| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: syscheckrt.exe in c:\syscheckrt\Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.02.2011, 22:12
| #1 |
| |  syscheckrt.exe in c:\syscheckrt\ Hallo Forum! Vor einigen Tagen hat Avira bei mir o.g. Datei gefunden und danach in Quarantäne verschoben. Auszug aus dem Avira Log: "Beginne mit der Desinfektion: C:\syscheckrt\syscheckrt.exe [FUND] Ist das Trojanische Pferd TR/Spy.SpyEyes.ezt [HINWEIS] Der Registrierungseintrag <HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\syscheckrt.exe> wurde erfolgreich entfernt. [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '497a1ba8.qua' verschoben!" Beim Googeln nach dem Trojaner bin ich unter anderem auf dieses Forum gestoßen und habe mehrfach gelesen, dass er nicht ungefährlich ist und auch eine Entfernung nicht unbedingt heißt, dass der Computer sauber ist. Deshalb würde es mich freuen, wenn die Profis hier einen Blick auf mein System werfen könnten. OTL-Log:OTL Logfile: Code:
ATTFilter OTL logfile created on: 24.02.2011 21:45:18 - Run 2 OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Steffen\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19019) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 54,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 73,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 149,80 Gb Free Space | 64,32% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 190,75 Gb Free Space | 81,91% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: Steffen | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Steffen\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10l_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation) PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten) PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\PostgreSQL\8.4\bin\pg_ctl.exe (PostgreSQL Global Development Group) PRC - C:\Programme\PostgreSQL\8.4\bin\postgres.exe (PostgreSQL Global Development Group) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\CD\CDBurnerXP\NMSAccessU.exe () PRC - C:\Programme\bin32\nSvcAppFlt.exe () PRC - C:\Programme\bin32\nSvcIp.exe () PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\System32\dlbkcoms.exe ( ) PRC - C:\Programme\Power Manager\PM.exe () PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) ========== Modules (SafeList) ========== MOD - C:\Users\Steffen\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (postgresql-8.4) -- C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe (PostgreSQL Global Development Group) SRV - (HsfXAudioService) -- C:\Windows\System32\XAudio32.dll (Conexant Systems, Inc.) SRV - (NMSAccessU) -- C:\Programme\CD\CDBurnerXP\NMSAccessU.exe () SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Programme\bin32\nSvcAppFlt.exe () SRV - (nSvcIp) -- C:\Programme\bin32\nSvcIp.exe () SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (dlbk_device) -- C:\Windows\System32\dlbkcoms.exe ( ) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys () DRV - (dgderdrv) -- C:\Windows\System32\drivers\dgderdrv.sys (Devguru Co., Ltd) DRV - (sscemdm) -- C:\Windows\System32\drivers\sscemdm.sys (MCCI Corporation) DRV - (ssceserd) SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM) -- C:\Windows\System32\drivers\ssceserd.sys (MCCI Corporation) DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\System32\drivers\sscebus.sys (MCCI Corporation) DRV - (sscemdfl) -- C:\Windows\System32\drivers\sscemdfl.sys (MCCI Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio32.sys (Conexant Systems, Inc.) DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.) DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (Cam5603D) -- C:\Windows\System32\drivers\BisonCam.sys (Bison Electronics. Inc. ) DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation) DRV - (smscirrx) -- C:\Windows\System32\drivers\smscirrx.sys (SMSC) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (WINIO) -- C:\Windows\System32\WinIo.sys (hxxp://www.internals.com) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54909 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.5 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.8 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 54909 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.01.13 00:41:12 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.01.13 00:41:12 | 000,000,000 | ---D | M] [2008.09.09 16:13:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Extensions [2011.02.14 21:04:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\mc0g3ms1.default\extensions [2011.02.12 14:22:24 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\mc0g3ms1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.01.27 19:01:53 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\mc0g3ms1.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2010.01.27 19:01:36 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\mc0g3ms1.