Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Versteckter Prozess (Rootkit) gefunden. Löschen? (https://www.trojaner-board.de/134279-versteckter-prozess-rootkit-gefunden-loeschen.html)

MaSchwa 30.04.2013 00:53
Versteckter Prozess (Rootkit) gefunden. Löschen?
 
Hallo liebe Community,

Ich habe anscheinend ein Rootkit in meinem System, was mir das Programm Gmer bestätigt hat. Google hat "gesagt" ich soll bevor ich irgendeinen versteckten Prozess lösche in einem Forum nachfragen, ob es richtig ist, diesen Prozess zu killen, da eventuell auch irreparable Schäden möglich sind. Ich hoffe ihr könnt mir weiterhelfen.

Vielen Dank schon mal im Voraus.

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-04-30 01:46:42
Windows 6.0.6000 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0 232,89GB
Running: llikksn3.exe; Driver: C:\Users\MARCEL~1\AppData\Local\Temp\uxliruog.sys


---- System - GMER 2.1 ----

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0x8C71959C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0x8CF9E388]

......

......

.....

---- Processes - GMER 2.1 ----

Process (*** hidden *** ) [4] 83A3E7B0

---- EOF - GMER 2.1 ----

Psychotic 30.04.2013 08:25
:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellste und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein Rechner clean ist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  1. Bitte arbeite alle Schritte der Reihe nach ab.
  2. Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  3. Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  4. Bitte kein Crossposting (posten in mehreren Foren) - wenn du die Anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  5. Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  6. Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!

    ...und ganz wichtig:

  7. Poste die Logfiles mit code-tags (das #-Symbol oben im Antwortfenster) in deinen Thread! Nicht anhängen, außer, ich fordere dich dazu auf. (Erschwert mir nämlich das Auswerten).


Vista und Win7 User
Alle Tools mit Rechtsklick --> "als Administrator ausführen" starten.


Schritt 1: defogger



Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
    Vista und Win7 User mit Rechtsklick "als Administrator starten".
  • Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
  • Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.




Schritt 2: OTL



Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
  • Doppelklick auf die OTL.exe
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.




Schritt 3: aswMBR



Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

MaSchwa 30.04.2013 11:08
Hallo Marius,

Erstmal schon mal vielen Dank für die schnelle Antwort. Das Problem bei der Formatierung ist, dass ich keine Vista-CD mit dem Laptop bekommen habe, ich konnte meinen Laptop nur mit Hilfe von solchen Recovery Cd's wieder auf den Auslieferungszustand zurücksetzen.

Hier die Berichte zu den einzelnen Schritten:




Schritt 1

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:42 on 30/04/2013 (Marcel_)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Schritt 2


