| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sysWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
04.01.2011, 19:57
| #1 |
| |  Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Hallo lieber Boardler, mich plagt schon seit ein paar tagen der gedanke,das ich ein unerwünschten Rootkit auf meinem Pc habe... Nun habe ich meinen Pc mit Sophos Anit-Rootkit scannen lassen. Was mir aufgefallen war ist,dass er beim ersten Scan ca 12 gefunden hatte (die meisten in der Windows Systemdatei),beim 2ten aber nur 1nen. Hier die ergebnisse vom 2ten Durchlauf: Description: Unknown hidden file Location: C:\Windows\System32\drivers\sptd.sys Würde mich darüber freuen ob ihr mir sagt,ob der gefährlich ist oder nicht edit: Beim 3. Scan findet er offenbar wieder andere Rootkits: Area: Local hard drives Description: Unknown hidden file Location: C:\Windows\Temp\TMP0000006F5E14F96CD96EAFD9 Removable: Yes (but clean up not recommended for this file) Notes: (no more detail available) Geändert von K.K.M (04.01.2011 um 20:12 Uhr) |
|
04.01.2011, 21:14
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Hallo und
__________________ Zitat:
Noch andere Funde? Du kannst zur Vorsicht ja mal routinemäßig MBAM und OTL ausführen: Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
05.01.2011, 00:04
| #3 |
| | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys hier ist der scan mit malwarebytes :
__________________Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 384249 Laufzeit: 2 Stunde(n), 5 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Rockstar\GTA\pztrain.exe (Backdoor.Bot) -> Quarantined and deleted successfully. den anderen mache ich morgen LG K.K.M |
|
05.01.2011, 12:48
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Log von MBAM ist unvollständig. Der Kopf fehlt.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
05.01.2011, 17:28
| #5 |
| | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Ohh Entschuldigung, war gestern schon später und ich wollte schnell ins Bett hier : Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes Datenbank Version: 5460 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 05.01.2011 00:02:56 mbam-log-2011-01-05 (00-02-51).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 384249 Laufzeit: 2 Stunde(n), 5 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Rockstar\GTA\pztrain.exe (Backdoor.Bot) -> No action taken. No action taken ist übrigends nicht mehr Aktuell. Ich habe die Datei gelöscht ( war eine Art Schummelprogramm für ein Spiel,aber legal) Aber ob der jetzt damit behoben ist oder bzw. ob er überhaupt gefährlich war kann ich nicht sagen. Soweit ich weiss müsste das doch so sein,dass man von Backdoor.bot nichts mitbekommt und jemand auf meine Festplatte geht... Die Datei kommt übrigends aus eigentlich Vertrauenswürdigen Quellen LG K.K.M  |
|
05.01.2011, 19:31
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Und was ist mit den OTL-Logs?
__________________ --> Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys |
|
05.01.2011, 21:39
| #7 |
| | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Hier sind sie (das hoffe ich zumindest )OTL Logfile:Code:
ATTFilter OTL logfile created on: 05.01.2011 11:16:39 - Run 1 OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Kolja\Downloads 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 74,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 931,41 Gb Total Space | 720,18 Gb Free Space | 77,32% Space Free | Partition Type: NTFS Drive D: | 2,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: KOLJAS-PC | User Name: kolja | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\pchooklaunch32.exe (BitDefender S.R.L.) PRC - C:\Users\Kolja\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) PRC - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe () PRC - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\EXPERTool\TBPANEL.exe (Gainward Co.) ========== Modules (SafeList) ========== MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_extra.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_net.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_nt.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_base.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_fragments.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\midas32.dll (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\plugin_registry.m32 (BitDefender S.R.L. Bucharest, ROMANIA) MOD - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\pchook32.dll (BitDefender S.R.L.) MOD - C:\Users\Kolja\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00060_002\leaktests.m32 (BitDefender SRL) MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4926_none_508ed732bcbc0e5a\msvcr90.