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2011.01.09 17:04:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.05.31 20:09:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.05 15:07:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.07 15:09:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.09 17:04:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2009.09.28 20:05:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2010.01.13 20:56:35 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.04.03 01:07:37 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010.05.31 20:09:20 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.05 15:07:37 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.07 15:09:37 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.09 17:04:16 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.11.07 15:01:30 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.11.07 15:01:31 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.11.07 15:01:31 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.11.07 15:01:31 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.11.07 15:01:31 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PowerManager] C:\Programme\Power Manager\PM.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Application Launcher\Application Launcher.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [conhost] File not found O4 - HKCU..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKCU..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe () O9 - Extra 'Tools' menuitem : Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Poker\PartyGaming\PartyPoker\RunApp.exe () O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Poker\PartyGaming\PartyPoker\RunApp.exe () O13 - gopher Prefix: missing O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{edaf80be-007f-11df-8575-001060d019e2}\Shell - "" = AutoRun O33 - MountPoints2\{edaf80be-007f-11df-8575-001060d019e2}\Shell\AutoRun\command - "" = F:\Launch.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.02.23 19:18:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell [2011.02.23 19:16:07 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrsmgr.dll [2011.02.23 19:15:41 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrs.exe [2011.02.23 19:15:41 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrshost.exe [2011.02.23 19:15:41 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmprovhost.exe [2011.02.23 19:15:35 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmplpxy.dll [2011.02.23 19:15:35 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrssrv.dll [2011.02.23 19:15:31 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtfwd.dll [2011.02.23 19:15:31 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecutil.exe [2011.02.23 19:15:31 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecapi.dll [2011.02.23 19:15:31 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmRes.dll [2011.02.23 19:15:29 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pwrshplugin.dll [2011.02.23 19:15:14 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManMigrationPlugin.dll [2011.02.23 19:15:14 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManHTTPConfig.exe [2011.02.23 19:15:14 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrscmd.dll [2011.02.23 19:15:14 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmWmiPl.dll [2011.02.23 19:15:14 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmAuto.dll [2011.02.19 14:07:07 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe [2011.02.10 21:38:49 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2011.02.10 21:38:49 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2011.02.10 21:38:49 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll [2011.02.10 21:38:48 | 000,979,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll [2011.02.10 21:38:48 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2011.02.10 21:38:48 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2011.02.10 21:38:47 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll [2011.02.10 21:38:47 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.02.10 21:38:47 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll [2011.02.10 21:38:47 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll [2011.02.10 21:38:47 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2011.02.10 21:38:47 | 000,261,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll [2011.02.10 21:38:46 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll [2011.02.10 21:38:46 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2011.02.10 21:38:46 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2011.02.10 21:38:45 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2011.02.10 21:38:45 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2011.02.10 21:38:45 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe [2011.02.10 21:38:45 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2011.02.10 21:38:44 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2011.02.10 21:38:44 | 000,209,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll [2011.02.10 21:38:44 