|
Log-Analyse und Auswertung: Vermutung von Hackprogrammen auf FestplatteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.12.2010, 17:26 | #1 |
| Vermutung von Hackprogrammen auf Festplatte Hallo liebe Community, ich habe seit ein paar Tagen den Verdacht, dass sich auf der Festplatte meines erst 3 Monate alten Samsung Notebooks bereits Schädliche Software befindet die mein Internetverlauf und meine eingegebenen Daten kopiert. Ich kommme darauf weil mein Firefox inzwischen immer langsamer arbeitet und sich teilweise ganz aufhängt, ebenso wenn ich mit IE arbeite. Außerdem habe ich vor kurzem eine E-Mail (von Ebay) bekommen die garnicht meine Daten enthielt. Ich erhoffe mir nun mit eurer Hilfe mein Notebook auf etwaige Schädlinge zu überprüfen und diese gegebenfalls zu entfernen. Bitte erklärt mir notwendige Handlungen Schritt für Schritt, da ich ein absoluter Noob bin was PC & Co. betrifft. so nun hier die ersten notwendigen Angaben: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5388 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 24.12.2010 17:04:01 mbam-log-2010-12-24 (17-04-01).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 152679 Laufzeit: 2 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) OTL logfile created on: 12/24/2010 5:08:32 PM - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Public\Desktop\MFtools 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free 8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 302.16 Gb Total Space | 229.41 Gb Free Space | 75.93% Space Free | Partition Type: NTFS Drive D: | 278.92 Gb Total Space | 89.32 Gb Free Space | 32.02% Space Free | Partition Type: NTFS Drive E: | 650.85 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: MISCHAPINK | User Name: Xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2010/12/24 16:48:13 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Public\Desktop\MFtools\OTL.exe PRC - [2010/12/06 08:31:52 | 001,910,152 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2010/09/01 07:39:18 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2010/07/23 03:09:20 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2010/07/23 03:09:20 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe PRC - [2010/06/02 15:58:20 | 000,246,520 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe PRC - [2010/04/01 10:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe PRC - [2010/01/19 03:34:48 | 002,201,192 | ---- | M] (SEC) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe PRC - [2009/12/14 08:17:48 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe PRC - [2009/11/04 05:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2009/10/13 11:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe PRC - [2009/06/03 12:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe PRC - [2009/04/29 08:50:26 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe PRC - [2009/04/15 15:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe PRC - [2009/03/05 10:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\SysWOW64\Rezip.exe PRC - [2008/02/12 12:11:18 | 000,536,576 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe ========== Modules (SafeList) ========== MOD - [2010/12/24 16:48:13 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Public\Desktop\MFtools\OTL.exe MOD - [2010/08/21 06:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll MOD - [2010/07/14 13:30:14 | 000,018,688 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010/11/12 14:17:32 | 000,245,352 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire) SRV:64bit: - [2010/10/13 22:28:54 | 000,149,032 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp) SRV:64bit: - [2010/09/04 14:09:24 | 000,200,056 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield) SRV:64bit: - [2010/03/10 11:16:56 | 000,509,416 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc) SRV:64bit: - [2009/12/14 21:08:40 | 000,355,440 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service) SRV:64bit: - [2009/09/29 16:25:48 | 000,126,392 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV:64bit: - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2010/12/06 08:31:50 | 002,101,640 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2010/07/16 17:23:30 | 006,638,080 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe -- (AllShare) SRV - [2010/06/02 15:58:20 | 000,246,520 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/03/05 10:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\Rezip.exe -- (Rezip) ========== Driver