Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   ADSPY/Agent.223744 + TR/Kazy.18548.1 + diverse andere Plagen (https://www.trojaner-board.de/97653-adspy-agent-223744-tr-kazy-18548-1-diverse-andere-plagen.html)

Akkumolator 18.04.2011 18:41
ADSPY/Agent.223744 + TR/Kazy.18548.1 + diverse andere Plagen
 
Hallo allerseits,

Nachdem mein PC in regelmäßigen Abständen abstürzte und Google mich auf wundersame Weise mit allen möglichen Seiten verlinkt hat, mit Ausnahme von denen die ich tatsächlich angeklickt habe, habe ich Antivir mal Komplett meinen PC durchsuchen lassen.

Antivir fand dabei folgende Störprogramme:

ADSPY/Agent.223744
ADSPY/Burnfree.B
JAVA/Exdoer.BC.1
TR/Dropper.GEN
TR/Kazy.18548.1
TR/Pakes.JVM

Die Programme habe ich mittels AntiVir unter Qurantäne gestellt.

Im Anschluss habe ich mich per Internet über die Viren schlau machen wollen und bin über eure Seite gestolpert.

Jetzt hoffe das ihr mir beim entfernen der Schädlinge helfen könnt, da ich mich mit dem Thema überhaupt nicht auskenne.

Ich habe wie in der von euch angegebenen Beschreibung folgende Logfiles mittels Malwarebytes, sowie OTL erstellt.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6390

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

18.04.2011 19:10:26
mbam-log-2011-04-18 (19-10-26).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 414836
Laufzeit: 1 Stunde(n), 45 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



....und OTL als txt. Anhang

Anhang 15934,Anhang 15935


Vielen Dank schon einmal im voraus.

cosinus 18.04.2011 20:42
Zitat:
Antivir fand dabei folgende Störprogramme:
Log bitte komplett nachreichen.

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Akkumolator 19.04.2011 09:32
So hier sind die beiden zuerst erstellten Avir Berichte,

Anhang 15975 , Anhang 15976

sowie ein weiterer Malwarebytes Logfile, den ich vor dem geposteten Logfile gemacht habe.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6388

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

18.04.2011 11:33:13
mbam-log-2011-04-18 (11-33-13).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 179553
Laufzeit: 5 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PC Live Guard (Rogue.PCLiveGuard) -> Value: PC Live Guard -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL (Hijack.SearchPage) -> Bad: (hxxp://findgala.com/?&uid=7&q={searchTerms}) Good: (hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\Users\Benutzer\AppData\Roaming\pc live guard (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\Benutzer\AppData\Roaming\microsoft\Windows\start menu\Programs\pc live guard.lnk (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.
c:\Users\Benutzer\AppData\Roaming\microsoft\internet explorer\quick launch\pc live guard.lnk (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.
c:\Users\Benutzer\AppData\Roaming\microsoft\Windows\start menu\pc live guard.lnk (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.
c:\Users\Benutzer\AppData\Roaming\pc live guard\cookies.sqlite (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.
c:\Users\Benutzer\AppData\Roaming\pc live guard\instructions.ini (Rogue.PCLiveGuard) -> Quarantined and deleted successfully.

Ich bin überdies am überlegen, ob es nicht sinnvoll wäre mein Sytem zu formatieren und neu aufzusetzen. Zudem weiss ich nicht ob ich meine Online Account Daten verliere (Amazon, E-Mail), in wie weit diese weiterhin in Gefahr sind, oder ob die Viren,Trojaner, etc. immer noch auf dem PC vorhanden wären.
Den Rest meiner wichtigen persönlichen Daten habe ich auf externen Speichermedien untergebracht, weshalb ich diese Möglichkeit als Alternative zur Bereinigung in Betracht ziehe.

Über eine Entscheidungshilfe von euch würde ich mich freuen.

:dankeschoen:

cosinus 19.04.2011 19:45
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

Akkumolator 19.04.2011 20:39
Hier sind zwei aktuelle OTL Scans.

Anhang 16021

Anhang 16022

cosinus 19.04.2011 21:07
Deine Anhänge funktionieren nicht. Bitte normal posten oder alle Logs in EINE DATEI GEZIPT bei file-upload.net

Akkumolator 20.04.2011 10:14
Ok hier die OTL Logs.



