| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.ZPACK.Gen - was tun?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
15.04.2011, 10:51
| #1 |
| |  TR/Crypt.ZPACK.Gen - was tun? Hallo, bin neu hier und hoffe ihr könnt mir helfen. Gestern hat sich der Trojaner TR/Crypt.ZPACK.Gen bei mir eingenistet  . Bekam von Antivir sofort mehrere Meldungen das versch. Dateien infiziert und ins Quarantäneverzeichnis verschoben wurden. Habe sofort einen Scan gemacht und Antivir fand zwar nicht mehr diesen Trojaner aber dafür den Java-Virus: JAVA/Exdoer.BG.6 (wo ich mir den Trojaner eingefangen hab bekam ich auch eine Meldung wo was mit Java drin stand). Virus in die Quarantäne verschoben und System neu gestartet. Spybot laufen lassen: kein Fund , Antivir und Malewarebytes das gleiche, kein Fund. So nun nutzte ich das Notebook aber auch für Onlinebanking usw. Weswegen ich mir nicht sicher bin was nun zu tun ist? Habe mal die logfiles von otl und malewarebytes angehängt. Muss ich das System neu drauf spielen? Dabei gäbe es allerdings ein kleines Problem. Das Notebook ist neu und ich hatte bis dahin noch keine recovery cd gemacht. Und glaube das geht auch ohne cd nicht. Das mit der Cd(bzw. es waren 3 dvd's) habe ich jetzt nachgeholt (Revocery-Ordner ist auf einer anderen Partition). Kann man die noch verwenden? mfg Tim Hier erst mal die Funde von Antivir: Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\65mnmdz6.exe' C:\Users\AA\AppData\Local\Temp\65mnmdz6.exe [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a5cf3c5.qua' verschoben! Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\jar_cache7716420238782651705.tmp' Der zu durchsuchende Pfad C:\Users\AA\AppData\Local\Temp\jar_cache7716420238782651705.tmp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-4bb5d5b1-temp' Der zu durchsuchende Pfad C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-4bb5d5b1-temp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-4bb5d5b1' C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-4bb5d5b1 [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52d7ddb0.qua' verschoben! Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\ueimigjc.exe' C:\Users\AA\AppData\Local\Temp\ueimigjc.exe [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0090875a.qua' verschoben! Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\jar_cache5911348552403466951.tmp' Der zu durchsuchende Pfad C:\Users\AA\AppData\Local\Temp\jar_cache5911348552403466951.tmp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-6695a747-temp' Der zu durchsuchende Pfad C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-6695a747-temp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-6695a747' C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-6695a747 [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '66bfc89a.qua' verschoben! Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\h2xjx56q.exe' C:\Users\AA\AppData\Local\Temp\h2xjx56q.exe [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '232ce473.qua' verschoben! Beginne mit der Suche in 'C:\Users\AA\AppData\Local\Temp\jar_cache8855021323985939821.tmp' Der zu durchsuchende Pfad C:\Users\AA\AppData\Local\Temp\jar_cache8855021323985939821.tmp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-204bbafd-temp' Der zu durchsuchende Pfad C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-204bbafd-temp konnte nicht geöffnet werden! Systemfehler [2]: Das System kann die angegebene Datei nicht finden. Beginne mit der Suche in 'C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-204bbafd' C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\4cac3381-204bbafd [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c20d7c5.qua' verschoben! Nach Scan von Antivir: C:\Users\AA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\7560f91-15b864db [FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Exdoer.BG.6 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48eed1f7.qua' verschoben! Malewarebytes: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6366 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 15.04.2011 06:28:51 mbam-log-2011-04-15 (06-28-51).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|) Durchsuchte Objekte: 414666 Laufzeit: 56 Minute(n), 5 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) otl:OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.04.2011 10:57:26 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = D:\ 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 73,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,73 Gb Total Space | 190,20 Gb Free Space | 81,73% Space Free | Partition Type: NTFS Drive D: | 232,64 Gb Total Space | 217,58 Gb Free Space | 93,53% Space Free | Partition Type: NTFS Computer Name: AA-TOSH | User Name: AA | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\TOSHIBA\PCDiag\PCDiag.exe () PRC - C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) PRC - c:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\mswinext.exe (Microsoft Corp.) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION) PRC - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION) PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) ========== Modules (SafeList) ========== MOD - D:\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (TOSHIBA eco Utility Service) -- C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation) SRV:64bit: - (TPCHSrv) -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) SRV:64bit: - (TOSHIBA HDD SSD Alert Service) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) SRV:64bit: - (TODDSrv) -- C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (GameConsoleService) -- C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.) SRV - (TMachInfo) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation) SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH) SRV - (NAUpdate) -- c:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (cfWiMAXService) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ConfigFree Service) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) SRV - (SBSDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) ========== Driver Services (SafeList) ========== DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation) DRV:64bit: - (tosrfec) -- C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (CnxtHdmiAudService) -- C:\Windows\SysNative\drivers\CHDMI64.sys (Conexant Systems Inc.) DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (tdcmdpst) -- C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.) DRV:64bit: - (TVALZ) -- C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (FwLnk) -- C:\Windows\SysNative\drivers\FwLnk.sys (TOSHIBA Corporation) DRV:64bit: - (PGEffect) -- C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (TVALZFL) -- C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (LUMDriver) -- C:\Windows\SysNative\drivers\LUMDriver.sys (IBM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\Firefox [2010.11.16 19:42:14 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.11.16 19:42:16 | 000,000,000 | ---D | M] O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\npwinext.dll (Microsoft Corporation) O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Programme\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.) O4:64bit: - HKLM..\Run: [HSON] C:\Programme\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Programme\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [SmoothView] C:\Programme\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Programme\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH) O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) O4:64bit: - HKLM..\Run: [TosNC] C:\Programme\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Programme\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [TosSENotify] C:\Programme\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Programme\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Programme\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation) O4:64bit: - HKLM..\Run: [TPwrMain] C:\Programme\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Bing Bar] C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\mswinext.exe (Microsoft Corp.) O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION) O4 - HKLM..\Run: [NBAgent] c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.) O4 - Startup: C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{81804919-5bd0-11e0-b602-00266ca7d88c}\Shell - "" = AutoRun O33 - MountPoints2\{81804919-5bd0-11e0-b602-00266ca7d88c}\Shell\AutoRun\command - "" = G:\INTEL\startspk.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.04.15 05:31:50 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Malwarebytes [2011.04.15 05:31:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.04.15 05:31:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.04.15 05:31:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.04.15 05:31:36 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.04.15 05:31:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.04.15 02:32:30 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll [2011.04.15 02:32:30 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll [2011.04.15 02:32:28 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2011.04.15 02:32:28 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2011.04.15 02:32:28 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2011.04.15 02:32:24 | 001,395,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42.dll [2011.04.15 02:32:24 | 001,359,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42u.dll [2011.04.15 02:32:23 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll [2011.04.15 02:32:23 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll [2011.04.15 02:32:19 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2011.04.15 02:32:19 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2011.04.15 02:32:19 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2011.04.15 02:32:19 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2011.04.15 02:32:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2011.04.15 02:32:03 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2011.04.15 02:32:03 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2011.04.15 02:32:03 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.04.15 02:32:03 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2011.04.15 02:32:03 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.04.15 02:32:03 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.04.15 02:32:03 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.04.15 02:32:02 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2011.04.15 02:32:02 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2011.04.15 02:32:02 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2011.04.15 02:32:02 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2011.04.15 02:32:01 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2011.04.15 02:32:01 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2011.04.15 02:31:40 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll [2011.04.15 02:31:39 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnscacheugc.exe [2011.04.15 02:31:39 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe [2011.04.15 02:31:36 | 000,640,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi [2011.04.15 