| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: problem mit BDS/Papras.ABWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.01.2011, 19:48
| #1 |
 |  problem mit BDS/Papras.AB Hallo, ich habe schon von mehreren Mitgliedern hier gelesen, daß sie von BDS/Papras.AB befallen wurden. Er befindet sich bei mir an 2 Orten..Geht das überhaupt?  Ich habe Meldung von Avira bekommen, daß es einmalC:\Windows\system32\dllhethc.dll ist und einmal unter C:\System Volume information\_restore{ewig lange Zahlenkombination}\A0315450.dll Wie werde ich ihn los? Kann ich Ihn überhaupt los werden? Ich habe mir die Antworten der Administratoren durchgelesen und mir daraufhin Load.exe und OTL heruntergeladen. Die Load.exe läßt sich leider nicht starten, da immer die Meldung kommt, es sein keine Internetverbindung offen. Das kann aber nicht sein. Das Internet ist nur seeehr langsam :-( Ich weiß nicht warum, aber das mit dem Proxy Einstellungen habe ich überprüft- das kann es nicht sein.  Ich wollte nachfragen, was ich nun tun soll? Es wäre sehr nett, wenn mir jemand weiterhelfen könnte. |
|
21.01.2011, 01:08
| #2 |
| /// Malwareteam   | problem mit BDS/Papras.AB Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Schritt 2 Rootkit-Suche mit Gmer Was sind Rootkits? Wichtig: Bei jedem Rootkit-Scans soll/en:
Lade Dir Gmer von dieser Seite herunter (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Nun das Logfile in Code-Tags posten. Falls das nicht geht, dann lade Dir von einem anderen Rechner Malwarebytes auf einen USB Stick und kopiere es dann auf den infizierten Rechner und lass es laufen gemäss Anleitung. |
|
21.01.2011, 10:11
| #3 |
| | problem mit BDS/Papras.AB vielen dank für die schnelle Antwort:
__________________Hier ist das Ergebnis der OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.01.2011 10:01:33 - Run 5 OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\***\My Documents\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 1.015,00 Mb Total Physical Memory | 502,00 Mb Available Physical Memory | 49,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free Paging file location(s): C:\pagefile.sys 3000 3000 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 83,79 Gb Total Space | 59,52 Gb Free Space | 71,04% Space Free | Partition Type: NTFS Drive D: | 9,37 Gb Total Space | 9,17 Gb Free Space | 97,86% Space Free | Partition Type: NTFS Drive F: | 61,33 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: NDES00471101000 | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\***\My Documents\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.) PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.) PRC - C:\WINDOWS\system32\PMService.exe (TerraNovum) PRC - C:\Program Files\CyberLink\PowerDVD_5_1_DE\DVDLauncher.exe (CyberLink Corp.) PRC - C:\Program Files\Lotus\Notes\ntmulti.exe (IBM Corp) PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\***\My Documents\Downloads\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (hpdj) -- File not found SRV - (HidServ) -- File not found SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirFirewallService) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (NICCONFIGSVC) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.) SRV - (DWMRCS) -- C:\WINDOWS\System32\DWRCS.exe (DameWare Development LLC) SRV - (SavRoam) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\SavRoam.exe (symantec) SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Rtvscan.exe (Symantec Corporation) SRV - (DefWatch) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\DefWatch.exe (Symantec Corporation) SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation) SRV - (ccPwdSvc) -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation) SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation) SRV - (SNDSrvc) -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation) SRV - (SPBBCSvc) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation) SRV - (EPA_GPO_PMService) Energy Star(TM) -- C:\WINDOWS\system32\PMService.exe (TerraNovum) SRV - (BBDistHandler) -- C:\maint\sid\DISTH\DISTH.EXE (IBM) SRV - (Multi-user Cleanup Service) -- C:\Program Files\lotus\notes\ntmulti.exe (IBM Corp) SRV - (Lotus Notes Single Logon) -- C:\WINDOWS\system32\nslsvice.exe (IBM Corp) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avfwot) -- C:\WINDOWS\system32\drivers\avfwot.sys (Avira GmbH) DRV - (avfwim) -- C:\WINDOWS\system32\drivers\avfwim.sys (Avira GmbH) DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101214.001\navex15.sys (Symantec Corporation) DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101214.001\naveng.sys (Symantec Corporation) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\eengine\eeCtrl.sys (Symantec Corporation) DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc) DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.) DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.) DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.) DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation) DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation) DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation) DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation) DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation) DRV - (STAC97) -- C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.) DRV - (SAVRTPEL) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Savrtpel.sys (Symantec Corporation) DRV - (SAVRT) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\savrt.sys (Symantec Corporation) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (fpcmbase) -- C:\WINDOWS\system32\drivers\fpcmbase.sys (AVM Berlin) DRV - (AVMCOWAN) -- C:\WINDOWS\system32\drivers\avmcowan.sys (AVM GmbH) DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation) DRV - (GTIPCI21) -- C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments) DRV - (AVMWAN) -- C:\WINDOWS\system32\drivers\avmwan.sys (AVM GmbH) DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google Toolbar IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google Toolbar IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:1.0.0 FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.27 15:40:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.10 10:21:15 | 000,000,000 | ---D | M] [2010.06.23 17:14:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Extensions [2011.01.20 19:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions [2010.06.24 12:12:08 | 000,000,000 | ---D | M] (Winload Toolbar) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2010.06.24 12:12:06 | 000,000,000 | ---D | M] (Mein Gutscheincode Finder) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions\finder@meingutscheincode.de [2010.03.24 15:13:02 | 000,000,917 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\cmo0higa.default\searchplugins\conduit.xml [2010.06.23 17:14:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010.09.27 18:50:31 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.27 18:50:31 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.27 18:50:31 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.27 18:50:31 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.27 18:50:31 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.01.19 10:52:28 | 000,426,903 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 007guard.com - 007guard and Free Antivirus O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 cash advance debt consolidation insurance at 0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 14704 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: () - {1DA617DD-BB7B-40ED-8EB6-5919719D2BB2} - C:\MSYS\kpbho.dll () O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [ACSrun] C:\WINDOWS\System32\usrlogon.bat () O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD_5_1_DE\DVDLauncher.exe (CyberLink Corp.) O4 - HKLM..\Run: [EPA_EZ_GPO_Tool] C:\WINDOWS\system32\EZ_GPO_Tool.exe (Environmental Protection Agency) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft\Office_XP_XL\Office10\EXCEL.EXE (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O15 - HKLM\..Trusted Ranges: Range1 ([http] in Trusted sites) O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation) O24 - Desktop Components:AutorunsDisabled () - O24 - Desktop WallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008.07.07 21:46:00 | 000,000,113 | R--- | M] () - F:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell - "" = AutoRun O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell - "" = AutoRun O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.LEAD - LCODCCMP.DLL File not found Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation) Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation) Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2011.01.20 19:43:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Malwarebytes [2011.01.20 19:38:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2011.01.20 19:38:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.01.20 19:38:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2011.01.20 19:38:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.01.20 19:38:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.01.20 14:55:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome [2011.01.20 14:17:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler [2011.01.20 14:17:40 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2011.01.20 13:41:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\MFTools [2011.01.20 10:43:30 | 000,000,000 | ---D | C] -- C:\TUWINBAU [2011.01.20 10:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Uniblue [2011.01.20 10:23:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Local Settings\Application Data\PackageAware [2011.01.20 09:18:04 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2 [2011.01.20 09:15:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF [2011.01.19 10:57:38 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games [2011.01.18 18:37:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch [2011.01.18 18:07:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\Program Files\msn [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en [2011.01.18 18:07:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits [2011.01.18 18:00:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic [2011.01.18 17:54:02 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$ [2011.01.18 07:26:49 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\***\Recent [2011.01.10 12:41:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\My Documents\lego [2011.01.02 05:25:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\malte [2010.12.30 16:25:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\arne [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.01.21 09:43:03 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini [2011.01.21 09:36:02 | 000,001,110 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.01.21 09:27:56 | 000,002,557 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Connect.lnk [2011.01.20 21:23:27 | 000,000,374 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics [2011.01.20 21:22:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.01.20 21:22:28 | 000,001,106 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.01.20 21:22:14 | 1064,755,200 | -HS- | M] () -- C:\hiberfil.sys [2011.01.20 21:22:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.01.20 