OTL Extra Logfile:
Code:
OTL Extras logfile created on: 19.04.2011 21:27:45 - Run 3
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Benutzer\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 395,00 Mb Available Physical Memory | 39,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 53,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113,70 Gb Total Space | 36,45 Gb Free Space | 32,06% Space Free | Partition Type: NTFS
Drive D: | 113,34 Gb Total Space | 85,47 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: PC1 | User Name: Benutzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3189789724-1874663706-1517871287-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu -- (Acer Inc.)
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption -- (HiTRUST)
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption -- (HiTRUST)
"" = :*:Enabled:Yahoo! Music Jukebox
"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CDBA846-DCF7-4C7F-8787-3F1DFAFB0C60}" = protocol=17 | dir=in | app=c:\program files\lexmark 2500 series\lxddamon.exe |
"{0DFE0ABA-515F-404F-BC1C-8937ADC8F4DF}" = protocol=6 | dir=in | app=c:\program files\lexmark 2500 series\lxddmon.exe |
"{10FA5D65-1DE7-466E-8B2C-0E6718443186}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\red orchestra\system\redorchestra.exe |
"{1506F4DA-5773-4E26-B6EA-E04CD8296B84}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\red orchestra\system\redorchestra.exe |
"{23F74540-7FF7-4BC2-9431-81B509E7EAF4}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{2601DFCA-2ECD-4750-A279-FC2756536339}" = protocol=17 | dir=in | app=c:\windows\system32\lxddcoms.exe |
"{2609B5CB-3544-4E9F-BD86-4F42F355202F}" = protocol=6 | dir=in | app=c:\program files\lexmark 2500 series\lxddamon.exe |
"{49A9EE0D-85E2-41C6-94B3-5A6D4C972698}" = protocol=6 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{560BED54-9F18-415F-81FE-EF000420FD4B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{590B688B-4AAD-441E-B93C-14A4E49B4DA3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{5F826B1C-51D4-4BCC-AEE8-3658ABF92987}" = protocol=17 | dir=in | app=c:\program files\acer zone\acer zone main page\mce deluxe suite.exe |
"{640C056E-3924-4E0D-8E5C-FD375D88D724}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\red orchestra\system\redorchestra.exe |
"{641718CD-F51E-4B54-A27C-F9A7FB07145F}" = dir=in | app=c:\program files\acer zone\acer picture slide dvd\component\clsldvd.exe |
"{6F328782-51D4-4CA7-A916-95187208F6FF}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{6F768B1D-66FF-4305-B4FF-960E5C72906B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7574B1DA-FDB1-4217-B927-65584C93ACC3}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{783D719F-DF2A-456F-90E4-AEBF7078AA88}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{7F0847B0-AAA4-4E6A-90F2-9C26BA3623F6}" = dir=in | app=c:\program files\acer zone\acer plug and record\component\dvax2process.exe |
"{A8297613-CEBF-4468-BBCF-BDE34968DABC}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2 demo\bf2.exe |
"{AA00F4BC-C92B-4539-A6EE-140B457122C8}" = protocol=6 | dir=in | app=c:\program files\acer zone\acer zone main page\mce deluxe suite.exe |
"{AEFB590C-6C7B-41BF-A083-8110F9D8653D}" = protocol=6 | dir=in | app=c:\windows\system32\lxddcoms.exe |
"{B0F3ED34-BFCA-45FD-961A-CBDB1EFFD0AC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{B6C3878B-AADB-4457-B618-D84785084787}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{B901BB59-57E2-4E2F-8943-934AAED08558}" = protocol=17 | dir=in | app=c:\program files\lexmark 2500 series\app4r.exe |
"{B98DA94D-D1D5-4127-808C-99061B972957}" = protocol=17 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{BB7CFAC5-EE12-438E-A467-532660167EC3}" = protocol=6 | dir=in | app=c:\program files\lexmark 2500 series\app4r.exe |
"{CA82F8BE-49D0-493E-8F1E-60333D039A51}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{D8B8375D-D18B-4AE9-8B9E-DDE95D832EC1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{DFCC6F7E-0B5D-4492-84FD-4233257743CF}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{E1E4830C-19F5-4919-B5BA-0D10C9E238B9}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2 demo\bf2.exe |
"{E9645105-226A-407C-ACA7-47AFE323239A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{F61F56A9-412F-418A-A551-DA8B6112DF4C}" = dir=in | app=c:\program files\acer zone\acer plug and record\component\arawp.exe |