02:31:36 | 000,603,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe [2011.04.15 02:31:36 | 000,518,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe [2011.04.15 02:31:36 | 000,019,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd1394.dll [2011.04.15 02:31:35 | 000,556,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi [2011.04.15 02:31:35 | 000,020,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdusb.dll [2011.04.15 02:31:35 | 000,017,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdcom.dll [2011.04.15 02:31:34 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FXSCOVER.exe [2011.04.11 19:13:22 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Avira [2011.04.11 17:52:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2011.04.11 17:52:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.04.11 17:52:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2011.04.09 12:14:28 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2011.04.08 17:12:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TOSHIBA Tempro [2011.04.08 17:12:42 | 000,000,000 | ---D | C] -- C:\ProgramData\IsolatedStorage [2011.04.08 10:21:28 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\InstallShield [2011.04.08 10:21:25 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\WinBatch [2011.04.03 13:59:34 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Axialis [2011.04.03 13:59:28 | 057,696,588 | ---- | C] (Axialis Software) -- C:\Windows\MAHLE_ScreenSaver.scr [2011.04.01 22:46:13 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Adobe [2011.03.31 22:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint [2011.03.31 22:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2011.03.31 22:40:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services [2011.03.31 22:39:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework [2011.03.31 22:38:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2011.03.31 22:38:31 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2011.03.31 22:38:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services [2011.03.31 22:37:36 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Microsoft Help [2011.03.31 22:37:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.03.31 22:37:16 | 000,000,000 | RH-D | C] -- C:\MSOCache [2011.03.31 22:09:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CATIA [2011.03.31 21:57:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Designer [2011.03.31 21:57:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dassault Systemes [2011.03.31 21:56:58 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\DassaultSystemes [2011.03.31 21:56:58 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\DassaultSystemes [2011.03.31 21:56:58 | 000,000,000 | ---D | C] -- C:\ProgramData\DassaultSystemes [2011.03.31 21:51:31 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\DAEMON Tools Lite [2011.03.31 21:51:28 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite [2011.03.31 21:30:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.03.31 21:29:56 | 000,116,568 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.03.31 21:29:56 | 000,083,120 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.03.31 21:29:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.03.31 21:29:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2011.03.31 19:05:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2011.03.31 08:00:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2011.03.31 07:59:47 | 001,942,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dfshim.dll [2011.03.31 07:59:47 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll [2011.03.31 07:59:47 | 000,320,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHost.exe [2011.03.31 07:59:47 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe [2011.03.31 07:59:47 | 000,109,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHostProxy.dll [2011.03.31 07:59:47 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll [2011.03.31 07:59:47 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll [2011.03.31 07:59:47 | 000,048,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netfxperf.dll [2011.03.31 07:59:41 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2011.03.30 14:42:33 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll [2011.03.30 14:42:33 | 000,723,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011.03.30 14:42:32 | 001,118,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sbe.dll [2011.03.30 14:42:32 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sbe.dll [2011.03.30 14:42:32 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll [2011.03.30 14:42:32 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011.03.30 14:42:32 | 000,259,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax [2011.03.30 14:42:32 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2011.03.30 14:42:30 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskschd.dll [2011.03.30 14:42:30 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmicmiplugin.dll [2011.03.30 14:42:30 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskschd.dll [2011.03.30 14:42:30 | 000,473,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskcomp.dll [2011.03.30 14:42:30 | 000,464,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskeng.exe [2011.03.30 14:42:30 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\taskcomp.dll [2011.03.30 14:42:30 | 000,285,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\schtasks.exe [2011.03.30 14:42:30 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\schtasks.exe [2011.03.30 14:42:24 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll [2011.03.30 14:42:24 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax [2011.03.30 14:42:24 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2011.03.30 14:42:16 | 000,264,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\upnp.dll [2011.03.30 14:42:16 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\upnp.dll [2011.03.30 14:42:16 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\davclnt.dll [2011.03.30 14:42:16 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wscapi.dll [2011.03.30 14:42:15 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\davclnt.dll [2011.03.30 14:42:15 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wscapi.dll [2011.03.30 14:42:15 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\slwga.dll [2011.03.30 14:42:15 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\slwga.dll [2011.03.30 14:42:07 | 000,662,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll [2011.03.30 14:42:07 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll [2011.03.30 14:42:06 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2011.03.30 14:42:03 | 001,837,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll [2011.03.30 14:42:03 | 001,540,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2011.03.30 14:42:03 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10warp.dll [2011.03.30 14:42:03 | 000,902,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll [2011.03.30 14:42:03 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d2d1.dll [2011.03.30 14:42:02 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\DWrite.dll [2011.03.30 14:42:01 | 001,863,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ExplorerFrame.dll [2011.03.30 14:42:01 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ExplorerFrame.dll [2011.03.30 14:42:01 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll [2011.03.30 14:42:01 | 000,265,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys [2011.03.30 14:42:01 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsRasterService.dll [2011.03.30 14:42:01 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1core.dll [2011.03.30 14:42:01 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll [2011.03.30 14:42:01 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1.dll [2011.03.30 14:42:01 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll [2011.03.30 14:42:01 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsRasterService.dll [2011.03.30 14:41:56 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll [2011.03.30 14:41:56 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll [2011.03.30 14:41:31 | 005,510,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2011.03.30 14:41:31 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2011.03.30 14:41:31 | 001,739,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll [2011.03.30 14:41:30 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2011.03.30 14:41:24 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys [2011.03.30 14:41:21 | 000,720,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbc32.dll [2011.03.30 14:41:21 | 000,573,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbc32.dll [2011.03.30 14:41:19 | 000,112,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe [2011.03.30 14:41:18 | 003,138,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll [2011.03.30 14:41:18 | 002,690,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2011.03.30 14:41:18 | 001,097,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe [2011.03.30 14:41:18 | 001,034,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe [2011.03.29 17:29:27 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\TOSHIBA_Corporation [2011.03.29 17:25:43 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Toshiba [2011.03.29 17:24:48 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Adobe [2011.03.29 17:24:27 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Nero [2011.03.29 17:24:24 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\ATI [2011.03.29 17:24:24 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\ATI [2011.03.29 17:24:06 | 000,000,000 | R--D | C] -- C:\Users\AA\Searches [2011.03.29 17:24:06 | 000,000,000 | R--D | C] -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.03.29 17:23:57 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Identities [2011.03.29 17:23:55 | 000,000,000 | R--D | C] -- C:\Users\AA\Contacts [2011.03.29 17:22:24 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\VirtualStore [2011.03.29 17:20:50 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Toshiba [2011.03.29 17:15:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ToshibaEurope [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Vorlagen [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\AppData\Local\Verlauf [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\AppData\Local\Temporary Internet Files [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Startmenü [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\SendTo [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Recent [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Netzwerkumgebung [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Lokale Einstellungen [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Documents\Eigene Videos [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Documents\Eigene Musik [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Eigene Dateien [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Documents\Eigene Bilder [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Druckumgebung [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Cookies [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\AppData\Local\Anwendungsdaten [2011.03.29 17:15:10 | 000,000,000 | -HSD | C] -- C:\Users\AA\Anwendungsdaten [2011.03.29 17:15:09 | 000,000,000 | --SD | C] -- C:\Users\AA\AppData\Roaming\Microsoft [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Videos [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Saved Games [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Pictures [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Music [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Links [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Favorites [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Downloads [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Documents [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\Desktop [2011.03.29 17:15:09 | 000,000,000 | R--D | C] -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.03.29 17:15:09 | 000,000,000 | -H-D | C] -- C:\Users\AA\AppData [2011.03.29 17:15:09 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Temp [2011.03.29 17:15:09 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Local\Microsoft [2011.03.29 17:15:09 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Media Center Programs [2011.03.29 17:15:09 | 000,000,000 | ---D | C] -- C:\Users\AA\AppData\Roaming\Macromedia [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Programme [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.03.29 17:14:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.04.15 09:59:53 | 000,016,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.04.15 09:59:53 | 000,016,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.04.15 09:54:55 | 000,002,046 | ---- | M] () -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011.04.15 09:52:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.04.15 09:51:57 | 3113,361,408 | -HS- | M] () -- C:\hiberfil.sys [2011.04.15 05:31:42 | 000,001,120 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.04.15 03:21:05 | 000,425,232 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.04.10 19:14:20 | 001,486,084 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.04.10 19:14:20 | 000,648,704 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.04.10 19:14:20 | 000,611,332 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.04.10 19:14:20 | 000,128,930 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.04.10 19:14:20 | 000,105,512 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.04.10 19:10:46 | 000,425,252 | ---- | M] () -- C:\Users\AA\Documents\test2.CATPart [2011.04.10 12:40:54 | 000,076,037 | ---- | M] () -- C:\Users\AA\Documents\test1.CATPart [2011.04.09 12:14:25 | 387,259,715 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011.04.04 21:57:12 | 000,000,825 | ---- | M] () -- C:\Users\AA\Desktop\Studium - Verknüpfung.lnk [2011.04.03 13:55:20 | 057,696,588 | ---- | M] (Axialis Software) -- C:\Windows\MAHLE_ScreenSaver.scr [2011.03.31 22:09:54 | 000,002,488 | ---- | M] () -- C:\Users\Public\Desktop\CATIA V5R19.lnk [2011.03.31 21:52:25 | 000,834,544 | ---- | M] () -- C:\Windows\SysNative\drivers\sptd.sys [2011.03.31 21:47:50 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.03.31 21:30:02 | 000,002,077 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.03.31 15:39:01 | 000,001,761 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk [2011.03.29 17:12:52 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.03.29 17:12:52 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2011.03.29 17:11:21 | 000,000,000 | RHS- | M] () -- C:\Windows\SysWow64\drivers\TOSHIBA_Satellite L650_13467-GR_PSK1JE-0EW00.MRK [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.04.15 05:31:42 | 000,001,120 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.04.10 19:10:45 | 000,425,252 | ---- | C] () -- C:\Users\AA\Documents\test2.CATPart [2011.04.10 12:40:54 | 000,076,037 | ---- | C] () -- C:\Users\AA\Documents\test1.CATPart [2011.04.09 12:14:25 | 387,259,715 | ---- | C] () -- C:\Windows\MEMORY.DMP [2011.04.04 21:57:35 | 000,000,825 | ---- | C] () -- C:\Users\AA\Desktop\Studium - Verknüpfung.lnk [2011.03.31 22:09:54 | 000,002,488 | ---- | C] () -- C:\Users\Public\Desktop\CATIA V5R19.lnk [2011.03.31 21:52:25 | 000,834,544 | ---- | C] () -- C:\Windows\SysNative\drivers\sptd.sys [2011.03.31 21:47:50 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.03.31 21:30:02 | 000,002,077 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.03.31 15:39:01 | 000,001,761 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk [2011.03.29 17:24:07 | 000,001,450 | ---- | C] () -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.03.29 17:15:09 | 000,002,046 | ---- | C] () -- C:\Users\AA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011.03.29 17:11:21 | 000,000,000 | RHS- | C] () -- C:\Windows\SysWow64\drivers\TOSHIBA_Satellite L650_13467-GR_PSK1JE-0EW00.MRK [2011.01.23 23:56:31 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2010.11.17 10:00:54 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.11.16 18:01:20 | 000,002,012 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat < End of report > |
| Themen zu TR/Crypt.ZPACK.Gen - was tun? |
| adobe, alert, analysis, antivir, autorun, avg, avgntflt.sys, avira, bho, browser, chdrt64.sys, desktop, document, ebanking, error, explorer, firefox, format, helper, home, iastor.sys, jar_cache, kein fund, location, media center, mozilla, nicht sicher, ohne cd, oldtimer, otl.exe, performance, plug-in, realtek, registry, safer networking, saver, scan, sched.exe, senden, software, spielen, sptd.sys, start menu, studio, system, system neu, syswow64, temp, trojaner, trojaner eingefangen, visual studio, was tun, webcheck |
Baum-Darstellung