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2011.02.10 21:38:43 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll [2011.02.10 21:38:43 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2011.02.10 21:38:43 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll [2011.02.10 21:38:23 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2011.02.10 21:38:19 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2011.02.10 21:38:18 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2011.02.10 21:38:12 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2011.02.10 21:38:12 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.02.10 21:38:11 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.02.10 21:38:11 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2011.02.10 21:38:11 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2011.02.10 21:38:11 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.02.10 21:38:11 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.02.10 21:38:11 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2011.02.10 21:38:11 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2011.02.10 21:38:11 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2011.02.10 21:38:11 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2011.02.10 21:38:11 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2011.02.10 21:38:11 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2011.02.10 21:38:11 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2011.02.10 21:38:11 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2011.02.10 21:38:11 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2011.02.10 21:38:11 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2011.02.10 21:36:47 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2011.02.10 21:36:47 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2011.02.08 21:06:06 | 000,000,000 | ---D | C] -- C:\Users\Steffen\Documents\Taxpool-Buchhalter [2011.02.08 21:03:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Taxpool-Buchhalter [2011.02.08 21:02:13 | 000,000,000 | ---D | C] -- C:\Programme\Taxpool-Buchhalter [2011.02.06 18:21:53 | 000,000,000 | ---D | C] -- C:\Users\Steffen\Documents\ProSaldo [2011.02.06 18:21:37 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Local\ProSaldo [2011.02.06 18:21:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProSaldo [2011.02.06 18:21:23 | 000,000,000 | ---D | C] -- C:\Programme\ProSaldo [2011.02.06 18:15:13 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Avira [2011.02.06 13:28:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung [2011.02.06 13:28:24 | 000,820,560 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\System32\dgderapi.dll [2011.02.06 13:28:24 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DIFxAPI.dll [2011.02.06 13:28:24 | 000,018,120 | ---- | C] (Devguru Co., Ltd) -- C:\Windows\System32\drivers\dgderdrv.sys [2011.02.06 13:24:06 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Local\Downloaded Installations [2011.02.05 19:52:48 | 000,100,352 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssceserd.sys [2011.02.05 19:52:48 | 000,012,288 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscewhnt.sys [2011.02.05 19:52:48 | 000,012,288 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscewh.sys [2011.02.05 19:52:47 | 000,123,648 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscemdm.sys [2011.02.05 19:52:47 | 000,098,560 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscebus.sys [2011.02.05 19:52:47 | 000,014,848 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscemdfl.sys [2011.02.05 19:52:47 | 000,012,416 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscecmnt.sys [2011.02.05 19:52:47 | 000,012,416 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscecm.sys [2011.02.05 19:07:12 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Local\Samsung [2011.02.05 18:52:15 | 000,000,000 | ---D | C] -- C:\Temp [2011.02.05 18:45:29 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\System32\Redemption.dll [2011.01.29 23:16:28 | 000,177,496 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.exe [2011.01.29 23:16:26 | 000,030,056 | ---- | C] ((주)마크애니) -- C:\Windows\System32\MASetupCleaner.exe [2011.01.29 17:00:22 | 000,569,344 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzdecode.ax [2011.01.29 17:00:22 | 000,491,520 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.dll [2011.01.29 17:00:22 | 000,352,256 | ---- | C] (Sample Corporation) -- C:\Windows\System32\MSLUR71.dll [2011.01.29 17:00:22 | 000,258,048 | ---- | C] ((c) PeeringPortal) -- C:\Windows\System32\muzoggsp.ax [2011.01.29 17:00:22 | 000,245,760 | ---- | C] (Teruten Inc.) -- C:\Windows\System32\MSCLib.dll [2011.01.29 17:00:22 | 000,200,704 | ---- | C] ( (c) MusicCity) -- C:\Windows\System32\muzwmts.dll [2011.01.29 17:00:22 | 000,155,648 | ---- | C] (Teruten Inc.) -- C:\Windows\System32\MSFLib.dll [2011.01.29 17:00:22 | 000,135,168 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzaf1.dll [2011.01.29 17:00:22 | 000,131,072 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzmpgsp.ax [2011.01.29 17:00:22 | 000,122,880 | ---- | C] ((c) MUSICCITY) -- C:\Windows\System32\muzeffect.ax [2011.01.29 17:00:22 | 000,118,784 | ---- | C] ((주)마크애니) -- C:\Windows\System32\MaDRM.dll [2011.01.29 17:00:22 | 000,110,592 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzmp4sp.ax [2011.01.29 17:00:22 | 000,057,344 | ---- | C] (Marktek) -- C:\Windows\System32\MK_Lyric.