Code:
OTL logfile created on: 30.04.2013 11:49:03 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Marcel_47\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16546)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 47,59% Memory free
4,21 Gb Paging File | 3,07 Gb Available in Paging File | 73,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,59 Gb Total Space | 117,96 Gb Free Space | 79,38% Space Free | Partition Type: NTFS
Drive D: | 72,29 Gb Total Space | 72,21 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: MARCEL_47-PC | User Name: Marcel_47 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Marcel_47\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\ProgramData\fsc-reg\fscreg.exe (Fujitsu Siemens Computers)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\47b2e1d9030f551f685dfea0b618e7fd\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a4fd3b000abfd4712b02ec223df3e9dd\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\982c005f97eacba888acdda322c49362\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\38b9d09539b67b08ee996db6c71f8a9b\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6d75eb3ca10a514754f5e87cc2134f07\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\19d027c3381110e60c003f2c8bd307ee\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\57ac9ba5419d6bf4b79f2979b0755428\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\c068708e16abf0be77a21b9f29817d83\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
MOD - C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2840.38361__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2840.38587__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2840.38318__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2840.38373__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2840.38579__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2840.38353__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2840.38339__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2840.38616__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2840.38537__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2840.38473__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2840.38621__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2840.38332__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2840.38482__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2840.38387__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2840.38340__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2840.38565__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2840.38545__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2840.38380__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.2840.38609__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2840.38504__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2840.38552__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2840.38481__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2840.38545__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2840.38609__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2840.38503__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2840.38580__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2840.38475__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.2840.38524__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2840.38467__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.2840.38392__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2840.38474__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2840.38392__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2840.38481__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2840.38523__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2791.32000__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2791.31999__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2791.32024__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2791.32011__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2791.32025__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2791.31986__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2791.31992__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2791.32016__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2791.32006__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2791.32002__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2791.32027__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2791.31988__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2791.32015__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2791.32041__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2791.32434__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2791.32041__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2791.32007__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2791.31999__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2791.31995__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2791.32016__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2791.32015__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2791.32001__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2791.32029__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2791.32040__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2791.32027__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2791.32014__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2833.15324__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2833.15304__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2791.32007__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2791.32014__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2791.32039__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2833.15206__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2791.32039__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2791.31987__90ba9c70f846762e\AEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2791.32029__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2791.32006__90ba9c70f846762e\APM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2791.32001__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2840.38348__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2840.38594__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2840.38602__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2840.38310__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2840.38601__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2791.31996__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2791.32008__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2840.38644__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2791.31993__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2791.32039__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2840.38594_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2791.32009__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2840.38309__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2840.38327__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2840.38311__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2840.38310__90ba9c70f846762e\APM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2840.38309__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2791.32004__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2840.38602__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2791.32010__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2791.32030__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56ita.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56esp.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56brz.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56kor.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56ger.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56fra.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56dnk.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56jpn.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56cht.dll ()
MOD - C:\Program Files\Motorola\SMSERIAL\sm56chs.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (CLTNetCnService) -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found
SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) -- C:\Windows\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (AswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswRvrt) -- C:\Windows\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (nvrd32) -- C:\Windows\System32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (JRAID) -- C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (NETw4v32) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (NETw3v32) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Marcel_47\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Marcel_47\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Marcel_47\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Marcel_47\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Google Docs = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: avast! WebRep = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0\
CHR - Extension: Google Mail = C:\Users\Marcel_47\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [recinfo303] c:\RecInfo\RecInfo.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (Fujitsu Siemens Computers)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E79C7507-696C-472E-8A50-22BFB78D1B95}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.30 11:38:41 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Marcel_47\Desktop\aswMBR.exe
[2013.04.30 11:38:17 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Marcel_47\Desktop\OTL.exe
[2013.04.30 00:19:03 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.04.29 23:58:50 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2013.04.29 23:58:46 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2013.04.29 23:58:46 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2013.04.29 22:41:23 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2013.04.29 22:41:22 | 000,996,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2013.04.29 00:05:22 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013.04.29 00:05:22 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2013.04.29 00:05:22 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2013.04.29 00:05:22 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013.04.29 00:05:22 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2013.04.29 00:04:52 | 000,272,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\polstore.dll
[2013.04.29 00:04:52 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FwRemoteSvr.dll
[2013.04.29 00:03:55 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2013.04.29 00:03:55 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2013.04.29 00:03:55 | 000,095,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2013.04.29 00:03:02 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2013.04.29 00:03:01 | 000,297,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2013.04.29 00:03:01 | 000,290,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2013.04.29 00:03:01 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanhlp.dll
[2013.04.29 00:03:01 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll
[2013.04.29 00:02:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2013.04.29 00:02:26 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml6r.dll
[2013.04.29 00:00:52 | 002,855,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.04.29 00:00:52 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2013.04.29 00:00:52 | 000,052,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rrinstaller.exe
[2013.04.29 00:00:52 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfpmp.exe
[2013.04.29 00:00:52 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mferror.dll
[2013.04.29 00:00:51 | 002,433,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2013.04.29 00:00:19 | 003,502,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.29 00:00:18 | 003,468,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.28 23:57:05 | 000,500,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2013.04.28 23:57:05 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xolehlp.dll
[2013.04.28 23:56:16 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2013.04.28 23:56:16 | 000,036,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2013.04.28 23:55:47 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll
[2013.04.28 23:54:58 | 000,713,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2013.04.28 23:53:11 | 001,244,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mcmde.dll
[2013.04.28 23:53:11 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2013.04.28 23:53:11 | 000,292,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2013.04.28 23:53:11 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2013.04.28 23:53:11 | 000,177,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2013.04.28 23:53:11 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2013.04.28 23:53:11 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2013.04.28 23:53:10 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2013.04.28 23:50:52 | 000,109,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ataport.sys
[2013.04.28 23:50:52 | 000,045,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\pciidex.sys
[2013.04.28 23:50:36 | 002,923,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.04.28 23:49:40 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcfg.exe
[2013.04.28 23:49:10 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2013.04.28 23:49:09 | 000,654,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2013.04.28 23:49:08 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2013.04.28 23:49:08 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2013.04.28 23:49:08 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2013.04.28 23:49:08 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2013.04.28 23:48:48 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2013.04.28 23:48:48 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2013.04.28 23:48:18 | 000,543,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FWPUCLNT.DLL
[2013.04.28 23:48:18 | 000,213,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2013.04.28 23:48:18 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2013.04.28 23:48:18 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2013.04.28 23:48:18 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiougc.exe
[2013.04.28 23:47:49 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMASF.DLL
[2013.04.28 23:47:49 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\LAPRXY.DLL
[2013.04.28 23:47:49 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asferror.dll
[2013.04.28 23:47:39 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2013.04.28 23:47:23 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amxread.dll
[2013.04.28 23:47:23 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apilogen.dll
[2013.04.28 23:47:07 | 000,425,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2013.04.28 23:47:06 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2013.04.28 23:46:23 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013.04.28 23:46:12 | 002,031,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.04.28 23:46:00 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rmcast.sys
[2013.04.28 23:46:00 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wshrm.dll
[2013.04.28 23:45:42 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2013.04.28 23:45:42 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2013.04.28 23:45:13 | 000,523,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2013.04.28 23:45:13 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2013.04.28 23:45:13 | 000,473,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2013.04.28 23:45:13 | 000,472,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2013.04.28 23:45:13 | 000,435,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2013.04.28 23:45:13 | 000,431,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2013.04.28 23:45:13 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2013.04.28 23:45:13 | 000,154,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2013.04.28 23:45:13 | 000,154,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2013.04.28 23:44:58 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbunattend.exe
[2013.04.28 23:44:37 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2013.04.28 23:44:19 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2013.04.28 23:44:17 | 004,247,552 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2013.04.28 23:44:17 | 001,686,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.04.28 23:43:50 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\INETRES.dll
[2013.04.28 23:43:40 | 001,645,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\connect.dll
[2013.04.28 23:43:14 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2013.04.28 23:41:52 | 000,321,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2013.04.28 23:41:44 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2013.04.28 23:40:48 | 001,327,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2013.04.28 23:40:48 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2013.04.28 23:40:48 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avicap32.dll
[2013.04.28 23:39:59 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2013.04.28 23:39:47 | 008,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2013.04.28 23:39:46 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2013.04.28 23:39:45 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2013.04.28 23:39:45 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2013.04.28 23:39:42 | 000,311,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2013.04.28 18:39:33 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\Google
[2013.04.28 18:39:31 | 000,368,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013.04.28 18:39:31 | 000,029,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013.04.28 18:39:31 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2013.04.28 18:39:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.04.28 18:39:30 | 000,765,736 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013.04.28 18:39:30 | 000,062,376 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013.04.28 18:39:30 | 000,049,760 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2013.04.28 18:39:28 | 000,228,600 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2013.04.28 18:39:28 | 000,066,336 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013.04.28 18:38:55 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.04.28 18:38:23 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.04.28 18:38:00 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.04.28 18:35:54 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\VirtualStore
[2013.04.28 18:33:38 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Roaming\Adobe
[2013.04.28 18:33:38 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\Adobe
[2013.04.28 18:32:12 | 000,000,000 | ---D | C] -- C:\ProgramData\fsc-reg
[2013.04.28 18:32:07 | 000,000,000 | ---D | C] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2013.04.28 18:31:59 | 000,000,000 | ---D | C] -- C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[2013.04.28 18:31:54 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\Seven Zip
[2013.04.28 18:30:32 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Roaming\ATI
[2013.04.28 18:30:32 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\ATI
[2013.04.28 18:30:12 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.04.28 18:30:12 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Searches
[2013.04.28 18:30:12 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.04.28 18:30:04 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Roaming\Identities
[2013.04.28 18:30:02 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Contacts
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Vorlagen
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\AppData\Local\Verlauf
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\AppData\Local\Temporary Internet Files
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Startmenü
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\SendTo
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Recent
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Netzwerkumgebung
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Lokale Einstellungen
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Documents\Eigene Videos
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Documents\Eigene Musik
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Eigene Dateien
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Documents\Eigene Bilder
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Druckumgebung
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Cookies
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\AppData\Local\Anwendungsdaten
[2013.04.28 18:29:50 | 000,000,000 | -HSD | C] -- C:\Users\Marcel_47\Anwendungsdaten
[2013.04.28 18:29:49 | 000,000,000 | --SD | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Videos
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Saved Games
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Pictures
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Music
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Links
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Favorites
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Downloads
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Documents
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\Desktop
[2013.04.28 18:29:49 | 000,000,000 | R--D | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.04.28 18:29:49 | 000,000,000 | -H-D | C] -- C:\Users\Marcel_47\AppData
[2013.04.28 18:29:49 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\Temp
[2013.04.28 18:29:49 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Local\Microsoft
[2013.04.28 18:29:49 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Roaming\Media Center Programs
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.04.28 18:25:57 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.04.28 18:21:40 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.04.28 18:17:53 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013.04.28 17:53:28 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.04.28 17:26:04 | 000,237,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2013.04.28 16:34:11 | 000,739,856 | ---- | C] (Google Inc.) -- C:\Users\Marcel_47\Desktop\chrome_installer141043.exe
[2013.04.28 16:27:12 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\Desktop\Marcels Geschenk
[2013.04.28 16:27:06 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\Desktop\Job Uni
[2013.04.28 16:27:03 | 000,000,000 | ---D | C] -- C:\Users\Marcel_47\Desktop\Hasi
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.30 11:42:12 | 000,000,000 | ---- | M] () -- C:\Users\Marcel_47\defogger_reenable
[2013.04.30 11:40:12 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Marcel_47\Desktop\aswMBR.exe
[2013.04.30 11:38:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Marcel_47\Desktop\OTL.exe
[2013.04.30 11:37:30 | 000,050,477 | ---- | M] () -- C:\Users\Marcel_47\Desktop\Defogger.exe
[2013.04.30 11:36:07 | 000,641,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.04.30 11:36:07 | 000,610,142 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.04.30 11:36:07 | 000,116,706 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.04.30 11:36:07 | 000,103,924 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.04.30 11:30:47 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.04.30 11:30:46 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.04.30 11:30:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.30 11:30:16 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.30 02:10:25 | 000,045,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\de-DE\http.sys.mui
[2013.04.30 02:05:59 | 000,001,136 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000UA.job
[2013.04.30 00:19:03 | 260,946,798 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.04.30 00:12:42 | 032,243,712 | ---- | M] () -- C:\Windows\ocsetup_install_NetFx3.etl
[2013.04.30 00:12:42 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.perf
[2013.04.30 00:12:41 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.dpx
[2013.04.29 23:58:50 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2013.04.29 23:58:46 | 000,158,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2013.04.29 23:58:46 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2013.04.29 22:41:23 | 000,094,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2013.04.29 22:41:22 | 000,996,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2013.04.29 21:10:06 | 000,298,088 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.04.29 03:16:43 | 000,000,009 | ---- | M] () -- C:\DVD.TAG
[2013.04.29 00:05:22 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013.04.29 00:05:22 | 000,156,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2013.04.29 00:05:22 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2013.04.29 00:05:22 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013.04.29 00:05:22 | 000,010,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2013.04.29 00:04:52 | 000,272,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\polstore.dll
[2013.04.29 00:04:52 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FwRemoteSvr.dll
[2013.04.29 00:03:55 | 000,241,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2013.04.29 00:03:55 | 000,160,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2013.04.29 00:03:55 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2013.04.29 00:03:02 | 001,657,350 | ---- | M] () -- C:\Windows\System32\wlan.tmf
[2013.04.29 00:03:02 | 000,123,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2013.04.29 00:03:01 | 000,297,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2013.04.29 00:03:01 | 000,290,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2013.04.29 00:03:01 | 000,067,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wlanhlp.dll
[2013.04.29 00:03:01 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll
[2013.04.29 00:02:27 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2013.04.29 00:02:26 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msxml6r.dll
[2013.04.29 00:00:52 | 002,855,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2013.04.29 00:00:52 | 000,098,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2013.04.29 00:00:52 | 000,052,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rrinstaller.exe
[2013.04.29 00:00:52 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfpmp.exe
[2013.04.29 00:00:52 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mferror.dll
[2013.04.29 00:00:51 | 002,433,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2013.04.29 00:00:19 | 003,502,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.29 00:00:19 | 003,468,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.28 23:57:05 | 000,500,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2013.04.28 23:57:05 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\xolehlp.dll
[2013.04.28 23:56:16 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2013.04.28 23:56:16 | 000,036,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2013.04.28 23:55:47 | 000,303,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmpeffects.dll
[2013.04.28 23:54:58 | 000,713,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2013.04.28 23:53:11 | 001,244,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mcmde.dll
[2013.04.28 23:53:11 | 000,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2013.04.28 23:53:11 | 000,217,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2013.04.28 23:53:11 | 000,177,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2013.04.28 23:53:11 | 000,080,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2013.04.28 23:53:11 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2013.04.28 23:53:10 | 000,057,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2013.04.28 23:50:52 | 000,109,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\ataport.sys
[2013.04.28 23:50:52 | 000,045,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\pciidex.sys
[2013.04.28 23:50:36 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2013.04.28 23:49:40 | 000,024,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netcfg.exe
[2013.04.28 23:49:10 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2013.04.28 23:49:09 | 000,654,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2013.04.28 23:49:09 | 000,053,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2013.04.28 23:49:08 | 000,158,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2013.04.28 23:49:08 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2013.04.28 23:49:08 | 000,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2013.04.28 23:48:48 | 000,220,672 | ---- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2013.04.28 23:48:48 | 000,062,464 | ---- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2013.04.28 23:48:18 | 000,543,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FWPUCLNT.DLL
[2013.04.28 23:48:18 | 000,213,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2013.04.28 23:48:18 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2013.04.28 23:48:18 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2013.04.28 23:48:18 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netiougc.exe
[2013.04.28 23:47:49 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMASF.DLL
[2013.04.28 23:47:49 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\LAPRXY.DLL
[2013.04.28 23:47:49 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\asferror.dll
[2013.04.28 23:47:39 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2013.04.28 23:47:23 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\amxread.dll
[2013.04.28 23:47:23 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\apilogen.dll
[2013.04.28 23:47:07 | 000,425,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2013.04.28 23:47:06 | 000,347,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2013.04.28 23:46:23 | 000,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013.04.28 23:46:12 | 002,031,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.04.28 23:46:00 | 000,113,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\rmcast.sys
[2013.04.28 23:46:00 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wshrm.dll
[2013.04.28 23:45:42 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2013.04.28 23:45:42 | 000,018,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2013.04.28 23:45:13 | 000,523,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2013.04.28 23:45:13 | 000,515,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2013.04.28 23:45:13 | 000,473,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2013.04.28 23:45:13 | 000,472,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2013.04.28 23:45:13 | 000,435,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2013.04.28 23:45:13 | 000,431,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2013.04.28 23:45:13 | 000,312,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2013.04.28 23:45:13 | 000,154,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2013.04.28 23:45:13 | 000,154,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2013.04.28 23:44:58 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sbunattend.exe
[2013.04.28 23:44:37 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2013.04.28 23:44:19 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2013.04.28 23:44:17 | 004,247,552 | ---- | M] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2013.04.28 23:44:17 | 001,686,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2013.04.28 23:43:50 | 000,084,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\INETRES.dll
[2013.04.28 23:43:40 | 001,645,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\connect.dll
[2013.04.28 23:43:14 | 000,024,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2013.04.28 23:41:52 | 000,321,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2013.04.28 23:41:44 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2013.04.28 23:40:48 | 000,082,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2013.04.28 23:40:48 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\avicap32.dll
[2013.04.28 23:39:59 | 000,604,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2013.04.28 23:39:47 | 008,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2013.04.28 23:39:46 | 000,007,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2013.04.28 23:39:45 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2013.04.28 23:39:42 | 000,311,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2013.04.28 18:39:31 | 000,001,835 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.28 18:39:28 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013.04.28 18:32:07 | 000,002,172 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Office – 60-Tage-Testversion.lnk
[2013.04.28 18:31:46 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\UMDF\Msft_User_WpdFs_01_00_00.Wdf
[2013.04.28 18:31:41 | 000,001,406 | ---- | M] () -- C:\Users\Marcel_47\Desktop\First Steps.lnk
[2013.04.28 18:31:39 | 000,001,520 | ---- | M] () -- C:\Users\Public\Desktop\eBay.lnk
[2013.04.28 18:06:00 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000Core.job
[2013.04.28 17:55:03 | 000,002,060 | ---- | M] () -- C:\Users\Marcel_47\Desktop\Google Chrome.lnk
[2013.04.28 16:34:00 | 000,739,856 | ---- | M] (Google Inc.) -- C:\Users\Marcel_47\Desktop\chrome_installer141043.exe
[2013.04.27 18:30:22 | 000,525,669 | ---- | M] () -- C:\Users\Marcel_47\Desktop\El Senor v. Chr.-0200.CivBeyondSwordSave
[2013.04.27 13:30:38 | 000,510,507 | ---- | M] () -- C:\Users\Marcel_47\Desktop\Khan, Dschinghis n. Chr.-1780.CivBeyondSwordSave
[2013.04.22 20:47:52 | 115,054,456 | ---- | M] () -- C:\Users\Marcel_47\Desktop\avast_free_73antivirus_setup.exe
 