20:39:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.01.20 19:38:49 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.20 15:09:11 | 000,000,659 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit OTL.exe.lnk [2011.01.20 14:55:04 | 000,001,819 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk [2011.01.20 14:55:04 | 000,001,797 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2011.01.20 14:53:01 | 000,002,385 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word XP XL.lnk [2011.01.20 14:17:43 | 000,001,586 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk [2011.01.20 09:26:30 | 000,000,806 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011.01.20 09:26:29 | 000,000,788 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Windows Media Player.lnk [2011.01.20 09:22:56 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb [2011.01.20 09:22:56 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb [2011.01.20 09:16:59 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2011.01.20 09:15:56 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.01.19 12:20:55 | 000,435,172 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.01.19 12:20:55 | 000,069,162 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.01.19 12:18:04 | 000,169,896 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.01.19 11:07:15 | 000,000,943 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit msimn.exe.lnk [2011.01.19 10:52:28 | 000,426,903 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2011.01.19 10:01:16 | 000,000,536 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\alice2.lnk [2011.01.19 09:34:37 | 000,001,509 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Paint.lnk [2011.01.18 18:41:06 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf [2011.01.18 18:41:02 | 000,000,785 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2011.01.18 18:00:13 | 000,250,048 | RHS- | M] () -- C:\ntldr [2011.01.18 16:28:09 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Benutzerdokumentation Notes R651.lnk [2011.01.18 07:40:59 | 171,083,144 | ---- | M] () -- C:\Documents and Settings\***\My Documents\DJ_AIO_NonNetwork_DEU_NB.exe [2011.01.15 07:17:34 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.01.10 08:18:28 | 000,002,367 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Word XP XL.lnk [2011.01.09 16:08:05 | 000,530,264 | ---- | M] () -- C:\Documents and Settings\***\My Documents\P1070205.jpg [2011.01.09 15:06:38 | 000,002,511 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vodafone SMS.lnk [2011.01.06 08:08:21 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2011.01.03 19:00:31 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Magdalene Kowalski.doc [2011.01.01 12:36:45 | 000,015,273 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Kalos_Bereifung_EGBE_Juni_2010.pdf [2010.12.31 10:51:58 | 001,295,148 | ---- | M] () -- C:\Documents and Settings\***\My Documents\anmeldung_kiga.rtf [2010.12.30 16:38:56 | 000,000,041 | ---- | M] () -- C:\WINDOWS\System32\Filzip.ini [2010.12.30 15:09:30 | 000,002,355 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Excel XP XL.lnk [2010.12.27 11:04:54 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.01.20 19:38:49 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.20 15:09:11 | 000,000,659 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit OTL.exe.lnk [2011.01.20 14:55:04 | 000,001,819 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk [2011.01.20 14:55:04 | 000,001,797 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2011.01.20 14:17:43 | 000,001,586 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk [2011.01.20 09:26:29 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Windows Media Player.lnk [2011.01.20 09:18:11 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011.01.20 09:15:56 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.01.19 11:07:15 | 000,000,943 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit msimn.exe.lnk [2011.01.19 10:01:16 | 000,000,536 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\alice2.lnk [2011.01.18 18:41:06 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf [2011.01.18 18:40:58 | 000,000,785 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2011.01.18 16:28:09 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Benutzerdokumentation Notes R651.lnk [2011.01.09 16:08:04 | 000,530,264 | ---- | C] () -- C:\Documents and Settings\***\My Documents\P1070205.jpg [2011.01.07 04:54:02 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2011.01.03 19:00:30 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\***\My Documents\Magdalene Kowalski.doc [2011.01.01 12:36:45 | 000,015,273 | ---- | C] () -- C:\Documents and Settings\***\My Documents\Kalos_Bereifung_EGBE_Juni_2010.pdf [2010.12.31 10:51:57 | 001,295,148 | ---- | C] () -- C:\Documents and Settings\***\My Documents\anmeldung_kiga.rtf [2010.12.27 15:36:41 | 000,001,608 | ---- | C] () -- C:\Documents and Settings\***\Desktop\internt.lnk [2010.12.20 13:05:26 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini [2010.11.16 10:54:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\VPMAB.INI [2010.06.29 10:24:37 | 000,000,363 | ---- | C] () -- C:\WINDOWS\axabt.ini [2010.06.29 10:24:37 | 000,000,052 | ---- | C] () -- C:\WINDOWS\axae.ini [2010.06.29 10:24:35 | 000,006,344 | ---- | C] () -- C:\WINDOWS\alias.ini [2010.06.29 10:24:29 | 000,000,311 | ---- | C] () -- C:\WINDOWS\VPMS.INI [2010.06.29 10:24:28 | 000,005,184 | ---- | C] () -- C:\WINDOWS\vfrx.ini [2010.06.24 14:51:34 | 000,000,031 | ---- | C] () -- C:\WINDOWS\wininit.ini [2009.12.31 08:59:43 | 000,012,240 | ---- | C] () -- C:\WINDOWS\hpdj5100.ini [2009.12.31 08:57:47 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\fusioncache.dat [2009.12.30 11:45:22 | 000,001,459 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log [2009.06.21 06:41:02 | 003,195,904 | ---- | C] () -- C:\Program Files\Common FilesDDBACSetup.msi [2009.04.05 18:29:33 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.04.05 15:05:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI [2008.06.23 12:02:02 | 000,097,410 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4 [2008.05.23 16:48:50 | 000,020,270 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DeviceInstaller.xml [2007.11.15 20:27:40 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\dnt27VC8.dll [2007.11.15 20:25:28 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\dntvmc27VC8.dll [2007.11.15 20:25:12 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dntvm27VC8.dll [2006.10.11 14:48:59 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini [2006.10.11 13:43:13 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\implode.dll [2006.09.20 10:06:45 | 000,003,530 | ---- | C] () -- C:\WINDOWS\Kvdkv.ini [2006.09.20 10:06:45 | 000,000,025 | ---- | C] () -- C:\WINDOWS\KuDaBa.ini [2006.09.19 15:48:18 | 000,048,640 | ---- | C] () -- C:\Program Files\lv1871.exe [2006.09.19 15:48:18 | 000,000,766 | ---- | C] () -- C:\Program Files\LV1871h.ico [2006.09.19 13:38:42 | 000,000,309 | ---- | C] () -- C:\WINDOWS\BFDEINST.INI [2006.09.19 13:38:35 | 000,180,660 | ---- | C] () -- C:\WINDOWS\System32\KPXLS16.DLL [2006.09.19 13:38:34 | 000,304,640 | ---- | C] () -- C:\WINDOWS\System32\KPRPID32.DLL [2006.09.19 13:38:34 | 000,195,072 | ---- | C] () -- C:\WINDOWS\System32\Msodeger.dll [2006.09.19 13:38:34 | 000,157,404 | ---- | C] () -- C:\WINDOWS\System32\KPFILES.DLL [2006.09.19 13:38:33 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll [2006.09.19 13:32:08 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\Regadll.dll [2006.09.19 08:38:52 | 000,000,019 | ---- | C] () -- C:\WINDOWS\restart.ini [2006.09.19 08:38:35 | 000,000,252 | ---- | C] () -- C:\WINDOWS\caf.ini [2006.09.19 08:38:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BONNDATA.INI [2006.09.19 08:34:36 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\msvcrt10.dll [2006.09.19 08:34:36 | 000,042,520 | ---- | C] () -- C:\WINDOWS\System32\WSQLCALT.DLL [2006.09.19 08:34:35 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\ASdown.DLL [2006.08.28 16:14:11 | 000,004,730 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.08.28 14:58:41 | 000,000,040 | ---- | C] () -- C:\WINDOWS\nova.ini [2006.08.28 14:48:22 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.03.29 11:47:24 | 000,008,671 | ---- | C] () -- C:\WINDOWS\System32\Dwrcs.ini [2005.04.27 19:38:00 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\hpzidi01.dll [2004.09.27 13:37:46 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\PMevents.dll [2001.10.28 16:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [1997.05.12 23:00:00 | 001,664,272 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL [1997.05.12 23:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL [1997.05.12 23:00:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL [1980.01.01 01:00:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll [1980.01.01 01:00:00 | 000,000,162 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI ========== LOP Check ========== [2009.07.18 14:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AdventureChronicles1 [2009.12.29 14:38:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alawar Stargaze [2009.10.07 10:48:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Becky Brogan [2009.05.29 11:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Black Blob Studios [2009.10.13 15:29:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CasualForge [2009.12.20 10:55:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum2 [2009.05.18 13:51:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Far Mills [2010.10.24 16:20:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Farm Fishes [2009.07.31 09:17:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FarmFrenzy2 [2009.09.27 14:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FarmFrenzy3 [2009.09.30 12:07:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\fillup [2009.09.30 12:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fugazo [2009.09.30 12:40:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\game_fillup_ger [2009.09.05 13:59:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gogii [2009.10.12 13:08:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare [2009.07.25 08:34:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HipSoft [2009.09.01 16:41:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IntDreams [2006.08.28 15:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ISDNWatch [2010.02.10 13:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kristanix Games [2009.06.16 09:59:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lexware [2009.09.28 08:08:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Little Games Company [2006.08.28 14:56:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lotus [2009.10.04 10:21:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Merscom [2009.07.05 07:12:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MythPeople [2009.08.31 13:03:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NevoSoft Games [2009.10.31 11:01:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst [2009.10.03 18:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Princess Isabella [2009.09.21 13:24:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games [2009.08.11 09:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Shockwave [2010.05.15 17:51:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009.06.28 11:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UClick [2010.04.13 06:34:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vodafone [2009.06.16 09:58:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\World Money [2009.09.06 13:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom [2009.09.26 13:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Aisle 5 Games, Inc [2010.06.15 08:03:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Artogon [2009.11.03 14:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Azuaz Games [2009.07.12 12:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Big Fish Games [2009.04.01 19:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Boolat Games [2009.06.21 11:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\BrandX Games [2009.08.30 08:40:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Camel101 [2009.10.13 15:29:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CasualForge [2009.08.03 16:41:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CatmoonGames [2009.06.16 10:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\DataDesign [2009.12.29 12:16:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dekovir [2009.06.12 13:41:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dream Farm Games [2006.09.19 13:06:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ELAXY [2009.09.07 15:05:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\EleFun Games [2009.07.04 14:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Enchanted Katya [2009.05.19 11:07:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\FirstColony [2009.04.08 12:54:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\FRITZ! [2009.09.21 12:42:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Gaijin Ent [2009.09.05 12:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Gamelab [2009.06.10 12:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\HiT-MM [2009.10.04 09:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\IronCode [2009.09.21 13:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\iWin [2010.06.11 10:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Janes Realty2 [2010.07.15 12:43:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\KIDDINX [2006.10.11 17:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Leadertech [2009.06.16 09:57:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Lexware [2009.09.28 08:08:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Little Games Company [2009.08.22 18:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Lost in the City [2010.11.12 17:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Luupuw [2009.08.23 15:47:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Meridian93 [2006.10.11 14:47:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\PDFCreator [2009.09.08 08:32:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Peace Craft [2009.10.31 11:01:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\PlayFirst [2009.08.03 18:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ShinyTales [2009.08.11 09:09:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Shockwave [2010.10.15 07:35:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\TeamViewer [2009.06.28 11:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\UClick [2011.01.20 10:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Uniblue [2009.05.29 12:27:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ViquaSoft [2010.04.13 06:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Vodafone [2009.05.06 17:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Volkswohl Bund [2009.05.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\World-LooM [2009.06.21 13:29:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\YoudaGames [2010.11.12 17:34:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Yvra [2009.09.21 12:42:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Zylom ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2011.01.06 08:08:21 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2006.08.28 15:55:54 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2010.11.22 04:26:07 | 000,000,000 | ---- | M] () -- C:\data [2002.12.19 23:00:00 | 000,053,248 | ---- | M] () -- C:\gendel32.exe [2011.01.20 21:22:14 | 1064,755,200 | -HS- | M] () -- C:\hiberfil.sys [2010.04.12 10:16:05 | 000,010,942 | ---- | M] () -- C:\hpfr5100.log [2010.12.08 14:20:39 | 001,048,491 | ---- | M] () -- C:\immudebug.log [2006.08.28 14:24:20 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2010.10.05 21:01:57 | 000,000,486 | ---- | M] () -- C:\LOG4D.log [2009.04.19 06:24:24 | 000,004,208 | ---- | M] () -- C:\mmisscriptprotokoll.txt [2009.04.19 06:24:25 | 000,000,002 | ---- | M] () -- C:\mmxmlparserprotokoll.txt [2006.08.28 14:24:20 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.10.16 04:30:18 | 000,000,029 | ---- | M] () -- C:\Nina.cfg [2004.08.03 23:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2011.01.18 18:00:13 | 000,250,048 | RHS- | M] () -- C:\ntldr [2011.01.20 21:22:12 | 3145,728,000 | -HS- | M] () -- C:\pagefile.sys [2009.07.20 12:34:34 | 000,013,030 | ---- | M] () -- C:\PDOXUSRS.NET [2009.09.07 10:42:33 | 000,002,827 | ---- | M] () -- C:\RESET.log [2008.09.26 15:52:17 | 000,034,294 | ---- | M] () -- C:\setup.log [1 C:\*.tmp files -> C:\*.tmp -> ] < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont [2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont < %systemroot%\Fonts\*.dll > [2005.05.11 23:36:48 | 000,012,288 | ---- | M] (Hewlett-Packard Co.) -- C:\WINDOWS\Fonts\RandFont.dll < %systemroot%\Fonts\*.ini > [2006.08.28 14:23:50 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2007.03.22 20:24:58 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll [2005.05.10 20:48:48 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll [2007.03.28 12:57:34 | 000,274,944 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5ha.dll [2008.07.06 11:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > [2008.06.24 17:11:31 | 000,783,360 | ---- | M] () -- C:\WINDOWS\KPSAVER.SCR [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > [2009.08.24 11:01:44 | 000,001,538 | -H-- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\LastFlashConfig.WFC < %PROGRAMFILES%\*.* > [2009.06.21 06:41:04 | 003,195,904 | ---- | M] () -- C:\Program Files\Common FilesDDBACSetup.msi [2006.08.07 13:29:44 | 000,048,640 | ---- | M] () -- C:\Program Files\lv1871.exe [2006.04.26 14:28:06 | 000,000,766 | ---- | M] () -- C:\Program Files\LV1871h.ico [2011.01.21 09:32:16 | 000,007,680 | -HS- | M] () -- C:\Program Files\Thumbs.db < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.08.28 16:11:42 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2006.08.28 16:11:42 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2006.08.28 16:11:42 | 000,909,312 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\system32\user32.dll /md5 > [2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\system32\ws2_32.dll /md5 > [2008.04.14 01:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\system32\ws2help.dll /md5 > [2008.04.14 01:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe [2004.08.04 01:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: WINLOGON.EXE > [2004.08.04 01:56:58 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-21 03:50:15 < > ========== Alternate Data Streams ========== @Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6E86D926 @Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C07A6A6B @Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4363DE71 @Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C22674B6 @Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F84B8DB5 @Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3B8F70C @Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A688EF17 @Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A00BCDEF @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F41F8101 @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:425759C6 @Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8140CB50 @Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D2397415 @Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDCD0530 @Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:385E2CFD @Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:80B291A7 @Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:569CEE83 @Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3E06C78F @Alternate Data Stream - 196 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B6DD2C7E @Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0487F955 @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:28CDD861 @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457 @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89C28CF6 @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9026FFAC @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:61AF2B29 @Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AD727397 @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D0D17155 @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CF76F21 @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:551BED5F @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7CEDF9F3 @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35C78DCC @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765 @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69E3AF64 @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EC0A74A1 @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4A1628E5 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:059167AF @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0FEE2B @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B52659E @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3D36932D @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:237E4B91 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DF68137 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:471AD3D0 @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FECEF728 @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C928F3BE @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6BF0805F @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2CDB9CA3 @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A6346EE9 @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6444B424 @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:33EA030E @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BC498A4 @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:97C4F81F @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7881FECE @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6FE17A89 @Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D2032EBB @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F2AF86D9 @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:67BA17B9 @Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D0668210 @Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F44D3C53 @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8F067037 < End of report > |
|
21.01.2011, 10:11
| #4 |