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | C] (Marktek Inc.) -- C:\Windows\System32\MTXSYNCICON.dll [2011.01.29 17:00:22 | 000,049,152 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MaJGUILib.dll [2011.01.29 17:00:22 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MaXMLProto.dll [2011.01.29 17:00:22 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MACXMLProto.dll [2011.01.29 17:00:22 | 000,040,960 | ---- | C] (마크애니연구소) -- C:\Windows\System32\MAMACExtract.dll [2011.01.29 17:00:22 | 000,040,960 | ---- | C] (Telechips Inc.,) -- C:\Windows\System32\MTTELECHIP.dll [2007.03.21 12:41:30 | 000,073,728 | ---- | C] ( ) -- C:\Windows\System32\dlbkcu.dll [2007.01.30 13:47:52 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dlbkpmui.dll [2007.01.30 13:46:00 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\dlbkserv.dll [2007.01.30 13:36:30 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\dlbklmpm.dll [2007.01.30 13:35:00 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\dlbkiesc.dll [2007.01.30 13:32:06 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\dlbkpplc.dll [2007.01.30 13:31:08 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\dlbkcomc.dll [2007.01.30 13:30:30 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\dlbkprox.dll [2007.01.30 13:22:32 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\dlbkinpa.dll [2007.01.30 13:21:46 | 000,995,328 | ---- | C] ( ) -- C:\Windows\System32\dlbkusb1.dll [2007.01.30 13:17:02 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\dlbkhbn3.dll [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.02.24 21:31:51 | 000,048,253 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011.02.24 21:31:48 | 000,048,253 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011.02.24 21:25:20 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.02.24 21:25:19 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.02.24 21:25:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.02.24 21:24:22 | 2146,418,688 | -HS- | M] () -- C:\hiberfil.sys [2011.02.23 19:19:37 | 000,001,076 | ---- | M] () -- C:\Windows\bthservsdp.dat [2011.02.20 15:21:27 | 000,084,992 | ---- | M] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.02.19 19:28:41 | 000,005,970 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\PrimoPDFSet.xml [2011.02.19 14:07:13 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe [2011.02.14 21:59:23 | 234,330,835 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011.02.14 20:55:19 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.02.14 20:55:19 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.02.14 20:55:19 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.02.14 20:55:19 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.02.14 18:43:12 | 000,277,448 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.02.12 18:34:52 | 000,003,036 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\150A.200 [2011.02.12 13:11:20 | 000,067,003 | ---- | M] () -- C:\Users\Steffen\Desktop\Überweisung Weikert.pdf [2011.02.12 12:59:53 | 000,003,381 | ---- | M] () -- C:\Windows\KernelMessage [2011.02.08 22:31:39 | 000,000,082 | ---- | M] () -- C:\Windows\odbc_merge.INI [2011.02.08 21:03:47 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\Taxpool-Buchhalter.lnk [2011.02.06 13:30:39 | 000,001,734 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk [2011.01.29 23:16:28 | 000,177,496 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.exe [2011.01.29 23:16:26 | 000,030,056 | ---- | M] ((주)마크애니) -- C:\Windows\System32\MASetupCleaner.exe [2011.01.29 17:00:22 | 000,974,848 | ---- | M] () -- C:\Windows\System32\cis-2.4.dll [2011.01.29 17:00:22 | 000,569,344 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzdecode.ax [2011.01.29 17:00:22 | 000,491,520 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.dll [2011.01.29 17:00:22 | 000,352,256 | ---- | M] (Sample Corporation) -- C:\Windows\System32\MSLUR71.dll [2011.01.29 17:00:22 | 000,258,048 | ---- | M] ((c) PeeringPortal) -- C:\Windows\System32\muzoggsp.ax [2011.01.29 17:00:22 | 000,245,760 | ---- | M] (Teruten Inc.) -- C:\Windows\System32\MSCLib.dll [2011.01.29 17:00:22 | 000,200,704 | ---- | M] ( (c) MusicCity) -- C:\Windows\System32\muzwmts.dll [2011.01.29 17:00:22 | 000,155,648 | ---- | M] (Teruten Inc.) -- C:\Windows\System32\MSFLib.dll [2011.01.29 17:00:22 | 000,143,360 | ---- | M] () -- C:\Windows\System32\3DAudio.ax [2011.01.29 17:00:22 | 000,135,168 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzaf1.dll [2011.01.29 17:00:22 | 000,131,072 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzmpgsp.ax [2011.01.29 17:00:22 | 000,122,880 | ---- | M] ((c) MUSICCITY) -- C:\Windows\System32\muzeffect.ax [2011.01.29 17:00:22 | 000,118,784 | ---- | M] ((주)마크애니) -- C:\Windows\System32\MaDRM.dll [2011.01.29 17:00:22 | 000,110,592 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzmp4sp.ax [2011.01.29 17:00:22 | 000,081,920 | ---- | M] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.01.29 17:00:22 | 000,065,536 | ---- | M] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | M] (Marktek) -- C:\Windows\System32\MK_Lyric.