"{F89623FB-C558-466C-B1EA-CFCCB2A5F973}" = protocol=17 | dir=in | app=c:\program files\lexmark 2500 series\lxddmon.exe |
"{FDA8F07C-2403-4261-876E-7A981A7FFC7A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\red orchestra\system\redorchestra.exe |
"TCP Query User{22A2ABB1-04DE-40B8-B29A-1AE85E409428}C:\program files\ubisoft\crytek\far cry\bin32\farcry.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\crytek\far cry\bin32\farcry.exe |
"TCP Query User{2AD0736C-889E-4C93-9AA6-C2875BCDB19F}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{2AF4467D-4E44-40E2-A23D-1EEFC2DA68FC}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{349434BF-8A4B-4210-B5F7-9855E610DA20}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"TCP Query User{48B60DC0-8AF7-4A2E-8F4C-B405EBDA47CA}C:\program files\lexmark 2500 series\lxddamon.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 2500 series\lxddamon.exe |
"TCP Query User{772A79AA-B903-469C-8A55-AA34C0C0894C}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{9F2C3509-2BB8-46A5-9E88-37CC0777E864}C:\programdata\2c4034e\pc2c40.exe" = protocol=6 | dir=in | app=c:\programdata\2c4034e\pc2c40.exe |
"TCP Query User{A3A32800-2692-4F20-9B2D-4D7A01BC2DFD}C:\users\karl-heinz\appdata\roaming\icq\application\icq7.1\icq.exe" = protocol=6 | dir=in | app=c:\users\karl-heinz\appdata\roaming\icq\application\icq7.1\icq.exe |
"TCP Query User{A5BAB4F1-E13F-4E1E-BD4B-63F94201043A}C:\program files\ubisoft\crytek\far cry\bin32\farcry.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\crytek\far cry\bin32\farcry.exe |
"TCP Query User{AD0AE7E5-53B8-4833-A06A-B4995995238A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B21807C6-B8CC-485B-BBCA-41D625931F90}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"TCP Query User{D4198CD7-71BA-480D-88A0-2083F147065C}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{F2055061-17D9-48EC-9734-CE6B7E5CB350}C:\program files\lexmark 2500 series\app4r.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 2500 series\app4r.exe |
"TCP Query User{FDE7C9B9-688C-4FFF-A875-E171768FB03C}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe |
"UDP Query User{0656D52F-24C0-41A5-9083-EFE4ED6DDA8B}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{0C1D9645-DD82-49DB-A201-14912495D240}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{24F37CF6-3856-4A88-8B53-EF8BC942A12B}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
"UDP Query User{38DC5084-BF64-46BE-829D-98AB2B1D8125}C:\users\karl-heinz\appdata\roaming\icq\application\icq7.1\icq.exe" = protocol=17 | dir=in | app=c:\users\karl-heinz\appdata\roaming\icq\application\icq7.1\icq.exe |
"UDP Query User{4E47613B-2C52-4156-8E16-EADF8F17BD5C}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe |
"UDP Query User{4FAA0050-C388-4B5E-A5C3-5F3F110C5028}C:\program files\lexmark 2500 series\app4r.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 2500 series\app4r.exe |
"UDP Query User{597811AB-FD2A-44F7-A251-E58CBE95A0BB}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{6B6F0EFA-EF44-4266-AF17-B4CB17F01DCA}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{6D61D8F0-8B57-4C7F-9626-2CDFCB7AFCF3}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{90816FA5-1583-4986-A044-166DCE905320}C:\program files\ubisoft\crytek\far cry\bin32\farcry.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\crytek\far cry\bin32\farcry.exe |
"UDP Query User{A255C84B-1E45-4A6E-BA49-8B0670D0A1C5}C:\programdata\2c4034e\pc2c40.exe" = protocol=17 | dir=in | app=c:\programdata\2c4034e\pc2c40.exe |
"UDP Query User{CBCCB918-A64E-4C0B-8CFD-178C15A3DBCB}C:\program files\ubisoft\crytek\far cry\bin32\farcry.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\crytek\far cry\bin32\farcry.exe |
"UDP Query User{DE6C773F-D8C5-4B81-B47F-315F2F0527D5}C:\program files\lexmark 2500 series\lxddamon.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 2500 series\lxddamon.exe |
"UDP Query User{F83FB2FE-31CF-4AAB-8552-9D2C1F764D10}C:\program files\bearshare applications\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare applications\bearshare\bearshare.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{067FFF2F-0F1C-43DB-827B-F9BC4735F1BC}" = D2500
"{08F8FD7C-44A5-4423-B87C-EBD3D94C9F87}" = Vampire - The Masquerade Bloodlines
"{0900B4D5-B94A-4B08-9EB6-03C9D61D2975}" = Rome - Total War(TM) Demo
"{14C87AA7-08E6-419F-A165-998EBE5023D7}" = Oblivion - Knights of the Nine
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{16D919E6-F019-4E15-BFBE-4A85EF19DA57}" = Oblivion - Spell Tomes