========== Files Created - No Company Name ==========
 
[2013.04.30 11:42:12 | 000,000,000 | ---- | C] () -- C:\Users\Marcel_47\defogger_reenable
[2013.04.30 11:37:29 | 000,050,477 | ---- | C] () -- C:\Users\Marcel_47\Desktop\Defogger.exe
[2013.04.30 00:18:46 | 260,946,798 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.04.30 00:04:05 | 032,243,712 | ---- | C] () -- C:\Windows\ocsetup_install_NetFx3.etl
[2013.04.30 00:04:05 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_NetFx3.perf
[2013.04.30 00:04:05 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_NetFx3.dpx
[2013.04.29 03:16:43 | 000,000,009 | ---- | C] () -- C:\DVD.TAG
[2013.04.29 00:03:02 | 001,657,350 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2013.04.28 18:39:31 | 000,001,835 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.28 18:39:29 | 000,164,736 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013.04.28 18:39:29 | 000,049,248 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013.04.28 18:32:07 | 000,002,172 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Office – 60-Tage-Testversion.lnk
[2013.04.28 18:31:41 | 000,001,406 | ---- | C] () -- C:\Users\Marcel_47\Desktop\First Steps.lnk
[2013.04.28 18:31:39 | 000,001,520 | ---- | C] () -- C:\Users\Public\Desktop\eBay.lnk
[2013.04.28 18:30:13 | 000,000,955 | ---- | C] () -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.04.28 18:30:11 | 000,000,950 | ---- | C] () -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2013.04.28 18:30:02 | 000,000,921 | ---- | C] () -- C:\Users\Marcel_47\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2013.04.28 18:17:55 | 2145,837,056 | -HS- | C] () -- C:\hiberfil.sys
[2013.04.28 17:53:28 | 000,002,060 | ---- | C] () -- C:\Users\Marcel_47\Desktop\Google Chrome.lnk
[2013.04.28 17:50:46 | 000,001,136 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000UA.job
[2013.04.28 17:50:45 | 000,001,084 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000Core.job
[2013.04.28 16:32:01 | 152,249,762 | ---- | C] () -- C:\Users\Marcel_47\Desktop\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
[2013.04.28 16:26:40 | 000,525,669 | ---- | C] () -- C:\Users\Marcel_47\Desktop\El Senor v. Chr.-0200.CivBeyondSwordSave
[2013.04.28 16:26:40 | 000,510,507 | ---- | C] () -- C:\Users\Marcel_47\Desktop\Khan, Dschinghis n. Chr.-1780.CivBeyondSwordSave
[2013.04.22 20:43:27 | 115,054,456 | ---- | C] () -- C:\Users\Marcel_47\Desktop\avast_free_73antivirus_setup.exe
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.04.28 23:52:03 | 011,315,712 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2013.04.28 23:49:09 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2006.11.02 11:46:13 | 000,348,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >


Code:
OTL Extras logfile created on: 30.04.2013 11:49:03 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Marcel_47\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16546)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 47,59% Memory free
4,21 Gb Paging File | 3,07 Gb Available in Paging File | 73,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,59 Gb Total Space | 117,96 Gb Free Space | 79,38% Space Free | Partition Type: NTFS
Drive D: | 72,29 Gb Total Space | 72,21 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: MARCEL_47-PC | User Name: Marcel_47 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CDC3762-C87E-4BA0-88BE-A67B6F67FB52}" = dir=in | app=c:\program files\cyberlink\powerdv\powerdv.exe |
"{B3C233D1-1BDB-4932-9EE6-A558EDC399DA}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E4B9E090-E7B5-470A-AB8B-3AB341F8EBAD}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03AEE2B3-F368-E3A8-9EBB-4465FED5ECCF}" = CCC Help Japanese
"{0D32CEAA-E78B-9E26-582F-D2261E440C11}" = Catalyst Control Center Localization Chinese Traditional
"{1CD220E7-1512-A5E1-327F-9607587B75AD}" = Catalyst Control Center Graphics Light
"{2ED7986A-FFCF-7CE8-8714-10FADD57F93E}" = CCC Help Dutch
"{3569D31A-9079-9242-5506-72E724897CCE}" = CCC Help Chinese Traditional
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3E5948BC-A071-3C35-7DC4-31F5F293F35B}" = Catalyst Control Center Graphics Full New
"{418E2CBE-A6E4-7391-ABA0-B57CC95FB00A}" = Catalyst Control Center Localization Chinese Standard
"{42C5F6CE-D945-995C-033A-8401107567FA}" = CCC Help Spanish
"{43EA3C14-C1F7-A093-1F4D-362A09F9A63B}" = CCC Help German
"{44135984-1326-48ED-8071-BE0626892362}" = Catalyst Control Center Localization Italian
"{462F002C-0A03-6C5F-3475-228396D8F2AB}" = ccc-core-static
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = WebCam
"{5375B71B-6413-0C4D-9EDF-B059FECF66F7}" = CCC Help Swedish
"{5A66C68A-42E6-BB9E-2EC7-5C170DD944E9}" = Catalyst Control Center Localization Dutch
"{5B622752-7D0C-D1F6-85FC-7CD5604E6FA2}" = Catalyst Control Center Localization Swedish
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6BB19E5E-2AD7-B464-3B80-FB0CD8C504FB}" = Catalyst Control Center Graphics Full Existing
"{71DAE231-77A6-A1A9-EE96-E2C965988C54}" = Catalyst Control Center Localization French
"{73B9678F-E73B-E49F-4E21-EB5C839A1503}" = CCC Help Italian
"{763A5318-9657-9D47-3750-59DC1B00315E}" = CCC Help Chinese Standard
"{7C379BEF-4E12-3224-B2E8-513363B99181}" = ccc-utility
"{81CD6232-10F5-4832-B3DA-1B88B1571031}" = Nero 7 Essentials
"{8AC6C353-E7E2-163C-5C77-4D71F3A02443}" = CCC Help French
"{8AD67572-0AE2-0CAC-CD8B-17FBAC973901}" = ATI Catalyst Install Manager
"{8E4E938B-3D60-4F44-4E0A-CBC4259D96F9}" = CCC Help English
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95ED7549-7C66-A618-3100-B6999F6A79A4}" = Catalyst Control Center Localization German
"{960EED1D-8F37-9EF5-C2F2-19C19983658B}" = Catalyst Control Center Core Implementation
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E55D626-6CC8-780C-248E-486574EB08B7}" = CCC Help Korean
"{A471D44A-03B3-7D4D-D302-00430F5E992A}" = Catalyst Control Center Localization Portuguese
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{ABC80104-036E-6193-566F-4308420A4005}" = Catalyst Control Center Graphics Previews Vista
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{B71ACC25-ED80-056C-8184-F3A282F00818}" = Catalyst Control Center Localization Japanese
"{B804C424-B66D-447A-84BD-C6B88C392C3A}" = PowerDV
"{D8CF7C31-55A2-03EA-4998-89B44D559BBD}" = CCC Help Portuguese
"{DEE7AE5E-A8D1-05CF-5383-E5DC68486A54}" = Skins
"{E8673265-836F-796B-4923-27EC0D563810}" = Catalyst Control Center Localization Spanish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F252645C-3259-9DCC-C235-64562E08E868}" = Catalyst Control Center Localization Korean
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"avast" = avast! Free Antivirus
"Big Fish Games Center" = Big Fish Games Center (remove only)
"Big Fish Games Sudoku" = Big Fish Games Sudoku (remove only)
"Cradle of Rome" = Cradle of Rome (remove only)
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Luxor Amun Rising" = Luxor Amun Rising (remove only)
"Mahjong Towers Eternity EU" = Mahjong Towers Eternity EU (remove only)
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"Poker Superstars II" = Poker Superstars II (remove only)
"SMSERIAL" = Motorola SM56 Data Fax Modem
"Virtual Villagers" = Virtual Villagers (remove only)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.04.2013 12:30:41 | Computer Name = Marcel_47-PC | Source = Perflib | ID = 1008
Description =
 
Error - 28.04.2013 12:38:12 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 28.04.2013 11:47:27 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 28.04.2013 17:29:30 | Computer Name = Marcel_47-PC | Source = EventSystem | ID = 4621
Description =
 
Error - 29.04.2013 16:16:06 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 29.04.2013 16:26:56 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 29.04.2013 18:26:27 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 29.04.2013 18:30:24 | Computer Name = Marcel_47-PC | Source = Perflib | ID = 1008
Description =
 
Error - 29.04.2013 18:30:24 | Computer Name = Marcel_47-PC | Source = Perflib | ID = 1010
Description =
 
Error - 30.04.2013 05:36:07 | Computer Name = Marcel_47-PC | Source = WerSvc | ID = 5007
Description =
 
[ System Events ]
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 30.04.2013 05:49:13 | Computer Name = Marcel_47-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
 