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found SRV:64bit: - (npggsvc) -- C:\Windows\SysNative\GameMon.des File not found SRV:64bit: - (VSSERV) -- C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe (BitDefender S.R.L.) SRV:64bit: - (Updatesrv) -- C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe (BitDefender S.R.L.) SRV:64bit: - (Update Server) -- C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe (BitDefender) SRV:64bit: - (SandraAgentSrv) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (SiSoftware) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (msvsmon90) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation) SRV - (Akamai) -- c:\Program Files (x86)\Common Files\Akamai\netsession_win_dbc0250.dll () SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe () SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (npggsvc) -- C:\Windows\SysWow64\GameMon.des (INCA Internet Co., Ltd.) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AODService) -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe () SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV:64bit: - (NPPTNT2) -- C:\Windows\SysNative\npptNT2.sys File not found DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (bdfwfpf) -- C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys (BitDefender) DRV:64bit: - (Bdfndisf) -- c:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfndisf6.sys (BitDefender) DRV:64bit: - (bdfsfltr) -- C:\Windows\SysNative\drivers\bdfsfltr.sys (BitDefender) DRV:64bit: - (avckf) -- C:\Windows\SysNative\drivers\avckf.sys (BitDefender) DRV:64bit: - (avc3) -- C:\Windows\SysNative\drivers\avc3.sys (BitDefender) DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (BDFM) -- C:\Windows\SysNative\drivers\bdfm.sys (BitDefender S.R.L. Bucharest, ROMANIA) DRV:64bit: - (dc3d) MS Hardware Device Detection Driver (USB) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation) DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Sun Microsystems, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (SANDRA) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\WNt500x64\sandra.sys (SiSoftware) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\70AE.tmp (Sophos Plc) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (RTL8187B) RTL8187B Drahtlos-802.11b/g-USB 2.0-Netzwerkadapter (54 MBit/s) -- C:\Windows\SysNative\drivers\RTL8187B.sys (Realtek Semiconductor Corporation ) DRV:64bit: - (netr7364) -- C:\Windows\SysNative\drivers\netr7364.sys (Ralink Technology, Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (NuidFltr) -- C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation) DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (skfiltv) -- C:\Windows\SysNative\drivers\skfiltv.sys (Creative Technology Ltd.) DRV - (RushTopDevice_J) -- C:\Program Files (x86)\MSI\OverclockingCenter\RushJ64.sys (Your Corporation) DRV - (DualCoreCenter) -- C:\Program Files (x86)\MSI\OverclockingCenter\NTGLM7X64.sys (MICRO-STAR INT'L CO., LTD.) DRV - (RushTopDevice2) -- C:\Program Files (x86)\MSI\OverclockingCenter\RushTop64.sys (Your Corporation) DRV - (FLASHSYS) -- C:\Program Files (x86)\MSI\Live Update 4\LU4\Flashsys64.sys () DRV - (Cardex) -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys (Windows (R) Server 2003 DDK provider) DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys () DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - Reg Error: Key error. File not found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C5 28 96 5E 1B 5F CA 01 [binary data] IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official" FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: FFToolbar@bitdefender.com:2.0 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - prefs.js..network.proxy.backup.ftp: "192.168.2.110" FF - prefs.js..network.proxy.backup.ftp_port: 8080 FF - prefs.js..network.proxy.backup.gopher: "192.168.2.110" FF - prefs.js..network.proxy.backup.gopher_port: 8080 FF - prefs.js..network.proxy.backup.socks: "192.168.2.110" FF - prefs.js..network.proxy.backup.socks_port: 8080 FF - prefs.js..network.proxy.backup.ssl: "192.168.2.110" FF - prefs.js..network.proxy.backup.ssl_port: 8080 FF - prefs.js..network.proxy.ftp: "192.168.2.110" FF - prefs.js..network.proxy.ftp_port: 8080 FF - prefs.js..network.proxy.gopher: "192.168.2.110" FF - prefs.js..network.proxy.gopher_port: 8080 FF - prefs.js..network.proxy.http: "192.168.2.110" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "192.168.2.110" FF - prefs.js..network.proxy.socks_port: 8080 FF - prefs.js..network.proxy.ssl: "192.168.2.110" FF - prefs.js..network.proxy.ssl_port: 8080 FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\ [2011.01.04 21:11:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.31 15:54:57 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.12 00:16:40 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.10.08 21:12:52 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKLM\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2011\bdtbext\ [2011.01.04 21:11:03 | 000,000,000 | ---D | M] [2010.08.11 14:08:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kolja\AppData\Roaming\mozilla\Extensions [2010.08.11 