"{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}" = Morrowind
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 20
"{27197499-7680-4208-8FD8-5439CDB0FDC1}" = HPProductAssistant
"{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}" = Rome - Total War - Gold Edition
"{2F2E3D62-8B8C-448F-8900-451325E50948}" = Oblivion - Wizard's Tower
"{35095169-C59A-4571-A361-2117E04B7AFD}" = DJ_SF_03_D2500_ProductContext
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{369B36BE-3D64-4641-9AEA-808D436FE132}" = Microsoft Picture It! Foto 7.0
"{3ABEBD00-299D-4DCA-967F-B912163AB5EA}" = Oblivion - Horse Armor Pack
"{3E5721E5-BA31-46AD-8B35-065924D38E91}" = D2500_Help
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer Picture Slide DVD
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{520F4B09-3A51-47A2-82B0-9FF1DC2D20FA}" = Oblivion - Vile Lair
"{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}" = TES Construction Set
"{593A6CAF-E114-4e31-884F-74FF349E8E36}" = SolutionCenter
"{59C6EFB0-7A6F-4FC2-98C5-31A9DB93014A}" = DJ_SF_03_D2500_Software
"{5A96225D-A3B7-4535-AE49-3BF217999669}" = RPG Maker Fonts
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7236B969-6A18-42DD-ADE4-BBA2604F34C8}" = DJ_SF_03_D2500_Software_Min
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7CDBE27D-87EC-434E-AFE4-D0116AE876BB}" = Microsoft Works Suite-Add-Ins für Microsoft Word
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III
"{98786147-80E3-41A5-A80C-1F3C028558CF}" = Hearts of Iron 2
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}" = Hitman Blood Money
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe  1.4.136.1
"{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103}" = Dark Messiah
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack
"{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC0E1AE3-091D-4969-B151-7AC142062C28}" = SmartWebPrinting
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BB}" = WinZip 14.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D063F201-FAC4-4D5C-B10B-615058ADE5A7}" = HP Update
"{D10AB8DE-0ED1-4152-A247-FB89CF1435D5}" = HP Deskjet D2500 Printer Driver Software 11.0 Rel .3
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D2BBEABB-A8DF-4451-A7C4-63C87B31E325}" = IL-2 Sturmovik: Forgotten Battles AEP
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D94A8E22-DF2B-4107-9E51-608A60A7671D}" = Personal Ancestral File 5
"{D98C9637-93DA-44DB-B73A-B11A1192AB26}" = GameShadow
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EC425CFC-EE78-4A91-AA25-3BFA65B75364}" = Oblivion - Orrery
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF295F5C-7B57-47AA-8889-6B3E8E214E89}" = Oblivion - Mehrunes Razor
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Zone Main Page
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer Plug and Record
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F8B7F8E3-C1A8-444C-8777-D69F861995E3}" = Tunebite
"{FFFFFD17-B460-41EB-93F1-C48ABAD63828}" = Oblivion - Thieves Den
"1x1-Trainer" = 1x1-Trainer 4
"7-Zip" = 7-Zip 4.65
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Burn4Free Toolbar" = Burn4Free Toolbar
"Copy Utility" = Copy Utility
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 11.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"InstallShield_{0900B4D5-B94A-4B08-9EB6-03C9D61D2975}" = Rome - Total War(TM) Demo
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III
"InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"InstallShield_{D2BBEABB-A8DF-4451-A7C4-63C87B31E325}" = IL-2 Sturmovik: Forgotten Battles AEP
"Lexmark 2500 Series" = Lexmark 2500 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NVIDIA Drivers" = NVIDIA Drivers
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"OpenAL" = OpenAL
"Shockwave" = Shockwave
"Steam App 1200" = Red Orchestra
"Steam App 1220" = RedOrchestra SDK Beta
"Steam App 1280" = Darkest Hour
"TIPP10_is1" = TIPP10 Version 2.0.3
"Trusted Software Assistant_is1" = File Type Assistant
"Vampires Dawn 2" = Vampires Dawn 2
"VLC media player" = VLC media player 1.1.7
"Works2003Setup" = Microsoft Works 2003-Setup-Start
"XTTB00001.XTTB00001Toolbar" = ICQ Toolbar
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 18.04.2011 11:29:06 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
 0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733dc,
 Ausnahmecode 0xc000071b, Fehleroffset 0x00089341,  Prozess-ID 0x494, Anwendungsstartzeit
 01cbfdc15c4cd7bf.
 