< End of report >

Schritt 3


Code:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-30 12:02:40
-----------------------------
12:02:40.624    OS Version: Windows 6.0.6000
12:02:40.624    Number of processors: 2 586 0xF0D
12:02:40.624    ComputerName: MARCEL_47-PC  UserName: Marcel_47
12:02:41.466    Initialize success
12:02:41.653    AVAST engine defs: 13042901
12:02:58.614    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
12:02:58.630    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
12:02:58.770    Disk 0 MBR read successfully
12:02:58.770    Disk 0 MBR scan
12:02:58.786    Disk 0 Windows VISTA default MBR code
12:02:58.801    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        12288 MB offset 2048
12:02:58.801    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      152155 MB offset 25167872
12:02:58.832    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        74030 MB offset 336781312
12:02:58.848    Disk 0 scanning sectors +488394752
12:02:58.926    Disk 0 scanning C:\Windows\system32\drivers
12:03:04.729    Service scanning
12:03:18.351    Modules scanning
12:03:22.380    Disk 0 trace - called modules:
12:03:22.941    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
12:03:22.957    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x856a33d0]
12:03:22.957    3 ntkrnlpa.exe[820b07e2] -> nt!IofCallDriver -> [0x848176d0]
12:03:22.973    5 acpi.sys[8046932a] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84819030]
12:03:23.675    AVAST engine scan C:\Windows
12:03:25.437    AVAST engine scan C:\Windows\system32
12:05:00.742    AVAST engine scan C:\Windows\system32\drivers
12:05:09.722    AVAST engine scan C:\Users\Marcel_47
12:05:36.632    AVAST engine scan C:\ProgramData
12:05:48.020    Scan finished successfully
12:06:55.016    Disk 0 MBR has been saved successfully to "C:\Users\Marcel_47\Desktop\MBR.dat"
12:06:55.025    The log file has been saved successfully to "C:\Users\Marcel_47\Desktop\aswMBR.txt"
So ich hoffe ich hab alles richtig gemacht und du kannst damit was anfangen :)

Psychotic 30.04.2013 11:26
Hier kann ich nichts entdecken. Wir versuchen was anderes...


FRST



Downloade dir bitte Farbar's Recovery Scan Tool und speichere diese auf einen USB Stick.

Schließe den USB Stick an das infizierte System an

Du musst das System nun in die System Reparatur Option booten.

Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und starte von der CD
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !!
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".


Wähle in den Reparaturoptionen Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

MaSchwa 30.04.2013 11:46
Soooo...

Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-04-2013
Ran by SYSTEM on 30-04-2013 12:40:58
Running from G:\
Windows Vista (TM) Home Premium (X86) OS Language: English(US)
Internet Explorer Version 7
Boot Mode: Recovery
The current controlset is ControlSet001

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1006264 2007-12-05] (Microsoft Corporation)
HKLM\...\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [90112 2006-11-10] ()
HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [630784 2006-11-22] (Motorola Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40048 2007-05-10] (Adobe Systems Incorporated)
HKLM\...\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-02-26] (Nero AG)
HKLM\...\Run: [recinfo303] c:\RecInfo\RecInfo.exe [2764800 2007-10-23] ()
HKLM\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4767304 2013-03-06] (AVAST Software)
HKU\Marcel_47\...\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe [ 2007-11-08] (Fujitsu Siemens Computers)
HKU\Marcel_47\...\Run: [Google Update] "C:\Users\Marcel_47\AppData\Local\Google\Update\GoogleUpdate.exe" /c [ 2013-04-28] (Google Inc.)