14:08:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kolja\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.01.04 23:04:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions [2010.08.25 16:33:29 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2010.07.07 18:31:52 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2010.06.17 19:53:12 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.09.10 18:35:49 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2010.05.02 16:07:54 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.10.30 20:07:18 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.07.04 18:20:29 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2010.09.10 18:35:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kolja\AppData\Roaming\mozilla\Firefox\Profiles\e2xlk1mo.default\extensions\staged-xpis [2010.01.06 12:10:02 | 000,000,694 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icq-search.xml [2010.02.20 14:58:43 | 000,000,961 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin-1.xml [2010.03.12 14:33:17 | 000,000,950 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin-2.xml [2010.03.24 15:42:05 | 000,000,950 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin-3.xml [2010.04.03 19:20:02 | 000,000,950 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin-4.xml [2010.04.30 09:24:21 | 000,000,950 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin-5.xml [2010.05.12 17:40:06 | 000,001,042 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\icqplugin.xml [2010.06.17 19:59:58 | 000,002,057 | ---- | M] () -- C:\Users\Kolja\AppData\Roaming\Mozilla\Firefox\Profiles\e2xlk1mo.default\searchplugins\youtube-videosuche.xml [2011.01.04 22:28:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2009.12.26 09:51:43 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.11.24 16:34:44 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} [2010.03.29 12:38:34 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.06.16 17:29:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.24 10:54:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.20 13:39:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.12.29 22:27:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.01.04 21:11:01 | 000,000,000 | ---D | M] ("BitDefender Antiphishing Toolbar") -- C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER 2011\BDAPHFFEXT [2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll [2010.12.12 00:16:36 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.12.12 00:16:36 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml [2010.12.12 00:16:36 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.12.12 00:16:36 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.12.12 00:16:36 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll File not found O3:64bit: - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\ietoolbar.dll (BitDefender S.R.L.) O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ietoolbar.dll (BitDefender S.R.L.) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O4:64bit: - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe (BitDefender S.R.L.) O4:64bit: - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe (BitDefender S.R.L.) O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe (BitDefender S.R.L.) O4 - HKLM..\Run: [DelReg] C:\Program Files (x86)\MSI\OverclockingCenter\DelReg.exe () O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [TrayServer] C:\Program Files (x86)\MAGIX\Video_deluxe_15\Trayserver.exe (MAGIX AG) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [GAINWARD] C:\Program Files (x86)\EXPERTool\TBPanel.exe (Gainward Co.) O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [PlayNC Launcher] File not found O4 - HKCU..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation) O4 - HKCU..\RunOnce: [BrStsW64.exe] C:\Program Files (x86)\Brownie\BrStsW64.exe (brother) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Kolja\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Kolja\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\Kolja\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Kolja\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.2 O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.07.15 20:39:51 | 000,000,122 | R--- | M] () - D:\autorun.inf -- [ UDF ] O33 - MountPoints2\{3aaa0dcc-f63b-11de-96e2-4061862e1317}\Shell - "" = AutoRun O33 - MountPoints2\{3aaa0dcc-f63b-11de-96e2-4061862e1317}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found O33 - MountPoints2\{5ee6d0fb-cb07-11de-8c63-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{5ee6d0fb-cb07-11de-8c63-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe -- [2009.07.15 20:39:51 | 000,106,760 | R--- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.01.04 21:33:28 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\Malwarebytes [2011.01.04 21:33:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.01.04 21:33:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.01.04 