| | problem mit BDS/Papras.AB vielen dank für die schnelle Antwort: Hier ist das Ergebnis der OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.01.2011 10:01:33 - Run 5 OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\***\My Documents\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 1.015,00 Mb Total Physical Memory | 502,00 Mb Available Physical Memory | 49,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free Paging file location(s): C:\pagefile.sys 3000 3000 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 83,79 Gb Total Space | 59,52 Gb Free Space | 71,04% Space Free | Partition Type: NTFS Drive D: | 9,37 Gb Total Space | 9,17 Gb Free Space | 97,86% Space Free | Partition Type: NTFS Drive F: | 61,33 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: NDES00471101000 | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\***\My Documents\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.) PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.) PRC - C:\WINDOWS\system32\PMService.exe (TerraNovum) PRC - C:\Program Files\CyberLink\PowerDVD_5_1_DE\DVDLauncher.exe (CyberLink Corp.) PRC - C:\Program Files\Lotus\Notes\ntmulti.exe (IBM Corp) PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\***\My Documents\Downloads\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (hpdj) -- File not found SRV - (HidServ) -- File not found SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirFirewallService) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (NICCONFIGSVC) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.) SRV - (DWMRCS) -- C:\WINDOWS\System32\DWRCS.exe (DameWare Development LLC) SRV - (SavRoam) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\SavRoam.exe (symantec) SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Rtvscan.exe (Symantec Corporation) SRV - (DefWatch) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\DefWatch.exe (Symantec Corporation) SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation) SRV - (ccPwdSvc) -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation) SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation) SRV - (SNDSrvc) -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation) SRV - (SPBBCSvc) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation) SRV - (EPA_GPO_PMService) Energy Star(TM) -- C:\WINDOWS\system32\PMService.exe (TerraNovum) SRV - (BBDistHandler) -- C:\maint\sid\DISTH\DISTH.EXE (IBM) SRV - (Multi-user Cleanup Service) -- C:\Program Files\lotus\notes\ntmulti.exe (IBM Corp) SRV - (Lotus Notes Single Logon) -- C:\WINDOWS\system32\nslsvice.exe (IBM Corp) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avfwot) -- C:\WINDOWS\system32\drivers\avfwot.sys (Avira GmbH) DRV - (avfwim) -- C:\WINDOWS\system32\drivers\avfwim.sys (Avira GmbH) DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101214.001\navex15.sys (Symantec Corporation) DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101214.001\naveng.sys (Symantec Corporation) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\eengine\eeCtrl.sys (Symantec Corporation) DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc) DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.) DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.) DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.) DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation) DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation) DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation) DRV - (SymEvent) -- C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation) DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation) DRV - (STAC97) -- C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.) DRV - (SAVRTPEL) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Savrtpel.sys (Symantec Corporation) DRV - (SAVRT) -- C:\Program Files\Symantec\Symantec_Antivirus_10_DE\savrt.sys (Symantec Corporation) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (fpcmbase) -- C:\WINDOWS\system32\drivers\fpcmbase.sys (AVM Berlin) DRV - (AVMCOWAN) -- C:\WINDOWS\system32\drivers\avmcowan.sys (AVM GmbH) DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation) DRV - (GTIPCI21) -- C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments) DRV - (AVMWAN) -- C:\WINDOWS\system32\drivers\avmwan.sys (AVM GmbH) DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google Toolbar IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google Toolbar IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:1.0.0 FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.27 15:40:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.10 10:21:15 | 000,000,000 | ---D | M] [2010.06.23 17:14:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Extensions [2011.01.20 19:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions [2010.06.24 12:12:08 | 000,000,000 | ---D | M] (Winload Toolbar) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2010.06.24 12:12:06 | 000,000,000 | ---D | M] (Mein Gutscheincode Finder) -- C:\Documents and Settings\***\Application Data\mozilla\Firefox\Profiles\cmo0higa.default\extensions\finder@meingutscheincode.de [2010.03.24 15:13:02 | 000,000,917 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\cmo0higa.default\searchplugins\conduit.xml [2010.06.23 17:14:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010.09.27 18:50:31 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.09.27 18:50:31 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2010.09.27 18:50:31 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.09.27 18:50:31 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.09.27 18:50:31 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.01.19 10:52:28 | 000,426,903 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 007guard.com - 007guard and Free Antivirus O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 cash advance debt consolidation insurance at 0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 14704 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: () - {1DA617DD-BB7B-40ED-8EB6-5919719D2BB2} - C:\MSYS\kpbho.dll () O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [ACSrun] C:\WINDOWS\System32\usrlogon.bat () O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD_5_1_DE\DVDLauncher.exe (CyberLink Corp.) O4 - HKLM..\Run: [EPA_EZ_GPO_Tool] C:\WINDOWS\system32\EZ_GPO_Tool.exe (Environmental Protection Agency) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft\Office_XP_XL\Office10\EXCEL.EXE (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O15 - HKLM\..Trusted Ranges: Range1 ([http] in Trusted sites) O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation) O24 - Desktop Components:AutorunsDisabled () - O24 - Desktop WallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008.07.07 21:46:00 | 000,000,113 | R--- | M] () - F:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell - "" = AutoRun O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell - "" = AutoRun O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell - "" = AutoRun O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone) O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.LEAD - LCODCCMP.DLL File not found Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation) Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation) Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902109354000384) ========== Files/Folders - Created Within 30 Days ========== [2011.01.20 19:43:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Malwarebytes [2011.01.20 19:38:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2011.01.20 19:38:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.01.20 19:38:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2011.01.20 19:38:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.01.20 19:38:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.01.20 14:55:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome [2011.01.20 14:17:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler [2011.01.20 14:17:40 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2011.01.20 13:41:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\MFTools [2011.01.20 10:43:30 | 000,000,000 | ---D | C] -- C:\TUWINBAU [2011.01.20 10:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Uniblue [2011.01.20 10:23:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Local Settings\Application Data\PackageAware [2011.01.20 09:18:04 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2 [2011.01.20 09:15:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF [2011.01.19 10:57:38 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games [2011.01.18 18:37:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch [2011.01.18 18:07:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\Program Files\msn [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas [2011.01.18 18:07:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en [2011.01.18 18:07:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits [2011.01.18 18:00:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic [2011.01.18 17:54:02 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$ [2011.01.18 07:26:49 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\***\Recent [2011.01.10 12:41:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\My Documents\lego [2011.01.02 05:25:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\malte [2010.12.30 16:25:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Desktop\arne [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.01.21 09:43:03 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini [2011.01.21 09:36:02 | 000,001,110 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.01.21 09:27:56 | 000,002,557 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Connect.lnk [2011.01.20 21:23:27 | 000,000,374 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics [2011.01.20 21:22:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.01.20 21:22:28 | 000,001,106 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.01.20 21:22:14 | 1064,755,200 | -HS- | M] () -- C:\hiberfil.sys [2011.01.20 21:22:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.01.20 20:39:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.01.20 19:38:49 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.20 15:09:11 | 000,000,659 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit OTL.exe.lnk [2011.01.20 14:55:04 | 000,001,819 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk [2011.01.20 14:55:04 | 000,001,797 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2011.01.20 14:53:01 | 000,002,385 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word XP XL.lnk [2011.01.20 14:17:43 | 000,001,586 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk [2011.01.20 09:26:30 | 000,000,806 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011.01.20 09:26:29 | 000,000,788 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Windows Media Player.lnk [2011.01.20 09:22:56 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb [2011.01.20 09:22:56 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb [2011.01.20 09:16:59 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2011.01.20 09:15:56 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.01.19 12:20:55 | 000,435,172 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.01.19 12:20:55 | 000,069,162 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.01.19 12:18:04 | 000,169,896 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.01.19 11:07:15 | 000,000,943 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit msimn.exe.lnk [2011.01.19 10:52:28 | 000,426,903 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2011.01.19 10:01:16 | 000,000,536 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\alice2.lnk [2011.01.19 09:34:37 | 000,001,509 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Paint.lnk [2011.01.18 18:41:06 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf [2011.01.18 18:41:02 | 000,000,785 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2011.01.18 18:00:13 | 000,250,048 | RHS- | M] () -- C:\ntldr [2011.01.18 16:28:09 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\***\Desktop\Benutzerdokumentation Notes R651.lnk [2011.01.18 07:40:59 | 171,083,144 | ---- | M] () -- C:\Documents and Settings\***\My Documents\DJ_AIO_NonNetwork_DEU_NB.exe [2011.01.15 07:17:34 | 000,022,016 | ---- | M] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.01.10 08:18:28 | 000,002,367 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Word XP XL.lnk [2011.01.09 16:08:05 | 000,530,264 | ---- | M] () -- C:\Documents and Settings\***\My Documents\P1070205.jpg [2011.01.09 15:06:38 | 000,002,511 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vodafone SMS.lnk [2011.01.06 08:08:21 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2011.01.03 19:00:31 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Magdalene Kowalski.doc [2011.01.01 12:36:45 | 000,015,273 | ---- | M] () -- C:\Documents and Settings\***\My Documents\Kalos_Bereifung_EGBE_Juni_2010.pdf [2010.12.31 10:51:58 | 001,295,148 | ---- | M] () -- C:\Documents and Settings\***\My Documents\anmeldung_kiga.rtf [2010.12.30 16:38:56 | 000,000,041 | ---- | M] () -- C:\WINDOWS\System32\Filzip.ini [2010.12.30 15:09:30 | 000,002,355 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Excel XP XL.lnk [2010.12.27 11:04:54 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.01.20 19:38:49 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.20 15:09:11 | 000,000,659 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit OTL.exe.lnk [2011.01.20 14:55:04 | 000,001,819 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk [2011.01.20 14:55:04 | 000,001,797 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2011.01.20 14:17:43 | 000,001,586 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk [2011.01.20 09:26:29 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Windows Media Player.lnk [2011.01.20 09:18:11 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011.01.20 09:15:56 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.01.19 11:07:15 | 000,000,943 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Verknüpfung mit msimn.exe.lnk [2011.01.19 10:01:16 | 000,000,536 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\alice2.lnk [2011.01.18 18:41:06 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop anzeigen.scf [2011.01.18 18:40:58 | 000,000,785 | ---- | C] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2011.01.18 16:28:09 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\***\Desktop\Benutzerdokumentation Notes R651.lnk [2011.01.09 16:08:04 | 000,530,264 | ---- | C] () -- C:\Documents and Settings\***\My Documents\P1070205.jpg [2011.01.07 04:54:02 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK [2011.01.03 19:00:30 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\***\My Documents\Magdalene Kowalski.doc [2011.01.01 12:36:45 | 000,015,273 | ---- | C] () -- C:\Documents and Settings\***\My Documents\Kalos_Bereifung_EGBE_Juni_2010.pdf [2010.12.31 10:51:57 | 001,295,148 | ---- | C] () -- C:\Documents and Settings\***\My Documents\anmeldung_kiga.rtf [2010.12.27 15:36:41 | 000,001,608 | ---- | C] () -- C:\Documents and Settings\***\Desktop\internt.lnk [2010.12.20 13:05:26 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini [2010.11.16 10:54:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\VPMAB.INI [2010.06.29 10:24:37 | 000,000,363 | ---- | C] () -- C:\WINDOWS\axabt.ini [2010.06.29 10:24:37 | 000,000,052 | ---- | C] () -- C:\WINDOWS\axae.ini [2010.06.29 10:24:35 | 000,006,344 | ---- | C] () -- C:\WINDOWS\alias.ini [2010.06.29 10:24:29 | 000,000,311 | ---- | C] () -- C:\WINDOWS\VPMS.INI [2010.06.29 10:24:28 | 000,005,184 | ---- | C] () -- C:\WINDOWS\vfrx.ini [2010.06.24 14:51:34 | 000,000,031 | ---- | C] () -- C:\WINDOWS\wininit.ini [2009.12.31 08:59:43 | 000,012,240 | ---- | C] () -- C:\WINDOWS\hpdj5100.ini [2009.12.31 08:57:47 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\fusioncache.dat [2009.12.30 11:45:22 | 000,001,459 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log [2009.06.21 06:41:02 | 003,195,904 | ---- | C] () -- C:\Program Files\Common FilesDDBACSetup.msi [2009.04.05 18:29:33 | 000,022,016 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.04.05 15:05:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI [2008.06.23 12:02:02 | 000,097,410 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4 [2008.05.23 16:48:50 | 000,020,270 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DeviceInstaller.xml [2007.11.15 20:27:40 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\dnt27VC8.dll [2007.11.15 20:25:28 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\dntvmc27VC8.dll [2007.11.15 20:25:12 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dntvm27VC8.dll [2006.10.11 14:48:59 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini [2006.10.11 13:43:13 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\implode.dll [2006.09.20 10:06:45 | 000,003,530 | ---- | C] () -- C:\WINDOWS\Kvdkv.ini [2006.09.20 10:06:45 | 000,000,025 | ---- | C] () -- C:\WINDOWS\KuDaBa.ini [2006.09.19 15:48:18 | 000,048,640 | ---- | C] () -- C:\Program Files\lv1871.exe [2006.09.19 15:48:18 | 000,000,766 | ---- | C] () -- C:\Program Files\LV1871h.ico [2006.09.19 13:38:42 | 000,000,309 | ---- | C] () -- C:\WINDOWS\BFDEINST.INI [2006.09.19 13:38:35 | 000,180,660 | ---- | C] () -- C:\WINDOWS\System32\KPXLS16.DLL [2006.09.19 13:38:34 | 000,304,640 | ---- | C] () -- C:\WINDOWS\System32\KPRPID32.DLL [2006.09.19 13:38:34 | 000,195,072 | ---- | C] () -- C:\WINDOWS\System32\Msodeger.dll [2006.09.19 13:38:34 | 000,157,404 | ---- | C] () -- C:\WINDOWS\System32\KPFILES.DLL [2006.09.19 13:38:33 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll [2006.09.19 13:32:08 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\Regadll.dll [2006.09.19 08:38:52 | 000,000,019 | ---- | C] () -- C:\WINDOWS\restart.ini [2006.09.19 08:38:35 | 000,000,252 | ---- | C] () -- C:\WINDOWS\caf.ini [2006.09.19 08:38:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BONNDATA.INI [2006.09.19 08:34:36 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\msvcrt10.dll [2006.09.19 08:34:36 | 000,042,520 | ---- | C] () -- C:\WINDOWS\System32\WSQLCALT.DLL [2006.09.19 08:34:35 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\ASdown.DLL [2006.08.28 16:14:11 | 000,004,730 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.08.28 14:58:41 | 000,000,040 | ---- | C] () -- C:\WINDOWS\nova.ini [2006.08.28 14:48:22 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.03.29 11:47:24 | 000,008,671 | ---- | C] () -- C:\WINDOWS\System32\Dwrcs.ini [2005.04.27 19:38:00 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\hpzidi01.dll [2004.09.27 13:37:46 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\PMevents.dll [2001.10.28 16:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [1997.05.12 23:00:00 | 001,664,272 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL [1997.05.12 23:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL [1997.05.12 23:00:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL [1980.01.01 01:00:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll [1980.01.01 01:00:00 | 000,000,162 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI ========== LOP Check ========== [2009.07.18 14:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AdventureChronicles1 [2009.12.29 14:38:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alawar Stargaze [2009.10.07 10:48:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Becky Brogan [2009.05.29 11:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Black Blob Studios [2009.10.13 15:29:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CasualForge [2009.12.20 10:55:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum2 [2009.05.18 13:51:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Far Mills [2010.10.24 16:20:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Farm Fishes [2009.07.31 09:17:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FarmFrenzy2 [2009.09.27 14:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FarmFrenzy3 [2009.09.30 12:07:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\fillup [2009.09.30 12:41:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fugazo [2009.09.30 12:40:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\game_fillup_ger [2009.09.05 13:59:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gogii [2009.10.12 13:08:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare [2009.07.25 08:34:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HipSoft [2009.09.01 16:41:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IntDreams [2006.08.28 15:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ISDNWatch [2010.02.10 13:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kristanix Games [2009.06.16 09:59:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lexware [2009.09.28 08:08:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Little Games Company [2006.08.28 14:56:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lotus [2009.10.04 10:21:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Merscom [2009.07.05 07:12:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MythPeople [2009.08.31 13:03:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NevoSoft Games [2009.10.31 11:01:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst [2009.10.03 18:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Princess Isabella [2009.09.21 13:24:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sandlot Games [2009.08.11 09:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Shockwave [2010.05.15 17:51:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009.06.28 11:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UClick [2010.04.13 06:34:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vodafone [2009.06.16 09:58:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\World Money [2009.09.06 13:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom [2009.09.26 13:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Aisle 5 Games, Inc [2010.06.15 08:03:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Artogon [2009.11.03 14:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Azuaz Games [2009.07.12 12:53:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Big Fish Games [2009.04.01 19:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Boolat Games [2009.06.21 11:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\BrandX Games [2009.08.30 08:40:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Camel101 [2009.10.13 15:29:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CasualForge [2009.08.03 16:41:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\CatmoonGames [2009.06.16 10:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\DataDesign [2009.12.29 12:16:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dekovir [2009.06.12 13:41:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Dream Farm Games [2006.09.19 13:06:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ELAXY [2009.09.07 15:05:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\EleFun Games [2009.07.04 14:42:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Enchanted Katya [2009.05.19 