========================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [45248 2013-03-06] (AVAST Software)
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [262247 2006-07-19] ()
S2 TestHandler; C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [204800 2006-12-08] (Fujitsu Siemens Computers)
S2 CLTNetCnService; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-03-06] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-03-06] (AVAST Software)
S1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [49760 2013-03-06] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49248 2013-03-06] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [765736 2013-03-06] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [368176 2013-03-06] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [62376 2013-03-06] (AVAST Software)
S3 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [164736 2013-03-06] ()
S3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [46592 2007-04-03] (Windows (R) Codename Longhorn DDK provider)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [48256 2007-06-13] (JMicron Technology Corp.)
S4 viamraid; C:\Windows\system32\drivers\viamraid.sys [102912 2006-11-08] (VIA Technologies inc,.ltd)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-04-30 12:40 - 2013-04-30 12:40 - 00000000 ____D C:\FRST
2013-04-30 02:06 - 2013-04-30 02:06 - 00002026 ____A C:\Users\Marcel_47\Desktop\aswMBR.txt
2013-04-30 02:06 - 2013-04-30 02:06 - 00000512 ____A C:\Users\Marcel_47\Desktop\MBR.dat
2013-04-30 01:54 - 2013-04-30 01:54 - 00127070 ____A C:\Users\Marcel_47\Desktop\OTL.Txt
2013-04-30 01:54 - 2013-04-30 01:54 - 00025924 ____A C:\Users\Marcel_47\Desktop\Extras.Txt
2013-04-30 01:47 - 2013-04-30 01:47 - 00000000 ____A C:\Users\Marcel_47\Desktop\Neues Textdokument.txt
2013-04-30 01:42 - 2013-04-30 01:42 - 00000480 ____A C:\Users\Marcel_47\Desktop\defogger_disable.log
2013-04-30 01:42 - 2013-04-30 01:42 - 00000000 ____A C:\Users\Marcel_47\defogger_reenable
2013-04-30 01:38 - 2013-04-30 01:40 - 04745728 ____A (AVAST Software) C:\Users\Marcel_47\Desktop\aswMBR.exe
2013-04-30 01:38 - 2013-04-30 01:38 - 00602112 ____A (OldTimer Tools) C:\Users\Marcel_47\Desktop\OTL.exe
2013-04-30 01:37 - 2013-04-30 01:37 - 00050477 ____A C:\Users\Marcel_47\Desktop\Defogger.exe
2013-04-29 16:11 - 2013-04-29 16:11 - 00378368 ____A (Microsoft Corporation) C:\Windows\System32\winhttp.dll
2013-04-29 16:10 - 2013-04-29 16:10 - 00268800 ____A (Microsoft Corporation) C:\Windows\System32\es.dll
2013-04-29 15:53 - 2013-04-29 15:53 - 00063260 ____A C:\Users\Marcel_47\Documents\Rootkit.log
2013-04-29 14:19 - 2013-04-29 14:19 - 00139000 ____A C:\Windows\Minidump\Mini043013-01.dmp
2013-04-29 14:19 - 2013-04-29 14:19 - 00000000 ____D C:\Windows\Minidump
2013-04-29 14:18 - 2013-04-29 14:19 - 260946798 ____A C:\Windows\MEMORY.DMP
2013-04-29 14:08 - 2013-04-29 14:09 - 00377856 ____A C:\Users\Marcel_47\Downloads\llikksn3.exe
2013-04-29 14:04 - 2013-04-29 14:12 - 32243712 ____A C:\Windows\ocsetup_install_NetFx3.etl
2013-04-29 14:04 - 2013-04-29 14:12 - 00196608 ____A C:\Windows\ocsetup_cbs_install_NetFx3.perf
2013-04-29 14:04 - 2013-04-29 14:12 - 00196608 ____A C:\Windows\ocsetup_cbs_install_NetFx3.dpx
2013-04-29 13:58 - 2013-04-29 13:58 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\mscoree.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00096760 ____A (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00083968 ____A (Microsoft Corporation) C:\Windows\System32\mscories.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\netfxperf.dll
2013-04-29 12:41 - 2013-04-29 12:41 - 00996352 ____A (Microsoft Corporation) C:\Windows\System32\WMNetMgr.dll
2013-04-29 12:41 - 2013-04-29 12:41 - 00094720 ____A (Microsoft Corporation) C:\Windows\System32\logagent.exe
2013-04-29 12:40 - 2013-04-29 12:40 - 00060928 ____A (Microsoft Corporation) C:\Windows\System32\msasn1.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00289792 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00156672 ____A (Microsoft Corporation) C:\Windows\System32\t2embed.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\fontsub.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00034304 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\lpk.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00010240 ____A (Microsoft Corporation) C:\Windows\System32\dciman32.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00361984 ____A (Microsoft Corporation) C:\Windows\System32\IPSECSVC.DLL
2013-04-28 14:04 - 2013-04-28 14:04 - 00306688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv.sys
2013-04-28 14:04 - 2013-04-28 14:04 - 00272896 ____A (Microsoft Corporation) C:\Windows\System32\polstore.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srvnet.sys
2013-04-28 14:04 - 2013-04-28 14:04 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\winipsec.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\FwRemoteSvr.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 01657350 ____A C:\Windows\System32\wlan.tmf
2013-04-28 14:03 - 2013-04-28 14:03 - 00502272 ____A (Microsoft Corporation) C:\Windows\System32\wlansvc.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00297984 ____A (Microsoft Corporation) C:\Windows\System32\wlansec.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00290816 ____A (Microsoft Corporation) C:\Windows\System32\wlanmsm.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00241152 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceApi.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\WebClnt.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00160768 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceTypes.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\L2SecHC.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00110080 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys
2013-04-28 14:03 - 2013-04-28 14:03 - 00095232 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceClassExtension.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00067584 ____A (Microsoft Corporation) C:\Windows\System32\wlanhlp.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\wlanapi.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 01406464 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 01260032 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml6r.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2013-04-28 14:01 - 2013-04-28 14:01 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2013-04-28 14:01 - 2013-04-28 14:01 - 00211968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2013-04-28 14:01 - 2013-04-28 14:01 - 00102400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2013-04-28 14:01 - 2013-04-28 14:01 - 00058368 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2013-04-28 14:00 - 2013-04-28 14:00 - 03502480 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 03468168 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 02855424 ____A (Microsoft Corporation) C:\Windows\System32\mf.dll
2013-04-28 14:00 - 2013-04-28 14:00 - 02433536 ____A (Microsoft Corporation) C:\Windows\System32\WMVCORE.DLL
2013-04-28 14:00 - 2013-04-28 14:00 - 00098816 ____A (Microsoft Corporation) C:\Windows\System32\mfps.dll
2013-04-28 14:00 - 2013-04-28 14:00 - 00052736 ____A (Microsoft Corporation) C:\Windows\System32\rrinstaller.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\mfpmp.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\mferror.dll
2013-04-28 13:59 - 2013-04-28 13:59 - 00434176 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 01060920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-04-28 13:58 - 2013-04-28 13:58 - 00297472 ____A (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\atl.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\monitor.sys
2013-04-28 13:57 - 2013-04-28 13:57 - 00500736 ____A (Microsoft Corporation) C:\Windows\System32\msdtcprx.dll
2013-04-28 13:57 - 2013-04-28 13:57 - 00030208 ____A (Microsoft Corporation) C:\Windows\System32\xolehlp.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 01871872 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00156160 ____A (Microsoft Corporation) C:\Windows\System32\wkssvc.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00116736 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00036352 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2013-04-28 13:55 - 2013-04-28 13:55 - 00303616 ____A (Microsoft Corporation) C:\Windows\System32\wmpeffects.dll
2013-04-28 13:54 - 2013-04-28 13:54 - 00713728 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2013-04-28 13:54 - 2013-04-28 13:54 - 00425472 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 01244672 ____A (Microsoft Corporation) C:\Windows\System32\mcmde.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00428032 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00292352 ____A (Microsoft Corporation) C:\Windows\System32\psisdecd.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00217088 ____A (Microsoft Corporation) C:\Windows\System32\psisrndr.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\mpg2splt.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00080896 ____A (Microsoft Corporation) C:\Windows\System32\MSNP.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\Mpeg2Data.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\MSDvbNP.ax
2013-04-28 13:52 - 2013-04-28 13:52 - 11315712 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-04-28 13:51 - 2013-04-28 13:51 - 00696832 ____A (Microsoft Corporation) C:\Windows\System32\localspl.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 02923520 ____A (Microsoft Corporation) C:\Windows\explorer.exe
2013-04-28 13:50 - 2013-04-28 13:50 - 01233920 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00494592 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00408136 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00272384 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00211000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\volsnap.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00175104 ____A (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00171520 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00154624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\nwifi.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00109624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00045112 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\pciidex.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00021560 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\atapi.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00017464 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\intelide.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-04-28 13:49 - 2013-04-28 13:49 - 00654336 ____A (Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
2013-04-28 13:49 - 2013-04-28 13:49 - 00549888 ____A (Microsoft Corporation) C:\Windows\System32\rpcss.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\sdohlp.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\iasrecst.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\iasads.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00037888 ____A (Microsoft Corporation) C:\Windows\System32\iasdatastore.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\printfilterpipelineprxy.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\netcfg.exe
2013-04-28 13:48 - 2013-04-28 13:48 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00543232 ____A (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00512000 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00416768 ____A (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00317440 ____A (Microsoft Corporation) C:\Windows\System32\BFE.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00220672 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codecp.acm
2013-04-28 13:48 - 2013-04-28 13:48 - 00213896 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00179712 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\tcpipcfg.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2013-04-28 13:48 - 2013-04-28 13:48 - 00062464 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2013-04-28 13:48 - 2013-04-28 13:48 - 00025088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tunnel.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\System32\netiougc.exe
2013-04-28 13:48 - 2013-04-28 13:48 - 00015360 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TUNMP.SYS
2013-04-28 13:47 - 2013-04-28 13:47 - 00875520 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00712192 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00425472 ____A (Microsoft Corporation) C:\Windows\System32\PhotoMetadataHandler.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00347136 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00293376 ____A (Microsoft Corporation) C:\Windows\System32\browserchoice.exe
2013-04-28 13:47 - 2013-04-28 13:47 - 00223232 ____A (Microsoft Corporation) C:\Windows\System32\WMASF.DLL
2013-04-28 13:47 - 2013-04-28 13:47 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\amxread.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00014848 ____A (Microsoft Corporation) C:\Windows\System32\apilogen.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\LAPRXY.DLL
2013-04-28 13:47 - 2013-04-28 13:47 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\asferror.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 02031104 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-04-28 13:46 - 2013-04-28 13:46 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00113664 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rmcast.sys
2013-04-28 13:46 - 2013-04-28 13:46 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\cabview.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00014848 ____A (Microsoft Corporation) C:\Windows\System32\wshrm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00523776 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_isv.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00515584 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00473088 ____A (Microsoft Corporation) C:\Windows\System32\secproc_isv.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00472576 ____A (Microsoft Corporation) C:\Windows\System32\secproc.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00435712 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00431104 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp_isv.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00313344 ____A (Microsoft Corporation) C:\Windows\System32\wmpdxm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00312320 ____A (Microsoft Corporation) C:\Windows\System32\msdrm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00154624 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp_isv.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00154112 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\msdxm.tlb
2013-04-28 13:45 - 2013-04-28 13:45 - 00018432 ____A (Microsoft Corporation) C:\Windows\System32\amcompat.tlb
2013-04-28 13:44 - 2013-04-28 13:44 - 04247552 ____A (Microsoft) C:\Windows\System32\GameUXLegacyGDFs.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 01686528 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00558080 ____A (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00162816 ____A (Microsoft Corporation) C:\Windows\System32\dnsapi.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00083968 ____A (Microsoft Corporation) C:\Windows\System32\dnsrslvr.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\Apphlpdm.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\dnscacheugc.exe
2013-04-28 13:44 - 2013-04-28 13:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\sbunattend.exe
2013-04-28 13:43 - 2013-04-28 13:43 - 01645568 ____A (Microsoft Corporation) C:\Windows\System32\connect.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00788992 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00737792 ____A (Microsoft Corporation) C:\Windows\System32\inetcomm.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00396800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2013-04-28 13:43 - 2013-04-28 13:43 - 00084480 ____A (Microsoft Corporation) C:\Windows\System32\INETRES.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\httpapi.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\nshhttp.dll
2013-04-28 13:42 - 2013-04-28 13:42 - 00283712 ____A C:\Windows\msxml4-KB954430-enu.LOG
2013-04-28 13:42 - 2013-04-28 13:42 - 00130048 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv2.sys
2013-04-28 13:41 - 2013-04-28 13:41 - 00321536 ____A (Microsoft Corporation) C:\Windows\System32\WSDApi.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00290332 ____A C:\Windows\msxml4-KB973688-enu.LOG
2013-04-28 13:41 - 2013-04-28 13:41 - 00274432 ____A (Microsoft Corporation) C:\Windows\System32\raschap.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00232960 ____A (Microsoft Corporation) C:\Windows\System32\rastls.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\poqexec.exe
2013-04-28 13:40 - 2013-04-28 13:40 - 01327616 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\msvfw32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\avifil32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00082944 ____A (Microsoft Corporation) C:\Windows\System32\mciavi32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\avicap32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00050176 ____A (Microsoft Corporation) C:\Windows\System32\iyuv_32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\msvidc32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00022528 ____A (Microsoft Corporation) C:\Windows\System32\msyuv.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msrle32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\tsbyuv.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 10622464 ____A (Microsoft Corporation) C:\Windows\System32\wmp.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 08147968 ____A (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2013-04-28 13:39 - 2013-04-28 13:39 - 00604672 ____A (Microsoft Corporation) C:\Windows\System32\WMSPDMOD.DLL
2013-04-28 13:39 - 2013-04-28 13:39 - 00311296 ____A (Microsoft Corporation) C:\Windows\System32\unregmp2.exe
2013-04-28 13:39 - 2013-04-28 13:39 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\spwmp.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\msdxm.ocx
2013-04-28 13:39 - 2013-04-28 13:39 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\dxmasf.dll
2013-04-28 08:39 - 2013-04-28 08:40 - 00000000 ____D C:\Program Files\Google
2013-04-28 08:39 - 2013-04-28 08:39 - 00001835 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-04-28 08:39 - 2013-04-28 07:52 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Google
2013-04-28 08:39 - 2013-03-06 14:33 - 00765736 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00368176 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00164736 ____A C:\Windows\System32\Drivers\aswVmm.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00066336 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00062376 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00049760 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00049248 ____A C:\Windows\System32\Drivers\aswRvrt.sys
2013-04-28 08:39 - 2013-03-06 14:33 - 00029816 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys
2013-04-28 08:39 - 2013-03-06 14:32 - 00228600 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe
2013-04-28 08:38 - 2013-04-28 08:38 - 00000000 ____D C:ProgramData\AVAST Software
2013-04-28 08:38 - 2013-04-28 08:38 - 00000000 ____D C:\Program Files\AVAST Software
2013-04-28 08:38 - 2013-03-06 14:32 - 00041664 ____A (AVAST Software) C:\Windows\avastSS.scr
2013-04-28 08:35 - 2013-04-28 08:36 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\VirtualStore
2013-04-28 08:33 - 2013-04-28 08:37 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Adobe
2013-04-28 08:33 - 2013-04-28 08:33 - 00000000 ____D C:\Users\Marcel_47\AppData\Roaming\Adobe
2013-04-28 08:32 - 2013-04-28 08:32 - 00002172 ____A C:\Users\Public\Desktop\Microsoft Office – 60-Tage-Testversion.lnk
2013-04-28 08:32 - 2013-04-28 08:32 - 00000000 ____D C:ProgramData\fsc-reg
2013-04-28 08:32 - 2013-04-28 08:32 - 00000000 ____D C:ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2013-04-28 08:31 - 2013-04-28 08:32 - 00000000 ____D C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2013-04-28 08:31 - 2013-04-28 08:31 - 00001520 ____A C:\Users\Public\Desktop\eBay.lnk
2013-04-28 08:31 - 2013-04-28 08:31 - 00001406 ____A C:\Users\Marcel_47\Desktop\First Steps.lnk
2013-04-28 08:31 - 2013-04-28 08:31 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Seven Zip
2013-04-28 08:30 - 2013-04-29 12:16 - 00070744 ____A C:\Users\Marcel_47\AppData\Local\GDIPFONTCACHEV1.DAT
2013-04-28 08:30 - 2013-04-28 08:30 - 00000000 ____D C:\Users\Marcel_47\AppData\Roaming\ATI
2013-04-28 08:30 - 2013-04-28 08:30 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\ATI
2013-04-28 08:29 - 2013-04-30 01:42 - 00000000 ____D C:\users\Marcel_47
2013-04-28 08:29 - 2013-04-28 08:29 - 00000020 ___SH C:\Users\Marcel_47\ntuser.ini
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Startmenü
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Netzwerkumgebung
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Druckumgebung
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Documents\Eigene Musik
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Documents\Eigene Bilder
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\AppData\Local\Verlauf
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Vorlagen
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Startmenü
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Favoriten
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Dokumente
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Anwendungsdaten
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Public\Documents\Eigene Musik
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Public\Documents\Eigene Bilder
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Startmenü
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Netzwerkumgebung
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Druckumgebung
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Documents\Eigene Musik
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Documents\Eigene Bilder
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\AppData\Local\Verlauf
2013-04-28 08:21 - 2013-04-30 02:36 - 01958769 ____A C:\Windows\WindowsUpdate.log
2013-04-28 07:53 - 2013-04-28 07:55 - 00002060 ____A C:\Users\Marcel_47\Desktop\Google Chrome.lnk
2013-04-28 07:50 - 2013-04-30 02:06 - 00001136 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000UA.job
2013-04-28 07:50 - 2013-04-28 08:06 - 00001084 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000Core.job
2013-04-28 07:26 - 2013-03-11 15:10 - 00237088 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-04-28 06:34 - 2013-04-28 06:34 - 00739856 ____A (Google Inc.) C:\Users\Marcel_47\Desktop\chrome_installer141043.exe
2013-04-28 06:32 - 2013-02-24 12:02 - 152249762 ____A C:\Users\Marcel_47\Desktop\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2013-04-28 06:30 - 2013-04-27 09:42 - 00024064 ____A C:\Users\Marcel_47\Desktop\Ausgaben.xls
2013-04-28 06:27 - 2013-04-28 08:36 - 00000000 ____D C:\Users\Marcel_47\Desktop\Marcels Geschenk
2013-04-28 06:27 - 2013-04-28 08:36 - 00000000 ____D C:\Users\Marcel_47\Desktop\Job Uni
2013-04-28 06:27 - 2013-04-28 08:36 - 00000000 ____D C:\Users\Marcel_47\Desktop\Hasi
2013-04-28 06:26 - 2013-04-27 08:30 - 00525669 ____A C:\Users\Marcel_47\Desktop\El Senor v. Chr.-0200.CivBeyondSwordSave
2013-04-28 06:26 - 2013-04-27 03:30 - 00510507 ____A C:\Users\Marcel_47\Desktop\Khan, Dschinghis n. Chr.-1780.CivBeyondSwordSave
2013-04-22 10:43 - 2013-04-22 10:47 - 115054456 ____A C:\Users\Marcel_47\Desktop\avast_free_73antivirus_setup.exe