21:33:15 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.01.04 21:33:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.01.04 21:15:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eDgMt2 [2011.01.04 21:15:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eDgMt2 [2011.01.04 21:11:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDefender 2011 [2011.01.04 21:11:02 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\BitDefender [2011.01.04 21:10:54 | 000,000,000 | ---D | C] -- C:\Program Files\BitDefender [2011.01.04 21:01:05 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\QuickScan [2011.01.04 21:00:41 | 000,000,000 | ---D | C] -- C:\ProgramData\BitDefender [2011.01.04 21:00:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\BitDefender [2011.01.04 21:00:37 | 000,388,168 | ---- | C] (BitDefender) -- C:\Windows\SysNative\drivers\bdfsfltr.sys [2011.01.04 16:41:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos [2011.01.04 16:41:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos [2010.12.31 12:01:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2010.12.31 12:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2010.12.31 11:59:00 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2010.12.31 11:58:20 | 020,284,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2010.12.31 11:58:20 | 014,899,816 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2010.12.31 11:58:20 | 012,788,840 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2010.12.31 11:58:20 | 010,023,528 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2010.12.31 11:58:20 | 005,473,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2010.12.31 11:58:20 | 001,500,264 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco642050.dll [2010.12.31 11:58:20 | 001,308,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco642030.dll [2010.12.31 11:58:20 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2010.12.31 11:58:20 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2010.12.31 11:58:19 | 018,597,480 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2010.12.31 11:58:19 | 013,019,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2010.12.31 11:58:19 | 006,471,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2010.12.31 11:58:19 | 004,837,480 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2010.12.31 11:58:19 | 003,112,552 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2010.12.31 11:58:19 | 002,934,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2010.12.31 11:58:19 | 002,912,360 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2010.12.31 11:58:19 | 002,666,600 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2010.12.31 11:58:19 | 000,386,152 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll [2010.12.31 11:58:19 | 000,319,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll [2010.12.31 11:58:19 | 000,011,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvBridge.kmd [2010.12.31 11:56:28 | 000,000,000 | ---D | C] -- C:\NVIDIA [2010.12.30 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Local\Two Worlds II [2010.12.30 18:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump [2010.12.30 18:53:54 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll [2010.12.30 18:53:54 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll [2010.12.30 18:53:54 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll [2010.12.30 18:53:54 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll [2010.12.30 18:53:52 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll [2010.12.30 18:53:52 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll [2010.12.30 18:53:50 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll [2010.12.30 18:53:50 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll [2010.12.30 18:53:49 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll [2010.12.30 18:53:49 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll [2010.12.30 18:53:47 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll [2010.12.30 18:53:47 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll [2010.12.30 18:53:46 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll [2010.12.30 18:53:46 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll [2010.12.30 18:53:45 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll [2010.12.30 18:53:45 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll [2010.12.30 18:53:42 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll [2010.12.30 18:53:42 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll [2010.12.30 18:53:42 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll [2010.12.30 18:53:42 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll [2010.12.30 18:53:40 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll [2010.12.30 18:53:40 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll [2010.12.30 18:53:39 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll [2010.12.30 18:53:39 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll [2010.12.29 22:27:05 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.12.29 22:27:05 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.12.29 22:27:05 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.12.29 10:25:22 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.12.29 00:53:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya [2010.12.28 21:21:37 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Local\LogMeIn Hamachi [2010.12.28 21:20:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2010.12.28 21:20:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2010.12.28 20:56:07 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2010.12.25 11:51:17 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2010.12.25 11:50:35 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\HTC [2010.12.25 11:49:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC Sync [2010.12.25 11:39:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC [2010.12.25 11:39:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spirent Communications [2010.12.25 11:39:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HTC [2010.12.17 15:02:22 | 000,000,000 | ---D | C] -- C:\Users\Kolja\AppData\Roaming\LizardSystems [2010.12.17 15:02:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LizardSystems [2010.12.17 15:02:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LizardSystems [2010.12.17 14:54:39 | 000,000,000 | ---D | C] -- C:\Users\Kolja\cports [2010.12.16 09:08:26 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskschd.dll [2010.12.16 09:08:26 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmicmiplugin.dll [2010.12.16 09:08:26 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskschd.dll [2010.12.16 09:08:26 | 000,473,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskcomp.dll [2010.12.16 09:08:26 | 000,464,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskeng.exe [2010.12.16 09:08:26 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskcomp.dll [2010.12.16 09:08:26 | 000,285,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\schtasks.exe [2010.12.16 09:08:26 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\schtasks.exe [2010.12.16 09:08:24 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2010.12.16 09:08:24 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2010.12.16 09:08:24 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2010.12.16 09:08:24 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2010.12.16 09:08:22 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll [2010.12.16 09:08:22 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll [2010.12.16 09:08:20 | 000,112,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe [2010.12.16 09:08:16 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2010.12.16 09:08:16 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2010.12.16 09:08:16 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2010.12.16 09:08:15 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2010.12.16 09:08:15 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2010.12.16 09:08:15 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2010.12.16 09:08:15 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2010.12.16 09:08:15 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2010.12.16 09:08:15 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2010.12.16 09:08:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2010.12.16 09:08:15 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2010.12.16 09:08:15 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2010.12.16 09:08:15 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2010.12.16 09:08:15 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2010.12.11 15:28:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kurvenprofi [2010.12.11 15:28:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kurvenprofi [2010.12.11 15:28:24 | 000,884,215 | ---- | C] (Ulrich Strautz ) -- C:\Users\Kolja\Desktop\kurve.exe [2010.12.10 22:28:49 | 000,000,000 | ---D | C] -- C:\Program Files\Pivot Stickfigure Animator [4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.01.05 11:15:09 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.05 11:15:09 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.05 11:10:48 | 000,000,281 | ---- | M] () -- C:\Windows\Brownie.ini [2011.01.05 11:07:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.01.05 11:07:24 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys [2011.01.04 21:27:06 | 000,000,016 | ---- | M] () -- C:\Windows\SysNative\asdict.dat [2011.01.04 21:16:17 | 000,061,186 | ---- | M] () -- C:\ProgramData\bdinstall.bin [2011.01.04 21:13:31 | 000,000,415 | ---- | M] () -- C:\Windows\SysNative\user_gensett.xml [2011.01.04 21:11:05 | 000,002,056 | ---- | M] () -- C:\Users\Public\Desktop\BitDefender Internet Security 2011.lnk [2011.01.04 19:48:39 | 001,675,694 