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | M] (Marktek Inc.) -- C:\Windows\System32\MTXSYNCICON.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | M] () -- C:\Windows\System32\issacapi_se-2.3.dll [2011.01.29 17:00:22 | 000,049,152 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MaJGUILib.dll [2011.01.29 17:00:22 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MaXMLProto.dll [2011.01.29 17:00:22 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MACXMLProto.dll [2011.01.29 17:00:22 | 000,040,960 | ---- | M] (마크애니연구소) -- C:\Windows\System32\MAMACExtract.dll [2011.01.29 17:00:22 | 000,040,960 | ---- | M] (Telechips Inc.,) -- C:\Windows\System32\MTTELECHIP.dll [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.02.23 19:15:15 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs [2011.02.23 19:15:15 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml [2011.02.23 19:15:15 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl [2011.02.12 13:11:07 | 000,067,003 | ---- | C] () -- C:\Users\Steffen\Desktop\Überweisung Weikert.pdf [2011.02.12 13:00:07 | 000,003,036 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\150A.200 [2011.02.08 22:31:39 | 000,000,082 | ---- | C] () -- C:\Windows\odbc_merge.INI [2011.02.08 21:03:47 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Taxpool-Buchhalter.lnk [2011.02.06 13:30:39 | 000,001,734 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk [2011.01.29 17:00:22 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2011.01.29 17:00:22 | 000,143,360 | ---- | C] () -- C:\Windows\System32\3DAudio.ax [2011.01.29 17:00:22 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.01.29 17:00:22 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.01.29 17:00:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2010.08.12 20:13:02 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll [2010.08.12 20:13:02 | 000,042,112 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys [2010.05.31 20:41:52 | 000,000,255 | ---- | C] () -- C:\Windows\System32\dlbkcoin.ini [2010.05.31 20:38:39 | 000,000,102 | ---- | C] () -- C:\Windows\dellstat.ini [2010.01.13 20:53:00 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2010.01.10 16:55:56 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2009.09.24 21:15:50 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.08 18:53:50 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2009.03.15 22:16:53 | 000,001,212 | ---- | C] () -- C:\Windows\wiso.ini [2009.01.26 21:51:17 | 000,048,253 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.01.26 21:51:17 | 000,048,253 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008.08.27 17:45:04 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll [2008.08.27 17:45:04 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2008.08.27 17:45:02 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2008.08.27 17:45:02 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2008.08.27 17:45:01 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.08.27 17:45:00 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2008.08.24 15:46:34 | 000,000,224 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\APUSet.xml [2008.08.24 15:46:32 | 000,005,970 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\PrimoPDFSet.xml [2008.08.18 19:47:55 | 000,084,992 | ---- | C] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.08.18 19:10:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.08.18 19:08:35 | 000,027,525 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\nvModes.001 [2008.08.18 15:24:34 | 000,027,525 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\nvModes.dat [2008.08.18 12:56:41 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll [2008.08.18 12:29:47 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll [2008.08.18 11:49:53 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI [2008.08.08 13:06:53 | 000,015,190 | ---- | C] () -- C:\Windows\M2000Twn.ini [2008.04.28 17:13:33 | 000,000,290 | ---- | C] () -- C:\Windows\primopdf.ini [2007.06.22 02:59:38 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dlbkcur.dll [2007.03.21 12:41:20 | 000,413,696 | ---- | C] () -- C:\Windows\System32\dlbkutil.dll [2007.02.07 21:58:00 | 000,039,899 | ---- | C] () -- C:\Windows\System32\rtsicis.ini [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2005.12.16 18:15:44 | 000,040,960 | ---- | C] () -- C:\Windows\System32\dlbkvs.dll [2005.09.13 20:27:08 | 000,061,440 | ---- | C] () -- C:\Windows\System32\dlbkcnv5.dll [2005.09.13 20:27:08 | 000,061,440 | ---- | C] () -- C:\Windows\System32\dlbkcnv4.dll [2003.01.07 14:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI ========== LOP Check ========== [2009.07.19 20:52:36 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Canneverbe_Limited [2010.01.13 21:27:02 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DAEMON Tools Lite [2011.02.11 18:14:45 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\HEM Data [2011.02.16 22:04:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\ICQ [2010.04.21 18:38:16 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\MAGIX [2009.07.18 11:49:05 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\NCH Swift Sound [2010.10.03 17:36:36 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\OpenOffice.org [2009.06.16 18:27:53 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\PacificPoker [2011.01.13 21:37:58 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Roaming [2010.08.12 21:29:31 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Samsung [2010.03.16 22:13:29 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Teleca [2011.02.23 19:19:41 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Extras-Log:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 24.02.2011 21:45:18 - Run 2
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Steffen\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 54,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 73,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 149,80 Gb Free Space | 64,32% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 190,75 Gb Free Space | 81,91% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: Steffen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DAD63B-B944-40F1-A4AF-E4101692DA03}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{0E4E55B6-730A-467B-BDC4-DC498C19433A}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{0FA94367-F789-4810-81EF-1BEBA3748C49}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{44A6813B-ED84-46E8-A1A5-863F4EF03751}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{68A3F4FA-DD84-4546-B4AB-69FB601A8657}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{720D6567-2686-4212-8958-F751574929D7}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{7940E74E-1E2C-4F49-8060-30CF32E063C9}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{79C73CAE-724C-48AC-B45D-752704CEE51C}" = protocol=17 | dir=in | app=c:\windows\system32\dlbkcoms.exe |
"{8422251B-6DDC-46FE-B349-401DA28D2A84}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{90129578-75AA-4856-B7FF-20F8B2776465}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{982A1DC9-0B3E-4B3F-BFB9-C7A3797F7344}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{9CC61920-B8FF-4558-A0E2-EB654548FBA9}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{B0017FC6-3213-4AD6-9CBE-3F6B8F57097A}" = protocol=6 | dir=in | app=c:\windows\system32\dlbkcoms.exe |
"{DB26BAF4-242C-41E0-BCA0-A031CD6773CC}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{E2F02D5E-FF5C-4C6E-8AF2-932A8680A777}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{F5A72B12-5795-4D55-8A3B-EF2AA7A258BB}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{F60179C1-9030-45BF-859F-92EFC3B24724}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"TCP Query User{6A17D160-D758-4482-A036-CFA3D1252F20}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{A400E1CB-A217-4BDB-B408-98AC6CDC71A5}C:\poker\pokerstrategy\equilator\equilator.exe" = protocol=6 | dir=in | app=c:\poker\pokerstrategy\equilator\equilator.exe |
"TCP Query User{D69741BE-7086-4E18-9B14-9F0FE29E2B81}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{880927ED-0F1B-4E36-B1DF-E41288BB71A2}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{8C468B97-CBAB-4566-81A1-D62165A6B60B}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{F8C88BDD-7DB1-4CB2-83BE-EDBB8B784BCB}C:\poker\pokerstrategy\equilator\equilator.exe" = protocol=17 | dir=in | app=c:\poker\pokerstrategy\equilator\equilator.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 23
"{26A24AE4-039D-4CA4-87B4-2F83216020F0}" = Java(TM) 6 Update 20
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{42DE940E-8037-4266-9FBF-5A3AEDA39E96}" = Holdem Manager
"{47EA4DDF-FD99-46B3-846C-9F3F315268AD}" = ICM Trainer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = Bison WebCam
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5CC68528-24FF-4DF8-91C9-AF540F98505A}" = Sony Ericsson Drivers
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{901E0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 German User Interface Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A1973A71-BC23-4A8C-A0A0-2B0497B7EAF4}" = WISO Sparbuch 2008
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{B192E1BB-98A4-4369-9271-96117A57F546}" = Sony Ericsson PC Suite
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}" = Sony Ericsson Device Data
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D4EB3763-9586-405D-B376-DE98C8C9285E}" = PokerStrategy Equilator
"{D6BF6477-8369-489F-8DE6-3731F4B88560}" = Sony Ericsson PC Suite