==================== One Month Modified Files and Folders ========

2013-04-30 12:40 - 2013-04-30 12:40 - 00000000 ____D C:\FRST
2013-04-30 02:36 - 2013-04-28 08:21 - 01958769 ____A C:\Windows\WindowsUpdate.log
2013-04-30 02:36 - 2006-11-02 05:01 - 00005350 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-04-30 02:36 - 2006-11-02 05:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-30 02:35 - 2006-11-02 02:33 - 01461736 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-30 02:30 - 2006-11-02 04:47 - 00003072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-04-30 02:30 - 2006-11-02 04:47 - 00003072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-04-30 02:06 - 2013-04-30 02:06 - 00002026 ____A C:\Users\Marcel_47\Desktop\aswMBR.txt
2013-04-30 02:06 - 2013-04-30 02:06 - 00000512 ____A C:\Users\Marcel_47\Desktop\MBR.dat
2013-04-30 02:06 - 2013-04-28 07:50 - 00001136 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000UA.job
2013-04-30 01:54 - 2013-04-30 01:54 - 00127070 ____A C:\Users\Marcel_47\Desktop\OTL.Txt
2013-04-30 01:54 - 2013-04-30 01:54 - 00025924 ____A C:\Users\Marcel_47\Desktop\Extras.Txt
2013-04-30 01:47 - 2013-04-30 01:47 - 00000000 ____A C:\Users\Marcel_47\Desktop\Neues Textdokument.txt
2013-04-30 01:42 - 2013-04-30 01:42 - 00000480 ____A C:\Users\Marcel_47\Desktop\defogger_disable.log
2013-04-30 01:42 - 2013-04-30 01:42 - 00000000 ____A C:\Users\Marcel_47\defogger_reenable
2013-04-30 01:42 - 2013-04-28 08:29 - 00000000 ____D C:\users\Marcel_47
2013-04-30 01:40 - 2013-04-30 01:38 - 04745728 ____A (AVAST Software) C:\Users\Marcel_47\Desktop\aswMBR.exe
2013-04-30 01:38 - 2013-04-30 01:38 - 00602112 ____A (OldTimer Tools) C:\Users\Marcel_47\Desktop\OTL.exe
2013-04-30 01:37 - 2013-04-30 01:37 - 00050477 ____A C:\Users\Marcel_47\Desktop\Defogger.exe
2013-04-29 16:11 - 2013-04-29 16:11 - 00378368 ____A (Microsoft Corporation) C:\Windows\System32\winhttp.dll
2013-04-29 16:10 - 2013-04-29 16:10 - 00268800 ____A (Microsoft Corporation) C:\Windows\System32\es.dll
2013-04-29 16:10 - 2006-11-02 07:31 - 00000000 ____D C:\Windows\System32\Drivers\de-DE
2013-04-29 16:10 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-04-29 16:10 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\rescache
2013-04-29 15:53 - 2013-04-29 15:53 - 00063260 ____A C:\Users\Marcel_47\Documents\Rootkit.log
2013-04-29 14:35 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-04-29 14:19 - 2013-04-29 14:19 - 00139000 ____A C:\Windows\Minidump\Mini043013-01.dmp
2013-04-29 14:19 - 2013-04-29 14:19 - 00000000 ____D C:\Windows\Minidump
2013-04-29 14:19 - 2013-04-29 14:18 - 260946798 ____A C:\Windows\MEMORY.DMP
2013-04-29 14:12 - 2013-04-29 14:04 - 32243712 ____A C:\Windows\ocsetup_install_NetFx3.etl
2013-04-29 14:12 - 2013-04-29 14:04 - 00196608 ____A C:\Windows\ocsetup_cbs_install_NetFx3.perf
2013-04-29 14:12 - 2013-04-29 14:04 - 00196608 ____A C:\Windows\ocsetup_cbs_install_NetFx3.dpx
2013-04-29 14:09 - 2013-04-29 14:08 - 00377856 ____A C:\Users\Marcel_47\Downloads\llikksn3.exe
2013-04-29 13:58 - 2013-04-29 13:58 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\mscoree.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00096760 ____A (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00083968 ____A (Microsoft Corporation) C:\Windows\System32\mscories.dll
2013-04-29 13:58 - 2013-04-29 13:58 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\netfxperf.dll
2013-04-29 12:41 - 2013-04-29 12:41 - 00996352 ____A (Microsoft Corporation) C:\Windows\System32\WMNetMgr.dll
2013-04-29 12:41 - 2013-04-29 12:41 - 00094720 ____A (Microsoft Corporation) C:\Windows\System32\logagent.exe
2013-04-29 12:40 - 2013-04-29 12:40 - 00060928 ____A (Microsoft Corporation) C:\Windows\System32\msasn1.dll
2013-04-29 12:17 - 2006-11-02 04:50 - 00000749 __RAH C:\Windows\WindowsShell.Manifest
2013-04-29 12:17 - 2006-11-02 04:50 - 00000174 __ASH C:\Users\Public\desktop.ini
2013-04-29 12:17 - 2006-11-02 04:50 - 00000174 __ASH C:\users\desktop.ini
2013-04-29 12:17 - 2006-11-02 04:50 - 00000174 __ASH C:\Program Files\desktop.ini
2013-04-29 12:16 - 2013-04-28 08:30 - 00070744 ____A C:\Users\Marcel_47\AppData\Local\GDIPFONTCACHEV1.DAT
2013-04-29 11:10 - 2006-11-02 04:47 - 00298088 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-29 11:08 - 2006-11-02 04:37 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-04-29 11:08 - 2006-11-02 04:37 - 00000000 ____D C:\Program Files\Movie Maker
2013-04-28 14:05 - 2013-04-28 14:05 - 00289792 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00156672 ____A (Microsoft Corporation) C:\Windows\System32\t2embed.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\fontsub.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00034304 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\lpk.dll
2013-04-28 14:05 - 2013-04-28 14:05 - 00010240 ____A (Microsoft Corporation) C:\Windows\System32\dciman32.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00361984 ____A (Microsoft Corporation) C:\Windows\System32\IPSECSVC.DLL
2013-04-28 14:04 - 2013-04-28 14:04 - 00306688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv.sys
2013-04-28 14:04 - 2013-04-28 14:04 - 00272896 ____A (Microsoft Corporation) C:\Windows\System32\polstore.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srvnet.sys
2013-04-28 14:04 - 2013-04-28 14:04 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\winipsec.dll
2013-04-28 14:04 - 2013-04-28 14:04 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\FwRemoteSvr.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 01657350 ____A C:\Windows\System32\wlan.tmf
2013-04-28 14:03 - 2013-04-28 14:03 - 00502272 ____A (Microsoft Corporation) C:\Windows\System32\wlansvc.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00297984 ____A (Microsoft Corporation) C:\Windows\System32\wlansec.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00290816 ____A (Microsoft Corporation) C:\Windows\System32\wlanmsm.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00241152 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceApi.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\WebClnt.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00160768 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceTypes.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\L2SecHC.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00110080 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys
2013-04-28 14:03 - 2013-04-28 14:03 - 00095232 ____A (Microsoft Corporation) C:\Windows\System32\PortableDeviceClassExtension.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00067584 ____A (Microsoft Corporation) C:\Windows\System32\wlanhlp.dll
2013-04-28 14:03 - 2013-04-28 14:03 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\wlanapi.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 01406464 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 01260032 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml6r.dll
2013-04-28 14:02 - 2013-04-28 14:02 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2013-04-28 14:01 - 2013-04-28 14:01 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2013-04-28 14:01 - 2013-04-28 14:01 - 00211968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2013-04-28 14:01 - 2013-04-28 14:01 - 00102400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2013-04-28 14:01 - 2013-04-28 14:01 - 00058368 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2013-04-28 14:00 - 2013-04-28 14:00 - 03502480 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 03468168 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 02855424 ____A (Microsoft Corporation) C:\Windows\System32\mf.dll
2013-04-28 14:00 - 2013-04-28 14:00 - 02433536 ____A (Microsoft Corporation) C:\Windows\System32\WMVCORE.DLL
2013-04-28 14:00 - 2013-04-28 14:00 - 00098816 ____A (Microsoft Corporation) C:\Windows\System32\mfps.dll
2013-04-28 14:00 - 2013-04-28 14:00 - 00052736 ____A (Microsoft Corporation) C:\Windows\System32\rrinstaller.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\mfpmp.exe
2013-04-28 14:00 - 2013-04-28 14:00 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\mferror.dll
2013-04-28 13:59 - 2013-04-28 13:59 - 00434176 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 01060920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-04-28 13:58 - 2013-04-28 13:58 - 00297472 ____A (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\atl.dll
2013-04-28 13:58 - 2013-04-28 13:58 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\monitor.sys
2013-04-28 13:57 - 2013-04-28 13:57 - 00500736 ____A (Microsoft Corporation) C:\Windows\System32\msdtcprx.dll
2013-04-28 13:57 - 2013-04-28 13:57 - 00030208 ____A (Microsoft Corporation) C:\Windows\System32\xolehlp.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 01871872 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00156160 ____A (Microsoft Corporation) C:\Windows\System32\wkssvc.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00116736 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2013-04-28 13:56 - 2013-04-28 13:56 - 00036352 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2013-04-28 13:55 - 2013-04-28 13:55 - 00303616 ____A (Microsoft Corporation) C:\Windows\System32\wmpeffects.dll
2013-04-28 13:54 - 2013-04-28 13:54 - 00713728 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2013-04-28 13:54 - 2013-04-28 13:54 - 00425472 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 01244672 ____A (Microsoft Corporation) C:\Windows\System32\mcmde.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00428032 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00292352 ____A (Microsoft Corporation) C:\Windows\System32\psisdecd.dll
2013-04-28 13:53 - 2013-04-28 13:53 - 00217088 ____A (Microsoft Corporation) C:\Windows\System32\psisrndr.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\mpg2splt.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00080896 ____A (Microsoft Corporation) C:\Windows\System32\MSNP.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\Mpeg2Data.ax
2013-04-28 13:53 - 2013-04-28 13:53 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\MSDvbNP.ax
2013-04-28 13:52 - 2013-04-28 13:52 - 11315712 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-04-28 13:51 - 2013-04-28 13:51 - 00696832 ____A (Microsoft Corporation) C:\Windows\System32\localspl.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 02923520 ____A (Microsoft Corporation) C:\Windows\explorer.exe
2013-04-28 13:50 - 2013-04-28 13:50 - 01233920 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00494592 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00408136 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00272384 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00211000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\volsnap.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00175104 ____A (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00171520 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00154624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\nwifi.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00109624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00072704 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-04-28 13:50 - 2013-04-28 13:50 - 00045112 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\pciidex.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00021560 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\atapi.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00017464 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\intelide.sys
2013-04-28 13:50 - 2013-04-28 13:50 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-04-28 13:49 - 2013-04-28 13:49 - 00654336 ____A (Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
2013-04-28 13:49 - 2013-04-28 13:49 - 00549888 ____A (Microsoft Corporation) C:\Windows\System32\rpcss.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\sdohlp.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\iasrecst.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\iasads.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00037888 ____A (Microsoft Corporation) C:\Windows\System32\iasdatastore.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\printfilterpipelineprxy.dll
2013-04-28 13:49 - 2013-04-28 13:49 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\netcfg.exe
2013-04-28 13:48 - 2013-04-28 13:48 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00543232 ____A (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00512000 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00416768 ____A (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00317440 ____A (Microsoft Corporation) C:\Windows\System32\BFE.DLL