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.01.04 19:48:39 | 000,717,308 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.01.04 19:48:39 | 000,679,496 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.01.04 19:48:39 | 000,153,438 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.01.04 19:48:39 | 000,129,828 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.01.04 18:41:56 | 000,002,562 | ---- | M] () -- C:\Windows\diagwrn.xml [2011.01.04 18:41:56 | 000,001,908 | ---- | M] () -- C:\Windows\diagerr.xml [2010.12.31 12:07:22 | 011,964,416 | ---- | M] () -- C:\ProgramData\sandra.mda [2010.12.31 12:03:34 | 000,000,064 | ---- | M] () -- C:\ProgramData\sandra.ldb [2010.12.30 23:03:52 | 000,000,056 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.12.27 16:40:29 | 000,000,680 | RHS- | M] () -- C:\Users\Kolja\ntuser.pol [2010.12.25 11:50:13 | 000,001,042 | ---- | M] () -- C:\Users\Public\Desktop\HTC Sync.lnk [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.12.20 18:08:40 | 000,024,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.12.17 15:02:23 | 000,001,086 | ---- | M] () -- C:\Users\Kolja\Desktop\Network Scanner.lnk [2010.12.17 13:02:23 | 000,343,144 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.12.11 15:28:24 | 000,884,215 | ---- | M] (Ulrich Strautz ) -- C:\Users\Kolja\Desktop\kurve.exe [4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.01.04 21:27:06 | 000,000,016 | ---- | C] () -- C:\Windows\SysNative\asdict.dat [2011.01.04 21:13:31 | 000,000,415 | ---- | C] () -- C:\Windows\SysNative\user_gensett.xml [2011.01.04 21:11:05 | 000,002,056 | ---- | C] () -- C:\Users\Public\Desktop\BitDefender Internet Security 2011.lnk [2011.01.04 21:00:37 | 000,061,186 | ---- | C] () -- C:\ProgramData\bdinstall.bin [2011.01.04 18:40:26 | 000,002,562 | ---- | C] () -- C:\Windows\diagwrn.xml [2011.01.04 18:40:26 | 000,001,908 | ---- | C] () -- C:\Windows\diagerr.xml [2010.12.31 12:03:32 | 000,000,064 | ---- | C] () -- C:\ProgramData\sandra.ldb [2010.12.30 23:03:52 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.12.25 11:50:13 | 000,001,042 | ---- | C] () -- C:\Users\Public\Desktop\HTC Sync.lnk [2010.12.17 15:02:23 | 000,001,086 | ---- | C] () -- C:\Users\Kolja\Desktop\Network Scanner.lnk [2010.11.07 19:19:54 | 000,003,584 | ---- | C] () -- C:\Users\Kolja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2010.08.24 17:51:53 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll [2010.07.08 09:37:14 | 000,101,544 | ---- | C] () -- C:\Program Files\Common Files\LinkInstaller.exe [2010.07.06 17:25:43 | 000,000,456 | ---- | C] () -- C:\Windows\BeatBox.INI [2010.07.06 17:25:43 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI [2010.07.01 14:07:48 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\mgxasio2.dll [2010.05.26 16:20:35 | 000,000,000 | ---- | C] () -- C:\Users\Kolja\AppData\Local\prvlcl.dat [2010.01.05 13:10:00 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt [2010.01.05 13:07:16 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2009.12.30 13:27:32 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2009.12.30 13:26:25 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini [2009.12.26 13:38:57 | 000,217,088 | ---- | C] () -- C:\Windows\NVGfxOgl.dll [2009.12.25 20:54:31 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI [2009.12.25 20:54:18 | 000,000,151 | ---- | C] () -- C:\Windows\BRVIDEO.INI [2009.12.25 20:54:18 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\brlmw03a.ini [2009.12.25 20:54:18 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini [2009.12.25 20:54:17 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI [2009.12.25 20:52:06 | 000,000,281 | ---- | C] () -- C:\Windows\Brownie.ini [2009.11.06 23:44:30 | 000,007,605 | ---- | C] () -- C:\Users\Kolja\AppData\Local\resmon.resmoncfg [2009.11.06 23:03:49 | 011,964,416 | ---- | C] () -- C:\ProgramData\sandra.mda [2009.11.06 22:25:33 | 001,772,888 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2009.11.06 21:15:48 | 000,327,168 | ---- | C] () -- C:\Windows\SysWow64\cutil32.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.07.03 04:11:18 | 000,007,756 | ---- | C] () -- C:\Windows\cadx2.ini [2008.09.19 00:49:26 | 000,001,209 | ---- | C] () -- C:\Windows\skSPcfg.ini [2008.09.19 00:49:24 | 000,000,381 | ---- | C] () -- C:\Windows\skMCcfg.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0348410E < End of report > |
|
05.01.2011, 22:35
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys Ist unauffällig. Abgesehen von Fund - eher Fehlalarm - sptd.sys noch andere Probleme oder Funde?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Sophos AntiRootkit C:\Windows\System32\drivers\sptd.sys |
| c:\windows, drivers, durchlauf, ergebnisse, freue, gefunde, gefährlich, hidden, lieber, plagt, rootkit, scan, scanne, scannen, sophos, sptd.sys, system, system32, systemdatei, tagen, unerwünschte, unerwünschten, windows, windows\system32\drivers |
Linear-Darstellung