Error - 19.04.2011 04:00:51 | Computer Name = PC1 | Source = EventSystem | ID = 4609
Description =
 
Error - 19.04.2011 04:31:11 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
 0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733dc,
 Ausnahmecode 0xc000071b, Fehleroffset 0x00089341,  Prozess-ID 0x4bc, Anwendungsstartzeit
 01cbfe69c9189dbd.
 
Error - 19.04.2011 07:23:19 | Computer Name = PC1 | Source = EventSystem | ID = 4609
Description =
 
Error - 19.04.2011 07:37:48 | Computer Name = PC1 | Source = Windows Search Service | ID = 3013
Description =
 
Error - 19.04.2011 07:53:01 | Computer Name = PC1 | Source = Windows Search Service | ID = 3013
Description =
 
Error - 19.04.2011 08:11:04 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
 0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6001.18538, Zeitstempel 0x4cb733dc,
 Ausnahmecode 0xc000071b, Fehleroffset 0x00089341,  Prozess-ID 0x4c4, Anwendungsstartzeit
 01cbfe8803fdb9ab.
 
Error - 19.04.2011 11:35:03 | Computer Name = PC1 | Source = SPP | ID = 16387
Description =
 
Error - 19.04.2011 11:35:03 | Computer Name = PC1 | Source = System Restore | ID = 8193
Description =
 
Error - 19.04.2011 11:35:03 | Computer Name = PC1 | Source = System Restore | ID = 8210
Description =
 
[ System Events ]
Error - 19.04.2011 10:29:08 | Computer Name = PC1 | Source = Service Control Manager | ID = 7009
Description =
 
Error - 19.04.2011 10:29:08 | Computer Name = PC1 | Source = Service Control Manager | ID = 7000
Description =
 
Error - 19.04.2011 10:31:29 | Computer Name = PC1 | Source = Service Control Manager | ID = 7022
Description =
 
Error - 19.04.2011 10:51:14 | Computer Name = PC1 | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 19.04.2011 um 16:37:33 unerwartet heruntergefahren.
 
Error - 19.04.2011 10:51:26 | Computer Name = PC1 | Source = HTTP | ID = 15016
Description =
 
Error - 19.04.2011 10:52:39 | Computer Name = PC1 | Source = Service Control Manager | ID = 7000
Description =
 
Error - 19.04.2011 10:53:29 | Computer Name = PC1 | Source = Service Control Manager | ID = 7022
Description =
 
Error - 19.04.2011 15:21:33 | Computer Name = PC1 | Source = HTTP | ID = 15016
Description =
 
Error - 19.04.2011 15:22:56 | Computer Name = PC1 | Source = Service Control Manager | ID = 7000
Description =
 
Error - 19.04.2011 15:24:59 | Computer Name = PC1 | Source = Service Control Manager | ID = 7022
Description =
 