11:07:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\FirstColony [2009.04.08 12:54:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\FRITZ! [2009.09.21 12:42:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Gaijin Ent [2009.09.05 12:49:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Gamelab [2009.06.10 12:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\HiT-MM [2009.10.04 09:20:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\IronCode [2009.09.21 13:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\iWin [2010.06.11 10:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Janes Realty2 [2010.07.15 12:43:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\KIDDINX [2006.10.11 17:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Leadertech [2009.06.16 09:57:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Lexware [2009.09.28 08:08:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Little Games Company [2009.08.22 18:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Lost in the City [2010.11.12 17:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Luupuw [2009.08.23 15:47:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Meridian93 [2006.10.11 14:47:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\PDFCreator [2009.09.08 08:32:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Peace Craft [2009.10.31 11:01:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\PlayFirst [2009.08.03 18:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ShinyTales [2009.08.11 09:09:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Shockwave [2010.10.15 07:35:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\TeamViewer [2009.06.28 11:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\UClick [2011.01.20 10:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Uniblue [2009.05.29 12:27:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\ViquaSoft [2010.04.13 06:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Vodafone [2009.05.06 17:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Volkswohl Bund [2009.05.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\World-LooM [2009.06.21 13:29:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\YoudaGames [2010.11.12 17:34:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Yvra [2009.09.21 12:42:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Zylom ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2011.01.06 08:08:21 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2006.08.28 15:55:54 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS [2006.08.28 14:24:20 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2010.11.22 04:26:07 | 000,000,000 | ---- | M] () -- C:\data [2002.12.19 23:00:00 | 000,053,248 | ---- | M] () -- C:\gendel32.exe [2011.01.20 21:22:14 | 1064,755,200 | -HS- | M] () -- C:\hiberfil.sys [2010.04.12 10:16:05 | 000,010,942 | ---- | M] () -- C:\hpfr5100.log [2010.12.08 14:20:39 | 001,048,491 | ---- | M] () -- C:\immudebug.log [2006.08.28 14:24:20 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2010.10.05 21:01:57 | 000,000,486 | ---- | M] () -- C:\LOG4D.log [2009.04.19 06:24:24 | 000,004,208 | ---- | M] () -- C:\mmisscriptprotokoll.txt [2009.04.19 06:24:25 | 000,000,002 | ---- | M] () -- C:\mmxmlparserprotokoll.txt [2006.08.28 14:24:20 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.10.16 04:30:18 | 000,000,029 | ---- | M] () -- C:\Nina.cfg [2004.08.03 23:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2011.01.18 18:00:13 | 000,250,048 | RHS- | M] () -- C:\ntldr [2011.01.20 21:22:12 | 3145,728,000 | -HS- | M] () -- C:\pagefile.sys [2009.07.20 12:34:34 | 000,013,030 | ---- | M] () -- C:\PDOXUSRS.NET [2009.09.07 10:42:33 | 000,002,827 | ---- | M] () -- C:\RESET.log [2008.09.26 15:52:17 | 000,034,294 | ---- | M] () -- C:\setup.log [1 C:\*.tmp files -> C:\*.tmp -> ] < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont [2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont < %systemroot%\Fonts\*.dll > [2005.05.11 23:36:48 | 000,012,288 | ---- | M] (Hewlett-Packard Co.) -- C:\WINDOWS\Fonts\RandFont.dll < %systemroot%\Fonts\*.ini > [2006.08.28 14:23:50 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2007.03.22 20:24:58 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll [2005.05.10 20:48:48 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll [2007.03.28 12:57:34 | 000,274,944 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5ha.dll [2008.07.06 11:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > [2008.06.24 17:11:31 | 000,783,360 | ---- | M] () -- C:\WINDOWS\KPSAVER.SCR [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > [2009.08.24 11:01:44 | 000,001,538 | -H-- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\LastFlashConfig.WFC < %PROGRAMFILES%\*.* > [2009.06.21 06:41:04 | 003,195,904 | ---- | M] () -- C:\Program Files\Common FilesDDBACSetup.msi [2006.08.07 13:29:44 | 000,048,640 | ---- | M] () -- C:\Program Files\lv1871.exe [2006.04.26 14:28:06 | 000,000,766 | ---- | M] () -- C:\Program Files\LV1871h.ico [2011.01.21 09:32:16 | 000,007,680 | -HS- | M] () -- C:\Program Files\Thumbs.db < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.08.28 16:11:42 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2006.08.28 16:11:42 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2006.08.28 16:11:42 | 000,909,312 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\system32\user32.dll /md5 > [2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\system32\ws2_32.dll /md5 > [2008.04.14 01:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %systemroot%\system32\ws2help.dll /md5 > [2008.04.14 01:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll [10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\explorer.exe [2004.08.04 01:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: WINLOGON.EXE > [2004.08.04 01:56:58 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\winlogon.exe [2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-21 03:50:15 < > ========== Alternate Data Streams ========== @Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6E86D926 @Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C07A6A6B @Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4363DE71 @Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C22674B6 @Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F84B8DB5 @Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A3B8F70C @Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A688EF17 @Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A00BCDEF @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F41F8101 @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:425759C6 @Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8140CB50 @Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D2397415 @Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BDCD0530 @Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:385E2CFD @Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:80B291A7 @Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:569CEE83 @Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3E06C78F @Alternate Data Stream - 196 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B6DD2C7E @Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0487F955 @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:28CDD861 @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEE4A457 @Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89C28CF6 @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9026FFAC @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:61AF2B29 @Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AD727397 @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D0D17155 @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CF76F21 @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:551BED5F @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7CEDF9F3 @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:35C78DCC @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:957E9765 @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69E3AF64 @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EC0A74A1 @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9857FAE3 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4A1628E5 @Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:059167AF @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0FEE2B @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B52659E @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3D36932D @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:237E4B91 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DF68137 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:663B62CA @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:471AD3D0 @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FECEF728 @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C928F3BE @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6BF0805F @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2CDB9CA3 @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A6346EE9 @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6444B424 @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:33EA030E @Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2BC498A4 @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:97C4F81F @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7881FECE @Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6FE17A89 @Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D2032EBB @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F2AF86D9 @Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DF0BC727 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:67BA17B9 @Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D0668210 @Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F44D3C53 @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8F067037 < End of report > |
|
21.01.2011, 10:31
| #5 |
| | problem mit BDS/Papras.AB huch, doppelpostwo finde ich die extras.txt? |
|
21.01.2011, 10:47
| #6 | |
| /// Malwareteam | problem mit BDS/Papras.AB Wie oft hast Du OTL uf dem System laufen gelassen? Zitat:
Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button. Kennst Du diese DateI: C:\WINDOWS\System32\usrlogon.bat |
|
21.01.2011, 11:53
| #7 | ||
| | problem mit BDS/Papras.ABZitat:
Zitat:
ich habe jetzt die extra.txt:OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 21.01.2011 11:44:39 - Run 7
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\***\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
1.015,00 Mb Total Physical Memory | 493,00 Mb Available Physical Memory | 49,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 3000 3000 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 83,79 Gb Total Space | 59,53 Gb Free Space | 71,04% Space Free | Partition Type: NTFS
Drive D: | 9,37 Gb Total Space | 9,17 Gb Free Space | 97,86% Space Free | Partition Type: NTFS
Drive F: | 61,33 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: NDES00471101000 | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\PROGRA~1\MICROS~2\OFFICE~1\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\PROGRA~1\MICROS~2\OFFICE~1\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\MSYS\Snowball.exe" = C:\MSYS\Snowball.exe:*:Disabled:Clientkomponente SB
"C:\Program Files\AXA-BT\COLSERV\jre\bin\javaw.exe" = C:\Program Files\AXA-BT\COLSERV\jre\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary -- (Sun Microsystems, Inc.)
