exe (Dell) O4 - HKLM..\Run: [Dell Webcam Central] C:\Programme\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [dellsupportcenter] C:\Programme\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [WLSS] C:\Programme\Wireless Select Switch\WLSS.exe (Dell) O4 - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006..\Run: [Sony Ericsson PC Companion] C:\Programme\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2050875467-2829944441-1276351408-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} hxxp://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\GoToAssist: DllName - C:\Programme\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Programme\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\michaela\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\michaela\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.04.29 17:09:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{2c44b51f-26c1-11de-80b4-001d19fd2826}\Shell - "" = AutoRun O33 - MountPoints2\{2c44b51f-26c1-11de-80b4-001d19fd2826}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2c44b51f-26c1-11de-80b4-001d19fd2826}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- File not found O33 - MountPoints2\{58c0bf43-ad19-11df-840f-0024d22ac798}\Shell\AutoRun\command - "" = D:\pccompanion\Startme.exe -- File not found O33 - MountPoints2\{58c0bf43-ad19-11df-840f-0024d22ac798}\Shell\menu1\command - "" = D:\pccompanion\Startme.exe -- File not found O33 - MountPoints2\{8d766e80-b977-11df-841a-0024d22ac798}\Shell - "" = AutoRun O33 - MountPoints2\{8d766e80-b977-11df-841a-0024d22ac798}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8d766e80-b977-11df-841a-0024d22ac798}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- File not found O33 - MountPoints2\{f23a294c-bb5c-11df-841b-0024d22ac798}\Shell - "" = AutoRun O33 - MountPoints2\{f23a294c-bb5c-11df-841b-0024d22ac798}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f23a294c-bb5c-11df-841b-0024d22ac798}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- File not found O33 - MountPoints2\{f23a294d-bb5c-11df-841b-0024d22ac798}\Shell - "" = AutoRun O33 - MountPoints2\{f23a294d-bb5c-11df-841b-0024d22ac798}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f23a294d-bb5c-11df-841b-0024d22ac798}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- File not found O33 - MountPoints2\D\Shell - "" = AutoRun O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: GoToAssist - C:\Programme\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2010.12.18 11:49:09 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\OTL.exe [2010.12.18 10:33:18 | 000,000,000 | ---D | C] -- C:\Programme\hijackthis [2010.12.18 10:30:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\hijack [2010.12.18 08:25:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Malwarebytes [2010.12.18 08:24:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.12.18 08:24:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.12.18 08:24:25 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.12.18 08:24:25 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.12.18 08:22:27 | 007,622,112 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\mbam-setup-1.50.0.0.exe [2010.12.18 08:10:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\Downloads [2010.12.18 07:59:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\JGsoft [2010.12.18 07:54:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe [2010.12.18 07:09:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2010.12.18 07:07:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Avira [2010.12.18 06:55:58 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys [2010.12.18 06:55:46 | 000,135,096 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2010.12.18 06:55:46 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010.12.18 06:55:46 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys [2010.12.18 06:55:46 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys [2010.12.18 06:55:44 | 000,000,000 | ---D | C] -- C:\Programme\Avira [2010.12.18 06:55:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira [2010.12.15 22:24:33 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys [2010.12.15 22:23:43 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe [2010.11.20 08:28:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\PCDr [2010.11.20 08:26:49 | 001,740,104 | ---- | C] (Dell Inc) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\aulauncher.exe [2010.11.18 19:12:41 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isign32.dll [2010.08.21 21:49:45 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpe17C.dll [2008.12.11 21:16:30 | 002,207,280 | ---- | C] (C. Ghisler & Co.) -- C:\Programme\tcmd704a.exe [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.12.18 11:49:11 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\OTL.exe [2010.12.18 10:33:20 | 000,002,012 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Desktop\HiJackThis.lnk [2010.12.18 08:38:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.12.18 08:38:22 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys [2010.12.18 08:22:43 | 007,622,112 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\mbam-setup-1.50.0.0.exe [2010.12.18 06:57:59 | 000,001,673 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk [2010.12.18 06:54:03 | 058,849,392 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\avira_antivir_personal_de.exe [2010.12.17 10:38:57 | 000,193,676 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\delicious-20101217.htm [2010.12.16 21:59:18 | 000,004,278 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\wklnhst.dat [2010.12.16 17:02:36 | 000,164,320 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.12.16 06:05:58 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010.12.14 20:39:06 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.12.11 15:12:53 | 000,014,336 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\liste.xlr [2010.12.05 15:03:41 | 000,025,045 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Desktop\51gcS8gxK7L._SL500_AA300_.jpg [2010.11.30 21:02:00 | 000,460,908 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.11.30 21:02:00 | 000,442,800 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.11.30 21:02:00 | 000,085,594 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.11.30 21:02:00 | 000,072,066 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.11.30 18:48:22 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2010.11.30 18:13:03 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.11.28 15:45:11 | 000,144,749 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Desktop\3B71E6B6FA.pdf [2010.11.21 19:35:09 | 000,009,572 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Desktop\10525616_xxl.jpg [2010.11.21 19:27:43 | 000,000,529 | ---- | M] () -- C:\Dokumente und Einstellungen\michaela\Desktop\Verknüpfung mit liste.lnk [2010.11.20 08:26:50 | 001,740,104 | ---- | M] (Dell Inc) -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\aulauncher.exe [2010.11.18 19:12:41 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\isign32.dll [2010.11.18 19:12:41 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isign32.dll [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.12.18 10:33:20 | 000,002,012 