 
< End of report >
--- --- ---

--- --- ---

OTL Logfile:
Code:
OTL logfile created on: 19.04.2011 21:27:45 - Run 3
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Benutzer\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 395,00 Mb Available Physical Memory | 39,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 53,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113,70 Gb Total Space | 36,45 Gb Free Space | 32,06% Space Free | Partition Type: NTFS
Drive D: | 113,34 Gb Total Space | 85,47 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: PC1 | User Name: Benutzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Benutzer\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\lxddcoms.exe ( )
PRC - C:\Acer\Empowering Technology\EDSMSNFIX.EXE (HiTRUST co.)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\SysMonitor.exe ()
PRC - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe ()
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Benutzer\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (AVP) --  File not found
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (lxdd_device) -- C:\Windows\System32\lxddcoms.exe ( )
SRV - (eDataSecurity Service) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (AcerMemUsageCheckService) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (Cdralw2k) -- C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM) -- C:\Windows\System32\drivers\s116unic.sys (MCCI Corporation)
DRV - (s116obex) -- C:\Windows\System32\drivers\s116obex.sys (MCCI Corporation)
DRV - (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS) -- C:\Windows\System32\drivers\s116nd5.sys (MCCI Corporation)
DRV - (s116mgmt) Sony Ericsson Device 116  USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s116mgmt.sys (MCCI Corporation)
DRV - (s116mdm) -- C:\Windows\System32\drivers\s116mdm.sys (MCCI Corporation)
DRV - (s116mdfl) -- C:\Windows\System32\drivers\s116mdfl.sys (MCCI Corporation)
DRV - (s116bus) Sony Ericsson Device 116 driver (WDM) -- C:\Windows\System32\drivers\s116bus.sys (MCCI Corporation)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (int15) -- C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (WSVD) -- C:\Windows\System32\drivers\WSVD.sys (Wasay)
DRV - (hamachi_oem) -- C:\Windows\System32\drivers\gan_adapter.sys (Applied Networking Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.com/de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2008.12.04 16:05:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.19 10:02:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.27 12:30:47 | 000,000,000 | ---D | M]
 