"C:\Program Files\AXA-BT\COLSERV\BTFrame.exe" = C:\Program Files\AXA-BT\COLSERV\BTFrame.exe:*:Enabled:BTFrame -- ()
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator 0.8.0
"{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{12E0A949-8861-35F8-B7ED-5658788A7BFE}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - ESN
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{15C165F1-1DAE-4476-AFB6-8723729B41E7}" = hp deskjet 5100
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{298B7460-A43A-3083-B295-75547FC68392}" = Microsoft .NET Framework 3.5 Language Pack - esn
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2A871AF4-7699-4226-A3D3-869EE5E64034}" = Dameware Dameware Mini Remote Control 5.0 [5.0.1.5] DE
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1
"{3BB7DDB1-23A5-489D-8F96-292FB224BA90}" = AXA Beratungstechnologie
"{3F7924B9-D148-3141-87B1-68F36043A940}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{511DF669-2930-30C0-8EB6-552887E29EC8}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap
"{59EC5F32-D8D7-3909-B0CB-255AD09F5993}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - ITA
"{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1
"{5A633ED0-E5D7-4D65-AB8D-53ED43510284}" = Symantec Symantec Antivirus 10 [10.0.0.359] DE
"{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}" = Microsoft .NET Framework 3.5 Language Pack - fra
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{6183CFBD-5298-4329-BC4E-58568A004D35}" = Microsoft Access Runtime 10 [10.0.6626.0] EN
"{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1
"{6845AE3B-EB95-46DE-A190-EAB8D7764C60}" = Lexware Elster
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6EA3B25B-9FCF-4C8F-A1A0-7FD4978AAA1C}" = Lotus Notes 6.5.1 de
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7148F0A8-6813-11D6-A77B-00B0D0142060}" = Sun Microsystems, Inc. Java 2 Runtime Environment, SE 1.4.2.06 EN
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = Microsoft MSXML 4 EN
"{71CB2612-627C-3D58-8D82-B77444B27B6A}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - ITA
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{776AC7E8-F6F4-4E4F-98CD-ECCC54948C6A}" = Macromedia Shockwave 10 EN
"{79546A5F-AE7C-4693-8670-A3401B43ABD2}" = HP Deskjet 5900 series
"{7D7C9A8A-F3B4-42A2-9AD2-5B0CA013267C}" = Lexware online banking
"{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{83169D43-4660-4347-BC95-E9D6E6BE65CE}" = Microsoft NET Framework 1.1 ES
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
"{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP 10.0.6626.0 XL
"{901E0403-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Catalan User Interface Pack
"{901E0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP German User Interface 10 DE
"{901E040C-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP French User Interface 10 FR
"{901E0410-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Italian User Interface 10 IT
"{901E042D-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Basque User Interface Pack
"{901E0456-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Galician User Interface Pack
"{901E0C0A-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Spanish User Interface 10 ES
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{9311A75A-D83D-37B5-8D49-88E7F5AB2762}" = Microsoft .NET Framework 3.5 Language Pack - ita
"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft NET_Framework 1.1 FR
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5222E5A-13CB-4C98-9F5C-21CF6896A25C}" = HPDeskjet5900Series
"{A5BB5365-EFB4-44c3-A7E2-EB59B7EFD23D}" = CueTour
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AC76BA86-7AD7-1031-7B44-A71000000002}" = Adobe Reader 7.1.0 - Deutsch
"{ACAB3F35-588C-4F2E-81FF-764839A632D7}" = DDBAC
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B3BBA387-B30B-4E0F-9E35-82B15B7DD10E}" = InstallShield ISScript 3 EN
"{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min
"{B516126E-607A-47BD-8B35-335A76328576}" = Quicken Import Export Server 2009
"{BAC47667-0D8E-4B74-8C1B-630D68F7E23E}" = Eagle Star Tarifrechner
"{BB0DCC5E-7477-3350-B5F5-7CE64E1E83B6}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - ESN
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BEDFB0D0-CA1E-4CBA-9664-B25A74019D0C}" = Lexware Info Service
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1920D73-7374-49d9-8C37-58A6E49078A5}" = F2100_Help
"{C3B8F0DF-55EA-4793-8F77-3259211A3C9E}" = CyberLink PowerDVD 5.1 [5.1.057] DE
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C5B83F18-6959-4760-9879-709E29E75DAF}" = EZ GPO Power Management Config Tool
"{C5EF81AC-FE4C-4157-97E3-2E08B000742A}" = F2100_doccd
"{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}" = Vodafone Mobile Connect Lite
"{C8320AEC-2E97-4C78-81EC-43CF6D248B01}" = Microsoft XML Parser
"{CA50045C-5119-48e7-9BA7-6B317379857A}" = DJ_AIO_Software
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{DF70AE58-A4D9-43EE-8158-3800CB6EF59D}" = BBFacade
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E548726E-F4E8-459f-BAB8-45551BC071E9}" = DJ_AIO_ProductContext
"{E5A24EC1-61AF-4AF4-A103-756359FAC92E}" = Quicken 2009 - ServicePack 3
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{ECD9E9A7-EA28-4698-8414-3F306C79ECD7}" = Irfanview Irfan View 3.9 [3.98] DE
"{F1C409F0-8322-4c87-BD08-2F62777D490D}" = F2100
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F2D2B58B-B2FD-46D1-8319-DCE564079934}" = Microsoft NET Framework 1.1 IT
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}" = HP Deskjet All-In-One Software 9.0
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Premium Security Suite
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.92 Modem
"Defraggler" = Defraggler
"Domänenzulassung Bonnfinanz_is1" = Domänenzulassung Bonnfinanz 1.0
"Farm Frenzy - Gone Fishing 1.0.0.0" = Farm Frenzy - Gone Fishing 1.0.0.0
"Filzip 3.0.1.44_is1" = Filzip 3.01
"FRITZ! 2.0" = AVM FRITZ!
"Google Chrome" = Google Chrome
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photo & Imaging" = HP Image Zone 5.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"IrfanView" = IrfanView (remove only)
"LiveUpdate" = LiveUpdate 2.6 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 Language Pack - esn" = Paquete de idioma de Microsoft .NET Framework 3.5 - esn
"Microsoft .NET Framework 3.5 Language Pack - fra" = Module linguistique Microsoft .NET Framework 3.5 - fra
"Microsoft .NET Framework 3.5 Language Pack - ita" = Microsoft .NET Framework 3.5 - Language Pack (italiano)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"ST6UNST #1" = VB6-Runtime und Steuerelemente
"SystemRequirementsLab" = System Requirements Lab
"Viewer97" = Microsoft Word Viewer 97
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 20.01.2011 15:39:55 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb976576,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 15:39:59 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.5-kb2416473,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 16:22:21 | Computer Name = NDES00471101000 | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
Error - 20.01.2011 23:49:30 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb979909,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 23:49:42 | Computer Name = NDES00471101000 | Source = NativeWrapper | ID = 5000
Description =
Error - 20.01.2011 23:49:50 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.0-kb982168,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 23:49:58 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb2418241,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 23:50:05 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb983583,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 23:50:09 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb976576,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.
Error - 20.01.2011 23:50:15 | Computer Name = NDES00471101000 | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.5-kb2416473,
P2 1031, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.
[ System Events ]
Error - 20.01.2011 23:49:50 | Computer Name = NDES00471101000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "MSIServer"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {000C101C-0000-0000-C000-000000000046}
Error - 20.01.2011 23:49:56 | Computer Name = NDES00471101000 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 Update for Windows Server
2003 and Windows XP x86 (KB982168).