Services (SafeList) ========== DRV:64bit: - [2010/11/12 14:17:32 | 000,441,328 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek) DRV:64bit: - [2010/11/12 14:17:32 | 000,283,360 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk) DRV:64bit: - [2010/11/12 14:17:32 | 000,190,136 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk) DRV:64bit: - [2010/11/12 14:17:32 | 000,094,864 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet) DRV:64bit: - [2010/11/12 14:17:32 | 000,075,032 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk) DRV:64bit: - [2010/11/12 14:17:32 | 000,062,800 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids) DRV:64bit: - [2010/10/13 22:28:54 | 000,529,128 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk) DRV:64bit: - [2010/10/13 22:28:54 | 000,121,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk) DRV:64bit: - [2010/10/11 12:25:44 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2010/02/26 19:32:58 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2010/02/11 00:02:00 | 000,158,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd) DRV:64bit: - [2010/02/03 14:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009/12/14 21:46:56 | 001,573,888 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009/11/20 07:09:48 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009/09/29 16:25:50 | 000,012,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2009/09/28 10:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009/08/05 22:24:16 | 000,061,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2009/07/14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009/07/14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/06/27 15:55:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2009/06/10 21:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009/06/10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009/06/10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/05/28 07:38:04 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI) DRV:64bit: - [2007/01/10 17:46:30 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT) DRV:64bit: - [2007/01/10 16:31:47 | 000,054,072 | R--- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\DgivEcp.sys -- (DgiVecp) DRV - [2009/04/15 15:28:08 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/04/07 17:48:48] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) DRV - [2007/01/10 00:46:34 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\DGIVECP.SYS -- (DgiVecp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.6 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=" FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2010/12/14 13:08:25 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/08 19:07:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/11/18 10:01:51 | 000,000,000 | ---D | M] [2010/09/05 14:35:11 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mozilla\Extensions [2010/12/24 16:01:38 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\e3rmoljp.default\extensions [2010/09/04 15:22:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\e3rmoljp.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010/10/17 16:50:26 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\mozilla\Firefox\Profiles\e3rmoljp.default\extensions\vshare@toolbar [2010/10/11 12:26:06 | 000,002,059 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\Mozilla\FireFox\Profiles\e3rmoljp.default\searchplugins\daemon-search.xml [2010/12/21 23:12:21 | 000,000,950 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\Mozilla\FireFox\Profiles\e3rmoljp.default\searchplugins\icqplugin-1.xml [2010/09/07 20:45:54 | 000,000,950 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\Mozilla\FireFox\Profiles\e3rmoljp.default\searchplugins\icqplugin-2.xml [2010/09/07 20:46:50 | 000,000,950 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\Mozilla\FireFox\Profiles\e3rmoljp.default\searchplugins\icqplugin-3.xml [2010/06/21 16:35:24 | 000,001,042 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\Mozilla\FireFox\Profiles\e3rmoljp.default\searchplugins\icqplugin.xml [2010/12/16 14:37:09 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010/10/27 16:28:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010/12/01 11:55:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010/11/12 14:17:32 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010/07/23 01:48:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010/07/23 01:48:56 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010/07/23 01:48:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010/07/23 01:48:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010/07/23 01:48:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL () O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101208190750.dll (McAfee, Inc.