2013-04-28 13:48 - 2013-04-28 13:48 - 00220672 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codecp.acm
2013-04-28 13:48 - 2013-04-28 13:48 - 00213896 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00179712 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\tcpipcfg.dll
2013-04-28 13:48 - 2013-04-28 13:48 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2013-04-28 13:48 - 2013-04-28 13:48 - 00062464 ____A (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2013-04-28 13:48 - 2013-04-28 13:48 - 00025088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tunnel.sys
2013-04-28 13:48 - 2013-04-28 13:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\System32\netiougc.exe
2013-04-28 13:48 - 2013-04-28 13:48 - 00015360 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TUNMP.SYS
2013-04-28 13:47 - 2013-04-28 13:47 - 00875520 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00712192 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00425472 ____A (Microsoft Corporation) C:\Windows\System32\PhotoMetadataHandler.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00347136 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00293376 ____A (Microsoft Corporation) C:\Windows\System32\browserchoice.exe
2013-04-28 13:47 - 2013-04-28 13:47 - 00223232 ____A (Microsoft Corporation) C:\Windows\System32\WMASF.DLL
2013-04-28 13:47 - 2013-04-28 13:47 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\amxread.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00014848 ____A (Microsoft Corporation) C:\Windows\System32\apilogen.dll
2013-04-28 13:47 - 2013-04-28 13:47 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\LAPRXY.DLL
2013-04-28 13:47 - 2013-04-28 13:47 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\asferror.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 02031104 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-04-28 13:46 - 2013-04-28 13:46 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00113664 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rmcast.sys
2013-04-28 13:46 - 2013-04-28 13:46 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\cabview.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-04-28 13:46 - 2013-04-28 13:46 - 00014848 ____A (Microsoft Corporation) C:\Windows\System32\wshrm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00523776 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_isv.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00515584 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00473088 ____A (Microsoft Corporation) C:\Windows\System32\secproc_isv.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00472576 ____A (Microsoft Corporation) C:\Windows\System32\secproc.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00435712 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00431104 ____A (Microsoft Corporation) C:\Windows\System32\RMActivate_ssp_isv.exe
2013-04-28 13:45 - 2013-04-28 13:45 - 00313344 ____A (Microsoft Corporation) C:\Windows\System32\wmpdxm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00312320 ____A (Microsoft Corporation) C:\Windows\System32\msdrm.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00154624 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp_isv.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00154112 ____A (Microsoft Corporation) C:\Windows\System32\secproc_ssp.dll
2013-04-28 13:45 - 2013-04-28 13:45 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\msdxm.tlb
2013-04-28 13:45 - 2013-04-28 13:45 - 00018432 ____A (Microsoft Corporation) C:\Windows\System32\amcompat.tlb
2013-04-28 13:44 - 2013-04-28 13:44 - 04247552 ____A (Microsoft) C:\Windows\System32\GameUXLegacyGDFs.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 01686528 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00558080 ____A (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00162816 ____A (Microsoft Corporation) C:\Windows\System32\dnsapi.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00083968 ____A (Microsoft Corporation) C:\Windows\System32\dnsrslvr.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00028672 ____A (Microsoft Corporation) C:\Windows\System32\Apphlpdm.dll
2013-04-28 13:44 - 2013-04-28 13:44 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\dnscacheugc.exe
2013-04-28 13:44 - 2013-04-28 13:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\sbunattend.exe
2013-04-28 13:43 - 2013-04-28 13:43 - 01645568 ____A (Microsoft Corporation) C:\Windows\System32\connect.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00788992 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00737792 ____A (Microsoft Corporation) C:\Windows\System32\inetcomm.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00396800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2013-04-28 13:43 - 2013-04-28 13:43 - 00084480 ____A (Microsoft Corporation) C:\Windows\System32\INETRES.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\httpapi.dll
2013-04-28 13:43 - 2013-04-28 13:43 - 00024064 ____A (Microsoft Corporation) C:\Windows\System32\nshhttp.dll
2013-04-28 13:42 - 2013-04-28 13:42 - 00283712 ____A C:\Windows\msxml4-KB954430-enu.LOG
2013-04-28 13:42 - 2013-04-28 13:42 - 00130048 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv2.sys
2013-04-28 13:41 - 2013-04-28 13:41 - 00321536 ____A (Microsoft Corporation) C:\Windows\System32\WSDApi.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00290332 ____A C:\Windows\msxml4-KB973688-enu.LOG
2013-04-28 13:41 - 2013-04-28 13:41 - 00274432 ____A (Microsoft Corporation) C:\Windows\System32\raschap.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00232960 ____A (Microsoft Corporation) C:\Windows\System32\rastls.dll
2013-04-28 13:41 - 2013-04-28 13:41 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\poqexec.exe
2013-04-28 13:40 - 2013-04-28 13:40 - 01327616 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00123904 ____A (Microsoft Corporation) C:\Windows\System32\msvfw32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\avifil32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00082944 ____A (Microsoft Corporation) C:\Windows\System32\mciavi32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\avicap32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00050176 ____A (Microsoft Corporation) C:\Windows\System32\iyuv_32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\msvidc32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00022528 ____A (Microsoft Corporation) C:\Windows\System32\msyuv.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msrle32.dll
2013-04-28 13:40 - 2013-04-28 13:40 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\tsbyuv.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 10622464 ____A (Microsoft Corporation) C:\Windows\System32\wmp.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 08147968 ____A (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2013-04-28 13:39 - 2013-04-28 13:39 - 00604672 ____A (Microsoft Corporation) C:\Windows\System32\WMSPDMOD.DLL
2013-04-28 13:39 - 2013-04-28 13:39 - 00311296 ____A (Microsoft Corporation) C:\Windows\System32\unregmp2.exe
2013-04-28 13:39 - 2013-04-28 13:39 - 00007680 ____A (Microsoft Corporation) C:\Windows\System32\spwmp.dll
2013-04-28 13:39 - 2013-04-28 13:39 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\msdxm.ocx
2013-04-28 13:39 - 2013-04-28 13:39 - 00004096 ____A (Microsoft Corporation) C:\Windows\System32\dxmasf.dll
2013-04-28 08:40 - 2013-04-28 08:39 - 00000000 ____D C:\Program Files\Google
2013-04-28 08:39 - 2013-04-28 08:39 - 00001835 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-04-28 08:39 - 2006-11-02 02:23 - 00002577 ____A C:\Windows\System32\config.nt
2013-04-28 08:38 - 2013-04-28 08:38 - 00000000 ____D C:ProgramData\AVAST Software
2013-04-28 08:38 - 2013-04-28 08:38 - 00000000 ____D C:\Program Files\AVAST Software
2013-04-28 08:38 - 2006-11-02 04:37 - 00000000 ____D C:\Windows\System32\restore
2013-04-28 08:37 - 2013-04-28 08:33 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Adobe
2013-04-28 08:36 - 2013-04-28 08:35 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\VirtualStore
2013-04-28 08:36 - 2013-04-28 06:27 - 00000000 ____D C:\Users\Marcel_47\Desktop\Marcels Geschenk
2013-04-28 08:36 - 2013-04-28 06:27 - 00000000 ____D C:\Users\Marcel_47\Desktop\Job Uni
2013-04-28 08:36 - 2013-04-28 06:27 - 00000000 ____D C:\Users\Marcel_47\Desktop\Hasi
2013-04-28 08:33 - 2013-04-28 08:33 - 00000000 ____D C:\Users\Marcel_47\AppData\Roaming\Adobe
2013-04-28 08:32 - 2013-04-28 08:32 - 00002172 ____A C:\Users\Public\Desktop\Microsoft Office – 60-Tage-Testversion.lnk
2013-04-28 08:32 - 2013-04-28 08:32 - 00000000 ____D C:ProgramData\fsc-reg
2013-04-28 08:32 - 2013-04-28 08:32 - 00000000 ____D C:ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2013-04-28 08:32 - 2013-04-28 08:31 - 00000000 ____D C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2013-04-28 08:31 - 2013-04-28 08:31 - 00001520 ____A C:\Users\Public\Desktop\eBay.lnk
2013-04-28 08:31 - 2013-04-28 08:31 - 00001406 ____A C:\Users\Marcel_47\Desktop\First Steps.lnk
2013-04-28 08:31 - 2013-04-28 08:31 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Seven Zip
2013-04-28 08:31 - 2006-11-02 04:52 - 00014481 ____A C:\Windows\setupact.log
2013-04-28 08:31 - 2000-01-11 11:09 - 00000000 ____D C:\FirstSteps
2013-04-28 08:31 - 2000-01-11 11:09 - 00000000 ____D C:\ebay
2013-04-28 08:30 - 2013-04-28 08:30 - 00000000 ____D C:\Users\Marcel_47\AppData\Roaming\ATI
2013-04-28 08:30 - 2013-04-28 08:30 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\ATI
2013-04-28 08:29 - 2013-04-28 08:29 - 00000020 ___SH C:\Users\Marcel_47\ntuser.ini
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Startmenü
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Netzwerkumgebung
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Druckumgebung
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Documents\Eigene Musik
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\Documents\Eigene Bilder
2013-04-28 08:29 - 2013-04-28 08:29 - 00000000 __SHD C:\Users\Marcel_47\AppData\Local\Verlauf
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Vorlagen
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Startmenü
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Favoriten
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Dokumente
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:ProgramData\Anwendungsdaten
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Public\Documents\Eigene Musik
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Public\Documents\Eigene Bilder
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Startmenü
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Netzwerkumgebung
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Druckumgebung
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Documents\Eigene Musik
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\Documents\Eigene Bilder
2013-04-28 08:25 - 2013-04-28 08:25 - 00000000 __SHD C:\Users\Default\AppData\Local\Verlauf
2013-04-28 08:25 - 2006-11-02 03:18 - 00000000 __RHD C:\users\Default
2013-04-28 08:25 - 2006-11-02 03:18 - 00000000 ____D C:\Program Files\Windows NT
2013-04-28 08:21 - 2007-12-06 03:52 - 00000000 ____D C:\Windows\Panther
2013-04-28 08:20 - 2007-12-05 18:54 - 00003540 ____A C:\Windows\TSSysprep.log
2013-04-28 08:19 - 2006-11-02 04:48 - 00002856 ____A C:\Windows\DtcInstall.log
2013-04-28 08:06 - 2013-04-28 07:50 - 00001084 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3646662971-690315786-1530752921-1000Core.job
2013-04-28 08:05 - 2007-12-05 20:11 - 00000000 ____D C:ProgramData\Symantec
2013-04-28 07:55 - 2013-04-28 07:53 - 00002060 ____A C:\Users\Marcel_47\Desktop\Google Chrome.lnk
2013-04-28 07:52 - 2013-04-28 08:39 - 00000000 ____D C:\Users\Marcel_47\AppData\Local\Google
2013-04-28 07:46 - 2007-12-05 20:25 - 00041960 ____A C:\Windows\PFRO.log
2013-04-28 07:46 - 2006-11-02 03:18 - 00000000 ___SD C:ProgramData\Microsoft
2013-04-28 07:05 - 2007-12-05 20:11 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-04-28 06:34 - 2013-04-28 06:34 - 00739856 ____A (Google Inc.) C:\Users\Marcel_47\Desktop\chrome_installer141043.exe
2013-04-27 09:42 - 2013-04-28 06:30 - 00024064 ____A C:\Users\Marcel_47\Desktop\Ausgaben.xls
2013-04-27 08:30 - 2013-04-28 06:26 - 00525669 ____A C:\Users\Marcel_47\Desktop\El Senor v. Chr.-0200.CivBeyondSwordSave
2013-04-27 03:30 - 2013-04-28 06:26 - 00510507 ____A C:\Users\Marcel_47\Desktop\Khan, Dschinghis n. Chr.-1780.CivBeyondSwordSave
2013-04-22 10:47 - 2013-04-22 10:43 - 115054456 ____A C:\Users\Marcel_47\Desktop\avast_free_73antivirus_setup.exe