[2009.12.29 14:31:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Extensions
[2009.05.18 19:45:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2010.06.11 16:20:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\tog5x45h.default\extensions
[2010.02.04 16:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\tog5x45h.default\searchplugins\askcom.xml
[2010.07.09 17:21:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.04.22 16:13:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2011.03.05 22:42:30 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.05 22:42:30 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.05 22:42:30 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.05 22:42:30 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.05 22:42:30 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Burn4Free Toolbar Helper) - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} -  File not found
O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} -  File not found
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQ Toolbar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} -  File not found
O3 - HKCU\..\Toolbar\WebBrowser: (ICQ Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} -  File not found
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour Reminder]  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\EDSMSNFIX.EXE (HiTRUST co.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [lxddamon] C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
O4 - HKLM..\Run: [LXDDCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXDDtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NapsterShell]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched]  File not found
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Silent Hunter III.LNK =  File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{c5fe23e3-255b-11e0-b8a8-001921ec8294}\Shell - "" = AutoRun
O33 - MountPoints2\{c5fe23e3-255b-11e0-b8a8-001921ec8294}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.18 11:52:13 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Benutzer\Desktop\OTL.exe
[2011.04.17 19:05:40 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Roaming\Malwarebytes
[2011.04.17 19:05:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.17 19:05:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.04.17 19:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.17 19:05:27 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.17 19:05:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.16 15:10:22 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Roaming\Avira
[2011.04.16 12:57:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.04.16 12:56:22 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.04.16 12:56:21 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.04.16 12:56:21 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.04.16 12:56:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.04.16 12:56:19 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.04.15 21:08:58 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2011.04.15 21:08:55 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2011.04.15 21:08:54 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2011.04.15 20:58:31 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2011.04.15 20:24:38 | 000,105,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2011.04.15 20:24:38 | 000,097,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardapi.dll
[2011.04.15 20:24:37 | 000,037,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\infocardcpl.cpl
[2011.04.15 20:24:36 | 000,622,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardagt.exe
[2011.04.15 20:24:36 | 000,043,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2011.04.15 20:24:36 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardres.dll
[2011.04.15 20:24:34 | 000,781,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationNative_v0300.dll
[2011.04.15 20:24:32 | 000,326,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2011.04.15 20:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2011.04.15 20:14:41 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll
[2011.04.15 20:14:38 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll
[2011.04.15 20:10:41 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2011.04.15 20:10:39 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2011.04.15 20:08:57 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2011.03.27 13:25:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2011.03.27 13:20:51 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrsmgr.dll
[2011.03.27 13:20:14 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmprovhost.exe
[2011.03.27 13:20:13 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrs.exe
[2011.03.27 13:20:13 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrshost.exe
[2011.03.27 13:20:11 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wevtfwd.dll
[2011.03.27 13:20:11 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecutil.exe
[2011.03.27 13:20:11 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wecapi.dll
[2011.03.27 13:20:11 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmRes.dll
[2011.03.27 13:20:11 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wsmplpxy.dll
[2011.03.27 13:20:11 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrssrv.dll
[2011.03.27 13:20:10 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pwrshplugin.dll
[2011.03.27 13:19:56 | 000,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManMigrationPlugin.dll
[2011.03.27 13:19:56 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSManHTTPConfig.exe
[2011.03.27 13:19:56 | 000,241,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winrscmd.dll
[2011.03.27 13:19:56 | 000,214,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmWmiPl.dll
[2011.03.27 13:19:56 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmAuto.dll
[2011.03.27 13:15:37 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2011.03.27 13:14:51 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011.03.27 13:14:51 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011.03.27 13:14:25 | 000,523,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2011.03.27 13:14:25 | 000,511,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2011.03.27 13:14:24 | 000,472,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2011.03.27 13:14:24 | 000,472,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2011.03.27 13:14:24 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2011.03.27 13:14:24 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2011.03.27 13:14:23 | 000,329,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2011.03.27 13:14:23 | 000,151,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2011.03.27 13:14:23 | 000,151,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2011.03.27 13:11:11 | 003,548,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.03.27 13:11:07 | 003,600,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.03.27 13:10:50 | 002,452,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2011.03.27 13:10:46 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.03.27 13:10:46 | 000,467,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.03.27 13:10:45 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.03.27 13:10:45 | 000,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.03.27 13:10:45 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.03.27 13:10:45 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2011.03.27 13:10:45 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.03.27 13:10:45 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.03.27 13:10:45 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.03.27 13:10:45 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011.03.27 13:10:44 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.03.27 13:10:36 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2011.03.27 13:10:35 | 002,868,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011.03.27 13:10:28 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2011.03.27 13:10:28 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2011.03.27 13:10:22 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2011.03.27 13:09:57 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2011.03.27 13:09:57 | 000,183,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdohlp.dll