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20101208190750.dll (McAfee, Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.DLL (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [APLangApp] C:\Program Files (x86)\AnyPC Client\APLangApp.exe (DoctorSoft) O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe (cyberlink) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Logan_S2P] C:\Program Files (x86)\Samsung\Samsung SCX-4500 Series\SPanel\Scan2pc.exe File not found O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl8] C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/02/25 03:13:26 | 000,000,747 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{1576c67b-4691-11df-89da-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{1576c67b-4691-11df-89da-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2008/02/25 03:07:07 | 000,712,360 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/12/24 17:00:17 | 000,000,000 | ---D | C] -- C:\windows\ERDNT [2010/12/24 16:59:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT [2010/12/24 16:49:38 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\Malwarebytes [2010/12/24 16:49:28 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys [2010/12/24 16:49:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010/12/24 16:49:25 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2010/12/24 16:49:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010/12/24 16:48:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip [2010/12/24 16:47:42 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\MFtools [2010/12/16 17:36:22 | 000,089,600 | ---- | C] (SS) -- C:\windows\SysNative\sx450sci.dll [2010/12/16 17:36:22 | 000,000,000 | ---D | C] -- C:\windows\DRIVERS [2010/12/16 17:36:16 | 000,000,000 | ---D | C] -- C:\Temp [2010/12/16 17:33:21 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Roaming\SmarThru4 [2010/12/16 17:32:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\SRC Shared [2010/12/16 17:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Readiris10 [2010/12/16 17:31:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SmarThru 4 [2010/12/16 17:30:45 | 000,000,000 | ---D | C] -- C:\windows\Samsung [2010/12/16 17:29:46 | 000,151,552 | ---- | C] (SS) -- C:\windows\SysNative\sx450sci.exe [2010/12/16 17:29:09 | 000,204,800 | ---- | C] (SEC) -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcm.dll [2010/12/16 17:29:08 | 000,151,552 | ---- | C] (SS) -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\coinst.exe [2010/12/16 17:29:08 | 000,065,536 | ---- | C] (SS) -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\coinst.dll [2010/12/16 17:29:08 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series [2010/12/16 17:29:08 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\drivers\Samsung [2010/12/16 13:43:45 | 000,054,072 | R--- | C] (Samsung Electronics) -- C:\windows\SysNative\drivers\DgivEcp.sys [2010/12/16 13:43:36 | 000,212,480 | ---- | C] (Eastman Kodak) -- C:\windows\SysWow64\PCDLIB32.DLL [2010/12/16 13:41:16 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\PSU [2010/12/16 13:40:01 | 000,049,152 | R--- | C] (Samsung Electronics) -- C:\windows\SysNative\Ssusbpn.dll [2010/12/16 13:40:00 | 000,057,344 | R--- | C] (Samsung Electronics) -- C:\windows\SysNative\Ssdevm.dll [2010/12/15 17:10:26 | 000,000,000 | ---D | C] -- C:\Users\Xxx\Documents\Fotobuch-Dateien [2010/12/14 18:09:17 | 000,000,000 | ---D | C] -- C:\PCShareManagerUpload [2010/12/14 17:51:33 | 000,000,000 | ---D | C] -- C:\Users\Xxx\AppData\Local\ElevatedDiagnostics [2010/12/08 20:10:23 | 000,033,856 | -H-- | C] (LogMeIn, Inc.) -- C:\windows\SysNative\hamachi.sys [2010/12/08 20:10:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2010/12/01 11:56:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2010/11/27 12:45:24 | 000,663,552 | ---- | C] (MAGIX AG) -- C:\windows\SysWow64\mgxoschk.dll [2010/11/27 12:45:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Aldi Sued Fotoservice [2010/11/27 12:45:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Aldi Sued Fotoservice [2010/11/27 12:44:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Aldi Süd Foto Service [3 C:\Users\Xxx\Documents\*.tmp files -> C:\Users\Xxx\Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/12/24 17:11:20 | 000,013,936 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010/12/24 17:11:20 | 000,013,936 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010/12/24 16:59:14 | 000,000,924 | ---- | M] () -- C:\Users\Xxx\Desktop\NTREGOPT.lnk [2010/12/24 16:59:14 | 000,000,905 | ---- | M] () -- C:\Users\Xxx\Desktop\ERUNT.lnk [2010/12/24 16:54:12 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk [2010/12/24 16:53:28 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2010/12/24 16:53:25 | 4141,481,984 | -HS- | M] () -- C:\hiberfil.sys [2010/12/24 16:50:07 | 000,013,244 | ---- | M] () -- C:\Users\Xxx\Documents\Vermutung von Hackprogrammen auf der Festplatte.docx [2010/12/24 16:49:29 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/12/24 14:05:55 | 000,020,787 | ---- | M] () -- C:\Users\Xxx\Documents\One Day in Paris am 20.docx [2010/12/21 19:29:28 | 000,025,088 | ---- | M] () -- C:\Users\Xxx\Documents\Einkaufsliste.doc [2010/12/20 18:36:43 | 000,009,985 | ---- | M] () -- C:\Users\Xxx\Documents\u2011.xlsx [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys [2010/12/20 18:08:40 | 000,024,152 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2010/12/17 10:52:22 | 001,498,506 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2010/12/17 10:52:22 | 000,654,166 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2010/12/17 10:52:22 | 000,616,008 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2010/12/17 10:52:22 | 000,130,006 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2010/12/17 10:52:22 | 000,106,388 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2010/12/16 17:36:44 | 000,000,138 | ---- | M] () -- C:\Users\Public\Desktop\SAMSUNG Dr.Printer.url [2010/12/16 17:33:21 | 000,010,345 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\SmarThruOptions.xml [2010/12/16 17:32:58 | 000,000,136 | ---- | M] () -- C:\windows\Readiris.ini [2010/12/16 17:31:27 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\SmarThru 4.lnk [2010/12/16 14:28:48 | 000,007,446 | ---- | M] () -- C:\Users\Xxx\Documents\1. Bewerbung_Anschreiben.pdf [2010/12/16 13:54:54 | 000,482,847 | ---- | M] () -- C:\Users\Xxx\Documents\Ganzseitiges Foto.pdf [2010/12/16 03:21:16 | 000,386,640 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2010/12/15 17:36:51 | 000,025,734 | ---- | M] () -- C:\Users\Xxx\AppData\Roaming\mdbu.bin [2010/12/15 17:34:27 | 000,044,686 | ---- | M] () -- C:\Users\Xxx\Documents\Fotobuch.pbf [2010/12/15 17:03:24 | 000,000,162 | -H-- | M] () -- C:\Users\Xxx\Documents\~$e Day in Paris am 20.docx [2010/12/14 18:08:41 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk [2010/12/08 20:10:22 | 000,000,926 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk [2010/12/08 17:08:28 | 000,137,411 | ---- | M] () -- C:\Users\Xxx\Documents\Miyabi Bremen Einzelhandelsliste.docx [2010/12/06 16:25:53 | 000,231,530 | ---- | M] () -- C:\Users\Xxx\Documents\Miyabi Bremen Einzelhandelsliste.pdf [2010/12/05 22:57:33 | 000,013,935 | ---- | M] () -- C:\Users\Xxx\Documents\Die Schlümpfe leben in Schlumpfhausen.docx [2010/12/03 20:35:44 | 000,025,088 | ---- | M] () -- C:\Users\Xxx\Documents\outlook notizen.doc [2010/12/02 12:53:13 | 000,000,162 | -H-- | M] () -- C:\Users\Xxx\Documents\~$nkaufsliste.doc [2010/11/27 12:45:25 | 000,001,123 | ---- | M] () -- C:\Users\Public\Desktop\Aldi Süd Foto Service.lnk [2010/11/25 19:04:57 | 000,025,600 | ---- | M] () -- C:\Users\Xxx\Documents\Arbeitszeugnis Zohan Curcic.doc [2010/11/24 17:13:14 | 000,013,578 | ---- | M] () -- C:\Users\Xxx\Documents\Hallo liebes Pflegeteam.docx [3 C:\Users\Xxx\Documents\*.tmp files -> C:\Users\Xxx\Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/12/24 16:59:14 | 000,000,924 | ---- | C] () -- C:\Users\Xxx\Desktop\NTREGOPT.lnk [2010/12/24 16:59:14 | 000,000,905 | ---- | C] () -- C:\Users\Xxx\Desktop\ERUNT.lnk [2010/12/24 16:50:03 | 000,013,244 | ---- | C] () -- C:\Users\Xxx\Documents\Vermutung von Hackprogrammen auf der Festplatte.docx [2010/12/24 16:49:29 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/12/16 17:33:21 | 000,010,345 | ---- | C] () -- C:\Users\Xxx\AppData\Roaming\SmarThruOptions.xml [2010/12/16 17:32:58 | 000,000,136 | ---- | C] () -- C:\windows\Readiris.ini [2010/12/16 17:32:54 | 000,023,040 | ---- | C] () -- C:\windows\SysWow64\irisco32.dll [2010/12/16 17:31:27 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\SmarThru 4.lnk [2010/12/16 17:29:47 | 000,022,723 | ---- | C] () -- C:\windows\SysNative\sx450sl3.dll [2010/12/16 17:29:47 | 000,000,520 | ---- | C] () -- C:\windows\SysNative\sx450sl3.smt [2010/12/16 17:29:15 | 000,041,384 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450su.bmp [2010/12/16 17:29:15 | 000,039,751 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450s.cat [2010/12/16 17:29:15 | 000,022,723 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450sl3.dll [2010/12/16 17:29:15 | 000,008,462 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450s.inf [2010/12/16 17:29:15 | 000,004,894 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450su.ini [2010/12/16 17:29:15 | 000,000,527 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450spp.ver [2010/12/16 17:29:15 | 000,000,520 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\sx450sl3.SMT [2010/12/16 17:29:14 | 001,032,192 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvum.dll [2010/12/16 17:29:14 | 000,626,874 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvua.bmp [2010/12/16 17:29:14 | 000,206,278 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvub.bmp [2010/12/16 17:29:14 | 000,019,013 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvum.xml [2010/12/16 17:29:14 | 000,004,072 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvul.bmp [2010/12/16 17:29:13 | 000,835,584 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvu2.dll [2010/12/16 17:29:13 | 000,704,512 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvu.dll [2010/12/16 17:29:12 | 000,217,088 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvo.dll [2010/12/16 17:29:12 | 000,081,893 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvsp.dat [2010/12/16 17:29:12 | 000,081,851 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvpt.dat [2010/12/16 17:29:12 | 000,079,315 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvru.dat [2010/12/16 17:29:12 | 000,078,532 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvpo.dat [2010/12/16 17:29:12 | 000,076,532 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvtk.dat [2010/12/16 17:29:12 | 000,075,913 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvsw.dat [2010/12/16 17:29:12 | 000,033,875 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvpo.chm [2010/12/16 17:29:12 | 000,033,533 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvru.chm [2010/12/16 17:29:12 | 000,032,953 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvpt.chm [2010/12/16 17:29:12 | 000,032,903 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvsp.chm [2010/12/16 17:29:12 | 000,032,207 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvtk.chm [2010/12/16 17:29:12 | 000,032,117 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvsw.chm [2010/12/16 17:29:12 | 000,015,318 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvpp.dll [2010/12/16 17:29:11 | 000,086,021 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvfn.dat [2010/12/16 17:29:11 | 000,082,612 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvgr.dat [2010/12/16 17:29:11 | 000,080,966 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvit.dat [2010/12/16 17:29:11 | 000,079,692 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvhu.dat [2010/12/16 17:29:11 | 000,077,667 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvfi.dat [2010/12/16 17:29:11 | 000,075,829 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvnr.dat [2010/12/16 17:29:11 | 000,070,545 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvkr.dat [2010/12/16 17:29:11 | 000,069,632 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvlf.dll [2010/12/16 17:29:11 | 000,034,023 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvhu.chm [2010/12/16 17:29:11 | 000,033,999 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvgr.chm [2010/12/16 17:29:11 | 000,033,577 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvfn.chm [2010/12/16 17:29:11 | 000,033,121 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvkr.chm [2010/12/16 17:29:11 | 000,032,567 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvit.chm [2010/12/16 17:29:11 | 000,031,681 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvnr.chm [2010/12/16 17:29:10 | 000,082,861 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvel.dat [2010/12/16 17:29:10 | 000,079,932 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvdt.dat [2010/12/16 17:29:10 | 000,076,796 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvdn.dat [2010/12/16 17:29:10 | 000,076,682 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcz.dat [2010/12/16 17:29:10 | 000,073,688 