Error - 20.01.2011 23:49:57 | Computer Name = NDES00471101000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "MSIServer"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {000C101C-0000-0000-C000-000000000046}
Error - 20.01.2011 23:50:04 | Computer Name = NDES00471101000 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft .NET Framework 2.0 SP2 and
3.5 SP1 on Windows Server 2003 and Windows XP x86 (KB2418241).
Error - 20.01.2011 23:50:05 | Computer Name = NDES00471101000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "MSIServer"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {000C101C-0000-0000-C000-000000000046}
Error - 20.01.2011 23:50:09 | Computer Name = NDES00471101000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "MSIServer"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {000C101C-0000-0000-C000-000000000046}
Error - 20.01.2011 23:50:10 | Computer Name = NDES00471101000 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for .NET Framework 2.0 SP2 and 3.5 SP1 on
Windows Server 2003 and Windows XP x86 (KB983583).
Error - 20.01.2011 23:50:14 | Computer Name = NDES00471101000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "MSIServer"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {000C101C-0000-0000-C000-000000000046}
Error - 20.01.2011 23:50:15 | Computer Name = NDES00471101000 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524).
Error - 20.01.2011 23:50:20 | Computer Name = NDES00471101000 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft .NET Framework 3.5 SP1 on
Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 x86 (KB2416473).
< End of report >
vielen dank nochmal für Deine Hilfe :-) Geändert von ranjid (21.01.2011 um 11:55 Uhr) Grund: Ich habe noch etwas vergessen hinzu zuschreiben |
|
21.01.2011, 12:09
| #8 |
| /// Malwareteam | problem mit BDS/Papras.AB Mach einmal Rechtsklick auf die Bat Datei und dann öffnen mit Editor und poste den Inhalt. |
|
21.01.2011, 15:12
| #9 |
| | problem mit BDS/Papras.AB 1. hier nun das logfile von gmer: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-21 14:10:11
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS541010G9AT00 rev.MBZOA61A
Running: gmer.exe; Driver: C:\DOCUME~1\***\LOCALS~1\Temp\kxqyrpow.sys
---- System - GMER 1.0.15 ----
SSDT 8650F250 ZwConnectPort
SSDT F7D5289E ZwCreateKey
SSDT F7D52894 ZwCreateThread
SSDT F7D528A3 ZwDeleteKey
SSDT F7D528AD ZwDeleteValueKey
SSDT F7D528CB ZwLoadDriver
SSDT F7D528B2 ZwLoadKey
SSDT F7D52880 ZwOpenProcess
SSDT F7D52885 ZwOpenThread
SSDT F7D528BC ZwReplaceKey
SSDT F7D528B7 ZwRestoreKey
SSDT F7D528D0 ZwSetSystemInformation
SSDT F7D528A8 ZwSetValueKey
SSDT F7D5288F ZwTerminateProcess
SSDT F7D5288A ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.15 ----
init C:\WINDOWS\system32\DRIVERS\gtipci21.sys entry point in "init" section [0xF720CA80]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\firefox.exe[3272] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\RawIp avfwot.sys (TDI filtering kernel driver/Avira GmbH)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
Geändert von ranjid (21.01.2011 um 15:19 Uhr) |
|
21.01.2011, 15:17
| #10 | |
| | problem mit BDS/Papras.ABZitat:
Code:
ATTFilter REM ACSRun file (Application Compatibility Script - launcher)
|
|
21.01.2011, 16:55
| #11 |
| /// Malwareteam | problem mit BDS/Papras.AB Schritt 1 Fixen mit OTL
Code:
ATTFilter :OTL
O2 - BHO: () - {1DA617DD-BB7B-40ED-8EB6-5919719D2BB2} - C:\MSYS\kpbho.dll ()
O4 - HKLM..\Run: [ACSrun] C:\WINDOWS\System32\usrlogon.bat ()
O32 - AutoRun File - [2008.07.07 21:46:00 | 000,000,113 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone)
O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone)
O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell - "" = AutoRun
O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone)
O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell - "" = AutoRun
O33 - MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.08 03:27:14 | 000,327,680 | R--- | M] (Vodafone)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
[2011.01.20 09:22:56 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2011.01.20 09:22:56 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2011.01.20 09:16:59 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
:Commands
[purity]
[emptytemp]
Schritt 2 Downloade Dir bitte Malwarebytes
|
|
22.01.2011, 12:20
| #12 |
| | problem mit BDS/Papras.AB Hallo, hier ist der Inhalt der gefixten Datei: Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1DA617DD-BB7B-40ED-8EB6-5919719D2BB2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DA617DD-BB7B-40ED-8EB6-5919719D2BB2}\ deleted successfully.
C:\MSYS\kpbho.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ACSrun deleted successfully.
C:\WINDOWS\system32\usrlogon.bat moved successfully.
File F:\Autorun.inf not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa85819-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa85819-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa85819-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa85819-46be-11df-a282-404e57434401}\ not found.
File F:\setup_vmc_lite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa8581c-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa8581c-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1aa8581c-46be-11df-a282-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1aa8581c-46be-11df-a282-404e57434401}\ not found.
File F:\setup_vmc_lite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ea509f2-1345-11e0-a359-00166f749b57}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ea509f2-1345-11e0-a359-00166f749b57}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ea509f2-1345-11e0-a359-00166f749b57}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ea509f2-1345-11e0-a359-00166f749b57}\ not found.
File F:\setup_vmc_lite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8795645b-d744-11de-a252-0015c512d44d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8795645b-d744-11de-a252-0015c512d44d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8795645b-d744-11de-a252-0015c512d44d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a770f3e5-58ee-11df-a28d-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a770f3e5-58ee-11df-a28d-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a770f3e5-58ee-11df-a28d-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a770f3e5-58ee-11df-a28d-404e57434401}\ not found.
File F:\setup_vmc_lite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\LaunchU3.exe -a not found.
C:\WINDOWS\system32\nscompat.tlb moved successfully.
C:\WINDOWS\system32\amcompat.tlb moved successfully.
C:\WINDOWS\WMSysPr9.prx moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 43111200 bytes
->Temporary Internet Files folder emptied: 6520899 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 618688 bytes
User: ***
->Temp folder emptied: 74866889 bytes
->Temporary Internet Files folder emptied: 3032736 bytes
->Java cache emptied: 1 bytes
->FireFox cache emptied: 45113944 bytes
->Google Chrome cache emptied: 10491818 bytes
->Flash cache emptied: 3616 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 6300177 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 637205 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 43946588 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 553366514 bytes
Total Files Cleaned = 752,00 mb
OTL by OldTimer - Version 3.2.20.2 log created on 01222011_120847
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Geändert von ranjid (22.01.2011 um 12:26 Uhr) |
|
22.01.2011, 13:02
| #13 |
| | problem mit BDS/Papras.AB und hier ist das Ergebnis von Malwarebytes: Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 5570
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
22.01.2011 13:01:01
mbam-log-2011-01-22 (13-01-01).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 144366
Laufzeit: 20 Minute(n), 38 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
|
|
22.01.2011, 14:07
| #14 |
| | problem mit BDS/Papras.AB gerade eben hat antivir wieder gemeldet, daß es Papras.AB gefunden hat. Code:
ATTFilter Die Datei 'C:\System Volume Information\_restore{0111EB27-6CD3-4176-A2E4-F4511F0A8EBE}\RP221\A0302097.dll'
enthielt einen Virus oder unerwünschtes Programm 'BDS/Papras.AB' [backdoor].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f8d7126.qua' verschoben!
 wieso schickt es mir diese meldung, wenn sich papras schon in quarantäne befindet? das ist mir nicht ganz klar ? |
|
22.01.2011, 15:49
| #15 | |
| /// Malwareteam | problem mit BDS/Papras.AB Schritt 1 Zitat:
 Also keine Sorge, dass werden wir noch löschen am Schluss.Schritt 2 ESET Online Scanner Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
Schritt 3 Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
|
|
| Themen zu problem mit BDS/Papras.AB |
| antworten, avira, bds/papras, befallen, befindet, c:\windows, einstellungen, gen, information, interne, internetverbindung, keine internetverbindung, lange, langsam, load.exe, meldung, nachfrage, nicht starten, problem, proxy, starten, system, system volume information, system32, verbindung, warum, windows, worte, überhaupt, _restore |
Textbox.
Button.
Linear-Darstellung