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"GIMPshop" = GIMPshop 2.2.8
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"IsoBuster_is1" = IsoBuster 2.5
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.1.4
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MonKey Kassenbuch 2011_is1" = MonKey Kassenbuch 2011, Version 8.0.1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"PartyPoker" = PartyPoker
"PostgreSQL 8.4" = PostgreSQL 8.4
"Power Manager_is1" = Power Manager 2.1.7
"PrimoPDF4.0.2.5" = PrimoPDF
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"Taxpool-Buchhalter Mini" = Taxpool-Buchhalter Mini 4.16
"Titan Poker" = Titan Poker
"TQVault_is1" = TQVault 2.11
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VLC media player" = VLC media player 1.0.5
"WavePad" = WavePad Sound Editor
"WinRAR archiver" = WinRAR archiver
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
Ich hatte in einigen Posts gesehen, dass die Logs als eigenes Fenster mit Scrollbar angezeigt werden und hatte gehofft, dass diese automatisch umgewandelt werden. Leider passiert es nicht und ich konnte keine Anleitung finden, wie man das macht. Wäre super, wenn mir jemand schreibt, wie man das macht. Schon mal vorab vielen Dank für die Hilfe, Steffen |
|
25.02.2011, 09:32
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | syscheckrt.exe in c:\syscheckrt\ Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
|
26.02.2011, 16:33
| #3 |
| | syscheckrt.exe in c:\syscheckrt\ Hallo Arne,
__________________ich habe mir Malwerbytes runtergeladen und laufen lassen. Hier der Log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5883 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19019 26.02.2011 16:27:41 mbam-log-2011-02-26 (16-27-41).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 163987 Laufzeit: 5 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Grüße, Steffen |
|
26.02.2011, 20:18
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | syscheckrt.exe in c:\syscheckrt\Zitat:
Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
27.02.2011, 14:00
| #5 |
| | syscheckrt.exe in c:\syscheckrt\ Hier der Log des MB Vollscans: Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5883
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019
27.02.2011 13:55:54
mbam-log-2011-02-27 (13-55-54).txt
Scan type: Full scan (C:\|E:\|)
Objects scanned: 287399
Time elapsed: 1 hour(s), 16 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Da ich MB erst gestern installiert habe, gibt es keine älteren Logs. Grüße, Steffen |
|
27.02.2011, 15:23
| #6 |
| | syscheckrt.exe in c:\syscheckrt\ OK, auf die Admin Idee hätte ich natürlich auch vorher kommen können und einen Post sparen. Ich habe Malwarebytes noch mal als Admin gestartet, dann hat auch das Update funktioniert. Hier das Ergebnis dieses Vollscans: Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 5892
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019
27.02.2011 15:13:02
mbam-log-2011-02-27 (15-13-02).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 311271
Laufzeit: 1 Stunde(n), 8 Minute(n), 24 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
e:\$RECYCLE.BIN\s-1-5-21-1117535446-3671091523-533072694-1000\$RTM8UGS.6\Keygen\Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Wie kann ich denn die Dateien aus dem e:\$recycle.bin löschen (außer sie in dem versteckten Verzeichnis händisch zu löschen)? Offensichtlich werden sie nicht entfernt, wenn ich den Papierkorb leere. Ansonsten wäre die gefundene über zwei Jahre alte Datei nicht mehr dort. Grüße, Steffen Geändert von Steffen1 (27.02.2011 um 16:00 Uhr) |
|
27.02.2011, 20:30
| #7 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | syscheckrt.exe in c:\syscheckrt\Zitat:
 Dateien, die crack.exe, keygen.exe oder patch.exe sind zu 99,9% gefährliche Schädlinge, mit denen man nicht Spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur Neuinstallation von Windows!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.02.2011, 12:14
| #8 |
| | syscheckrt.exe in c:\syscheckrt\ Hi Arne, wie schon erwähnt, handelt es sich nicht um "meine" Datei und ich habe sie auch nicht benutzt. Andererseits habe ich natürlich keine Möglichkeit dies zu beweisen und ich verstehe, dass das Board nichts mit illegaler Software zu tun haben will. Trotzdem Danke für das Angebot der Hilfestellung und die vielen Informationen und Tips, die in diesem Forum zusammengetragen wurden. Grüße, Steffen |
|
| Themen zu syscheckrt.exe in c:\syscheckrt\ |
| 0x00000001, antivir, autorun, avgntflt.sys, avira, cdburnerxp, computer, corp./icp, error, excel, excel.exe, firefox, flash player, fontcache, home, home premium, iexplore.exe, install.exe, location, logfile, microsoft office 2003, mozilla, nvlddmkm.sys, nvstor.sys, object, oldtimer, otl.exe, plug-in, programdata, realtek, registry, rundll, saver, scan, sched.exe, searchplugins, security, shell32.dll, skype.exe, software, sparbuch, sptd.sys, start menu, studio, super, system, trojaner, vista, visual studio, windows |
Linear-Darstellung