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrven.dat [2010/12/16 17:29:10 | 000,034,443 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvel.chm [2010/12/16 17:29:10 | 000,033,205 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcz.chm [2010/12/16 17:29:10 | 000,032,973 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvdt.chm [2010/12/16 17:29:10 | 000,032,699 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvdn.chm [2010/12/16 17:29:10 | 000,032,015 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvfi.chm [2010/12/16 17:29:10 | 000,031,357 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrven.chm [2010/12/16 17:29:09 | 000,080,804 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvbp.dat [2010/12/16 17:29:09 | 000,072,350 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvab.dat [2010/12/16 17:29:09 | 000,063,622 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcp.dat [2010/12/16 17:29:09 | 000,063,435 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvct.dat [2010/12/16 17:29:09 | 000,038,208 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcm.ctd [2010/12/16 17:29:09 | 000,032,681 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvct.chm [2010/12/16 17:29:09 | 000,032,573 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvcp.chm [2010/12/16 17:29:09 | 000,032,387 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvab.chm [2010/12/16 17:29:09 | 000,032,293 | ---- | C] () -- C:\windows\SysWow64\drivers\Samsung\Samsung SCX-4500 Series\itdrvbp.chm [2010/12/16 14:28:45 | 000,007,446 | ---- | C] () -- C:\Users\Xxx\Documents\1. Bewerbung_Anschreiben.pdf [2010/12/16 13:54:53 | 000,482,847 | ---- | C] () -- C:\Users\Xxx\Documents\Ganzseitiges Foto.pdf [2010/12/16 13:43:59 | 000,000,138 | ---- | C] () -- C:\Users\Public\Desktop\SAMSUNG Dr.Printer.url [2010/12/16 13:43:45 | 000,007,297 | ---- | C] () -- C:\windows\SysWow64\SSPORT.CAT [2010/12/16 13:43:45 | 000,007,297 | ---- | C] () -- C:\windows\SysWow64\DgivEcp.cat [2010/12/16 13:43:44 | 000,036,864 | ---- | C] () -- C:\windows\SysWow64\SvcMan.exe [2010/12/16 13:43:39 | 000,172,032 | ---- | C] () -- C:\windows\SysWow64\SecSNMP.dll [2010/12/16 13:43:37 | 000,000,422 | ---- | C] () -- C:\windows\SysWow64\ltocx13.lic [2010/12/16 13:41:16 | 000,479,232 | ---- | C] () -- C:\windows\ssndii.exe [2010/12/16 13:40:17 | 000,110,592 | R--- | C] () -- C:\windows\WiaInst.exe [2010/12/16 13:40:15 | 000,011,502 | ---- | C] () -- C:\windows\Dr. Printer Icon.ico [2010/12/16 13:40:00 | 000,011,264 | R--- | C] () -- C:\windows\SysNative\sssegfilter.dll [2010/12/16 13:39:59 | 000,217,088 | R--- | C] () -- C:\windows\SysNative\ssminidriver.dll [2010/12/16 13:39:59 | 000,027,136 | R--- | C] () -- C:\windows\SysNative\ssimgfilter.dll [2010/12/16 13:39:59 | 000,010,752 | R--- | C] () -- C:\windows\SysNative\sserrhandler.dll [2010/12/15 17:10:26 | 000,044,686 | ---- | C] () -- C:\Users\Xxx\Documents\Fotobuch.pbf [2010/12/15 17:03:24 | 000,000,162 | -H-- | C] () -- C:\Users\Xxx\Documents\~$e Day in Paris am 20.docx [2010/12/14 18:08:41 | 000,002,046 | ---- | C] () -- C:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk [2010/12/06 16:25:52 | 000,231,530 | ---- | C] () -- C:\Users\Xxx\Documents\Miyabi Bremen Einzelhandelsliste.pdf [2010/12/06 16:13:08 | 000,137,411 | ---- | C] () -- C:\Users\Xxx\Documents\Miyabi Bremen Einzelhandelsliste.docx [2010/12/04 15:09:36 | 000,013,935 | ---- | C] () -- C:\Users\Xxx\Documents\Die Schlümpfe leben in Schlumpfhausen.docx [2010/12/02 12:53:13 | 000,000,162 | -H-- | C] () -- C:\Users\Xxx\Documents\~$nkaufsliste.doc [2010/12/02 12:11:26 | 000,020,787 | ---- | C] () -- C:\Users\Xxx\Documents\One Day in Paris am 20.docx [2010/11/27 12:46:56 | 000,025,734 | ---- | C] () -- C:\Users\Xxx\AppData\Roaming\mdbu.bin [2010/11/27 12:45:25 | 000,001,123 | ---- | C] () -- C:\Users\Public\Desktop\Aldi Süd Foto Service.lnk [2010/11/25 14:29:51 | 000,025,600 | ---- | C] () -- C:\Users\Xxx\Documents\Arbeitszeugnis Zohan Curcic.doc [2010/09/06 15:49:44 | 000,053,248 | ---- | C] () -- C:\windows\SysWow64\unrar.dll [2010/09/04 17:46:44 | 000,006,656 | ---- | C] () -- C:\Users\Xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/09/04 15:16:22 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010/04/07 10:11:14 | 000,000,426 | ---- | C] () -- C:\windows\HotFixList.ini [2010/04/07 09:49:46 | 000,000,109 | ---- | C] () -- C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log [2010/04/07 09:49:00 | 000,000,110 | ---- | C] () -- C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log [2010/04/07 09:47:52 | 000,000,106 | ---- | C] () -- C:\ProgramData\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}.log [2010/04/07 09:45:43 | 000,000,110 | ---- | C] () -- C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log [2010/04/07 09:44:37 | 000,000,105 | ---- | C] () -- C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log [2010/04/07 09:44:11 | 000,000,107 | ---- | C] () -- C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll [2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll [2006/10/08 18:33:54 | 000,000,000 | ---- | C] () -- C:\windows\R-series.ini ========== LOP Check ========== [2010/10/20 15:13:07 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2010/10/11 12:40:30 | 000,000,000 | ---D | M] -- C:\Users\Xxx\AppData\Roaming\DAEMON Tools Lite [2010/12/24 16:50:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ICQ [2010/12/16 17:33:21 | 000,000,000 | ---D | M] -- C:\Users\xxxx\AppData\Roaming\SmarThru4 [2010/12/23 19:12:50 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TVgenial [2010/11/24 15:50:32 | 000,032,588 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > OTL Extras logfile created on: 12/24/2010 5:08:32 PM - Run 1 OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Public\Desktop\MFtools 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free 8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 302.16 Gb Total Space | 229.41 Gb Free Space | 75.93% Space Free | Partition Type: NTFS Drive D: | 278.92 Gb Total Space | 89.32 Gb Free Space | 32.02% Space Free | Partition Type: NTFS Drive E: | 650.85 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: XXX | User Name: Xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation) .url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Überwachungstool für die Intel® Turbo-Boost-Technik "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 "{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "NVIDIA Drivers" = NVIDIA Drivers "SynTPDeinstKey" = Synaptics Pointing Device Driver "WinRAR archiver" = WinRAR [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{0A353130-D22C-41DD-8C67-1B02A05F2CE0}" = Samsung Support Center "{0F796312-289C-40CA-856C-9FBCF5E83342}" = REALTEK Wireless LAN Software "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4 "{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}" = Readiris Pro 10 "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager "{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 22 "{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{34B76DCB-BF7C-440F-B058-C84172C1E338}" = Easy Network Manager "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{3EED7541-55F8-4DC6-B9CD-28762D71310E}" = Samsung R-Series "{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2 "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010 "{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010 "{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010 "{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010 "{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 "{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010 "{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 "{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 "{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 "{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010 "{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 "{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010 "{90F1943D-EA4A-4460-B59F-30023F3BA69A}" = SmarThru 4 "{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}" = ChargeableUSB "{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch "{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3 "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program "{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus "{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "7-Zip" = 7-Zip 4.65 "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Aldi Süd Foto Service" = Aldi Süd Foto Service 4.6 "ALDI Süd Online Druck Service" = ALDI Süd Online Druck Service 4.6 "ALDI Sued Fotoservice_is1" = Aldi Sued Fotoservice 2.7 "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "DivX Setup.divx.com" = DivX-Setup "ERUNT_is1" = ERUNT 1.1j "Gamers.IRC" = Gamers.IRC 5.31 "ICQToolbar" = ICQ Toolbar "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite "InstallShield_{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "LogMeIn Hamachi" = LogMeIn Hamachi "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Marvell Miniport Driver" = Marvell Miniport