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Desktop\HiJackThis.lnk [2010.12.18 06:57:59 | 000,001,673 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk [2010.12.18 06:50:51 | 058,849,392 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\avira_antivir_personal_de.exe [2010.12.17 10:38:56 | 000,193,676 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Eigene Dateien\delicious-20101217.htm [2010.12.05 15:03:39 | 000,025,045 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Desktop\51gcS8gxK7L._SL500_AA300_.jpg [2010.11.28 15:45:11 | 000,144,749 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Desktop\3B71E6B6FA.pdf [2010.11.21 19:35:07 | 000,009,572 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Desktop\10525616_xxl.jpg [2010.11.21 19:27:43 | 000,000,529 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Desktop\Verknüpfung mit liste.lnk [2009.08.30 18:06:03 | 000,004,608 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.01.31 16:58:16 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2008.12.30 12:03:08 | 000,004,278 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\wklnhst.dat [2008.12.11 22:51:13 | 000,000,526 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2008.12.11 21:17:49 | 000,003,031 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2008.12.11 12:51:54 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\michaela\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2008.12.03 04:41:58 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll [2008.12.03 04:40:26 | 000,001,502 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2008.12.03 03:56:45 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008.12.03 03:31:23 | 000,266,240 | ---- | C] () -- C:\WINDOWS\System32\EMSC.DLL [2008.12.03 03:31:23 | 000,009,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\EMSC.sys [2008.07.30 17:55:02 | 002,854,912 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2008.04.29 17:06:17 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2008.04.29 04:02:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2001.11.14 20:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== LOP Check ========== [2010.08.21 21:51:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software [2010.07.10 12:16:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2010.07.10 13:14:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2008.12.03 03:42:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC-Doctor [2008.12.03 03:42:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCDr [2008.12.03 03:42:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SupportSoft [2008.12.03 03:31:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vista32 [2008.12.03 03:31:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vista64 [2008.12.03 03:55:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\XP32 [2010.12.18 07:59:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\JGsoft [2010.02.13 15:45:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Amazon [2008.12.28 08:52:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Feedreader [2009.02.14 20:01:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\JGsoft [2010.07.10 13:14:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Nokia [2008.12.22 22:46:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Nvu [2010.05.29 21:02:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Octoshape [2010.07.10 13:15:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\PC Suite [2010.11.20 08:28:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\PCDr [2010.08.21 21:35:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Sony [2008.12.30 12:03:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Template [2008.12.11 21:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Thunderbird ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > [2008.12.16 20:52:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Application Data\SupportSoft < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2008.12.11 21:49:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Adobe [2010.02.13 15:45:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Amazon [2010.12.18 07:07:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Avira [2008.12.11 19:02:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Creative [2008.12.28 08:52:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Feedreader [2008.04.29 17:12:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Identities [2008.12.03 03:48:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\InstallShield [2009.02.14 20:01:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\JGsoft [2008.12.11 18:41:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Macromedia [2010.12.18 08:25:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Malwarebytes [2010.08.21 21:46:47 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Microsoft [2008.12.11 21:13:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Mozilla [2010.07.10 13:14:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Nokia [2008.12.22 22:46:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Nvu [2010.05.29 21:02:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Octoshape [2010.07.10 13:15:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\PC Suite [2010.11.20 08:28:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\PCDr [2010.08.21 21:35:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Sony [2008.12.03 03:25:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Sun [2008.12.30 12:03:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Template [2008.12.11 21:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Thunderbird < %APPDATA%\*.exe /s > [2010.08.21 21:46:47 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe [2010.12.18 10:33:23 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\michaela\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\I386\sp3.cab:AGP440.sys [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2008.04.14 13:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\AGP440.SYS < MD5 for: ATAPI.SYS > [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\I386\sp3.cab:atapi.sys [2008.04.14 13:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.04.14 13:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2008.04.14 13:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll < MD5 for: EXPLORER.EXE > [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe < MD5 for: NETLOGON.DLL > [2008.04.14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 13:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll < MD5 for: USER32.DLL > [2008.04.14 13:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.04.14 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.04.29 05:00:31 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2008.04.29 05:00:31 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2008.04.29 05:00:31 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < End of report > |
Themen zu tr/dropper.gen blockiert die Websuche |
adobe, antivir guard, aufrufe, avira, bho, blockiert, browser, desktop, einstellungen, error, explorer, firefox, google, hijack, hijack.homepage, hkus\s-1-5-18, homepage, mozilla, plug-in, programm, pum.hijack.homepagecontrol, pum.hijack.regedit, senden, software, system, temp, tr/dropper.gen, trojan, virus, windows xp |