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-04-28 07:25:54
Restore point made on: 2013-04-28 08:38:20
Restore point made on: 2013-04-28 13:37:19
Restore point made on: 2013-04-29 12:39:22
Restore point made on: 2013-04-29 16:10:05

==================== Memory info ===========================

Percentage of memory in use: 19%
Total physical RAM: 2045.81 MB
Available physical RAM: 1644.55 MB
Total Pagefile: 1832.69 MB
Available Pagefile: 1695.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1975.71 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:148.59 GB) (Free:117.88 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:72.29 GB) (Free:72.21 GB) NTFS
Drive f: (WinRE) (Fixed) (Total:12 GB) (Free:5.41 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:3.73 GB) (Free:3.72 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

  Datentr ###  Status      Gr”áe    Frei    Dyn  GPT
  --------  ----------  -------  -------  ---  ---
      0    Online      233 GB  1177 KB       
      1    Online      3825 MB      0 B       


============================== MBR & Partition Table ==================

====================================================================
Disk: 0 (MBR Code: Windows Vista) (Size: 233 GB) (Disk ID: 03E145A4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=72 GB) - (Type=07 NTFS)

====================================================================
Disk: 1 (Size: 4 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)


Last Boot: 2013-04-30 01:35

==================== End Of Log ============================

Psychotic 30.04.2013 11:55
Ich kann hier nichts entdecken...

Sieht ganz gut aus - kontrollieren wir alles nochmal! :)


Schritt 1: MBAM vollständig


Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Vollständigen Scan durchführen und drücke auf Scannen. (Hinweis: Alle Festplatten anhaken!)
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.



Schritt 2: ESET


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


MaSchwa 30.04.2013 12:03
Wie kann ich Malwarebytes downloaden? Da steht zwar, der Download würde vorbereitet, jedoch passiert nichts.

Psychotic 30.04.2013 12:05
hier

MaSchwa 30.04.2013 12:23
Gut, das dauert offensichtlich noch etwas :)

Sooo Malwarebytes scheint nichts gefunden zu haben:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.04.30.02

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16546
Marcel_47 :: MARCEL_47-PC [Administrator]

30.04.2013 13:11:05
mbam-log-2013-04-30 (13-11-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 280073
Laufzeit: 1 Stunde(n), 5 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Ich mache jetzt Schritt 2...

In Schritt 2 wurden auch keine Bedrohungen gefunden, hier konnte ich auch keinen Logfile erstellen. Kann es sein dass das Rootkit verschwunden ist als ich meinen Laptop auf den Auslieferungszustand wiederhergestellt habe? Bevor ich das tat, bekam ich STÄNDIG von Avast eine Warnung, dass ein Rootkit gefunden wurde, aber wie erklärt sich dann der gefundene Prozess von Gmer? Ein Fehlalarm?

Und wenn jetzt alles in Ordnung ist, muss ich dann etwas Re-enablen beim defogger?

Psychotic 02.05.2013 07:17
Ach, du HAST das Gerät bereits zurückgesetzt. OK, damit hast du sämtlichen Schädlingen den Garaus gemacht. Im MBR der Festplatte versteckt sich auch nix, also können wir nachbereiten.



Adobe Reader update


Dein Adobe Reader ist veraltet. Da einige Schädlinge die Schwachstellen in veralteten Versionen nutzen, werden wir sie aktualisieren.

  • Lade dir den aktuellen Adobe Reader von hier herunter. Wichtig: Entferne den Haken für optionale Software (z.B. Google Chrome), der auf der Seite angezeigt wird, bevor du auf "Jetzt herunterladen" klickst.
  • Starte die Installation und folge den Anweisungen auf dem Bildschirm.
  • Drücke die Windows- und die R-Taste, gib im folgenden Fenster appwiz.cpl ein und klicke auf OK.
  • Suche und entferne alle älteren Reader-Versionen.



Defogger re-enable

Starte bitte den Defogger und klicke den re-enable Button




OTL

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.




Hier noch ein paar Tipps zur Absicherung deines Systems.

Aktualität

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.
Antviren-Software
  • Gehe sicher immer eine Antiviren-Software installiert zu haben und dass diese auch up to date ist. Auch der beste Virenscanner ist sinnlos, wenn er nicht aktuell ist!
    Eine Auswahl kostenloser Antivirenprogramme:
Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.
Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner, um diesen zu AdBlockPlus hinzuzufügen, reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.
Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Sei mißtrauisch in sozialen Netzwerken (z.B. MeinVZ, Facebook, etc) - auch, wenn Nachrichten/Einträge scheinbar von einem deiner Freunde stammen, bedeutet das noch lange nicht, dass sie unschädlich sind (Malware kann seinen Rechner verseucht haben).
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann.

MaSchwa 02.05.2013 10:50
So, alles erledigt. Ich danke dir für deine super schnelle und super Hilfe und die nützlichen Programme.

Psychotic 02.05.2013 11:58
Schön, dass wir helfen konnten! :abklatsch:


Dieses Thema scheint erledigt und wurde aus meinen Abos gelöscht.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und ein eigenes Thema erstellen!


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:49 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19