Driver "Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8) "MSC" = McAfee Internet Security Suite "Office14.SingleImage" = Microsoft Office Home and Student 2010 "Samsung SCX-4500 Series" = Samsung SCX-4500 Series "TVgenial" = TVgenial 4.10 "Veetle TV" = Veetle TV 0.9.18 "VLC media player" = VLC media player 1.1.5 "WinLiveSuite_Wave3" = Windows Live Essentials ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 12/3/2010 7:54:22 AM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/3/2010 10:02:41 PM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/6/2010 6:52:54 AM | Computer Name = Xxx | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: EXCEL.EXE, Version: 14.0.4756.1000, Zeitstempel: 0x4b9c08e8 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0xd516bc30 ID des fehlerhaften Prozesses: 0xeb8 Startzeit der fehlerhaften Anwendung: 0x01cb95305eff1ae2 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE Pfad des fehlerhaften Moduls: unknown Berichtskennung: f9fffdd0-0126-11e0-90ec-002454884354 Error - 12/6/2010 4:50:38 PM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/8/2010 4:18:29 PM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/10/2010 9:56:30 AM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/12/2010 8:51:55 PM | Computer Name = Xxx | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 12/13/2010 4:07:20 PM | Computer Name = Xxx | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 8.0.7600.16671 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 15d8 Startzeit: 01cb9afe13bfc3ac Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 8a4bd773-06f4-11e0-8a4a-002454884354 Error - 12/13/2010 4:19:26 PM | Computer Name = Xxx | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 8.0.7600.16671 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 21b4 Startzeit: 01cb9b015972f6ee Endzeit: 12 Anwendungspfad: C:\PROGRA~2\INTERN~1\iexplore.exe Berichts-ID: 3db8c5ae-06f6-11e0-8a4a-002454884354 Error - 12/14/2010 11:26:13 AM | Computer Name = Xxx | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 8.0.7600.16671 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 6bc Startzeit: 01cb9b771c85433d Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: 6ed64172-0796-11e0-a4c9-002454884354 [ System Events ] Error - 12/16/2010 9:22:50 AM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 9:42:41 AM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 12:29:17 PM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 12:30:48 PM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 12:33:11 PM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 12:36:27 PM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/16/2010 5:49:24 PM | Computer Name = Xxx | Source = NetBT | ID = 4321 Description = Der Name "CHAOS :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.0.104 registriert werden. Der Computer mit IP-Adresse 192.168.0.102 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error - 12/17/2010 5:46:35 AM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/18/2010 6:49:43 AM | Computer Name = Xxx | Source = Service Control Manager | ID = 7000 Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%20 Error - 12/18/2010 6:50:54 AM | Computer Name = Xxx | Source = WMPNetworkSvc | ID = 866300 Description = < End of report > |
25.12.2010, 02:00 | #2 | ||
/// Winkelfunktion /// TB-Süch-Tiger™ | Vermutung von Hackprogrammen auf Festplatte Hallo und
__________________Zitat:
Zitat:
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ |
25.12.2010, 15:01 | #3 |
| Vermutung von Hackprogrammen auf Festplatte ältere logs gibs leider nnet.
__________________naja hier der volllständige bericht Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5392 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 25.12.2010 14:59:39 mbam-log-2010-12-25 (14-59-39).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 270846 Laufzeit: 39 Minute(n), 18 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
Themen zu Vermutung von Hackprogrammen auf Festplatte |
64-bit, autorun, bho, c:\windows\system32\rundll32.exe, desktop, document, druck, e-mail, ebay, error, excel, excel.exe, fehler, festplatte, firefox, flash player, helper, home, home premium, iastor.sys, ieframe.dll, iexplore.exe, install.exe, installation, ip-adresse, location, logfile, microsoft office word, mozilla, oldtimer, phishing, plug-in, programdata, realtek, registry, richtlinie, rundll, saver, searchplugins, security, shell32.dll, siteadvisor, software, sptd.sys, syswow64, vlc media player, webcheck |