[2011.03.27 13:09:57 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasrecst.dll
[2011.03.27 13:09:57 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasdatastore.dll
[2011.03.27 13:09:57 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2011.03.27 13:09:56 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iasads.dll
[2011.03.27 13:09:56 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe
[2011.03.27 13:09:28 | 001,256,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2011.03.27 13:09:17 | 000,996,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMNetMgr.dll
[2011.03.27 13:09:17 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\logagent.exe
[2011.03.27 13:08:56 | 000,104,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll
[2011.03.27 13:08:55 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE
[2011.03.27 13:08:55 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE
[2011.03.27 13:08:55 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE
[2011.03.27 13:08:55 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE
[2011.03.27 13:08:55 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe
[2011.03.27 13:08:55 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE
[2011.03.27 13:08:54 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2011.03.27 13:08:16 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2011.03.27 13:08:16 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2011.03.27 13:07:53 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amxread.dll
[2011.03.27 13:07:53 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\apilogen.dll
[2011.03.27 13:07:34 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2011.03.27 13:07:34 | 000,345,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2011.03.27 13:07:34 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2011.03.27 13:07:24 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2011.03.27 13:07:24 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2011.03.27 13:07:24 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2011.03.27 13:07:16 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.03.27 13:07:16 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2011.03.27 13:07:16 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.03.27 13:07:16 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2011.03.27 13:06:58 | 000,636,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2011.03.27 13:06:50 | 000,409,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011.03.27 13:06:43 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011.03.27 13:06:43 | 000,323,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2011.03.27 13:06:43 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2011.03.27 13:06:43 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2011.03.27 13:06:31 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.03.27 13:06:26 | 002,038,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.03.27 13:06:00 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2011.03.27 13:05:51 | 002,927,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2011.03.27 13:05:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2011.03.27 13:04:48 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.03.27 13:04:38 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2011.03.27 13:04:19 | 000,036,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2011.03.27 13:04:12 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2011.03.27 13:04:07 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2011.03.27 13:04:00 | 000,562,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdtcprx.dll
[2011.03.27 13:04:00 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xolehlp.dll
[2011.03.27 13:03:47 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\raschap.dll
[2011.03.27 13:03:47 | 000,244,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll
[2011.03.27 13:03:30 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2011.03.27 13:03:25 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2011.03.27 13:03:16 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2011.03.27 13:03:10 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2011.03.27 13:02:44 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2011.03.27 13:02:26 | 000,866,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2011.03.27 12:35:08 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2011.03.27 12:34:24 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2011.03.27 12:34:22 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2011.03.27 12:34:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2011.03.27 12:34:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2009.05.15 12:52:51 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Benutzer\AppData\Roaming\pcouffin.sys
[2007.07.23 10:47:40 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXDDhcp.dll
[2007.07.23 10:47:37 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxddinpa.dll
[2007.07.23 10:47:37 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxddiesc.dll
[2007.07.23 10:47:36 | 001,232,896 | ---- | C] ( ) -- C:\Windows\System32\lxddserv.dll
[2007.07.23 10:47:36 | 000,999,424 | ---- | C] ( ) -- C:\Windows\System32\lxddusb1.dll
[2007.07.23 10:47:35 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxddprox.dll
[2007.07.23 10:47:35 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxddpplc.dll
[2007.07.23 10:47:34 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxddpmui.dll
[2007.07.23 10:47:34 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxddlmpm.dll
[2007.07.23 10:47:32 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxddhbn3.dll
[2007.07.23 10:47:32 | 000,385,968 | ---- | C] ( ) -- C:\Windows\System32\lxddih.exe
[2007.07.23 10:47:29 | 000,537,520 | ---- | C] ( ) -- C:\Windows\System32\lxddcoms.exe
[2007.07.23 10:47:29 | 000,425,984 | ---- | C] ( ) -- C:\Windows\System32\lxddcomm.dll
[2007.07.23 10:47:28 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxddcomc.dll
[2007.07.23 10:47:28 | 000,381,872 | ---- | C] ( ) -- C:\Windows\System32\lxddcfg.exe
[2007.07.18 15:14:15 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007.04.18 05:42:52 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[16 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[16 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Benutzer\*.tmp files -> C:\Users\Benutzer\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.19 21:30:29 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{41236337-FC7B-4DE1-9B65-EC0FF32D84B4}.job
[2011.04.19 21:27:41 | 000,628,210 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.19 21:27:41 | 000,595,308 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.19 21:27:41 | 000,126,850 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.19 21:27:41 | 000,104,742 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.19 21:21:34 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.19 21:21:34 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.19 21:21:20 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2011.04.19 21:21:06 | 1073,274,880 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.19 13:50:23 | 220,986,431 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.04.19 10:03:34 | 000,002,365 | ---- | M] () -- C:\Users\Benutzer\Desktop\mbam-log-2011- Quicklog
[2011.04.19 10:03:03 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2011.04.18 11:52:20 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Benutzer\Desktop\OTL.exe
[2011.04.17 19:05:32 | 000,000,944 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.17 15:57:04 | 004,323,235 | ---- | M] () -- C:\Users\Benutzer\Desktop\ComboFix.exe
[2011.04.16 12:57:02 | 000,001,885 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011.04.15 23:40:03 | 000,347,120 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.11 21:06:59 | 000,563,106 | ---- | M] () -- C:\Users\Benutzer\Desktop\rio_grande_blood.jpg
[2011.03.27 12:30:50 | 000,001,925 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011.03.25 19:16:02 | 000,209,920 | ---- | M] () -- C:\Users\Benutzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[16 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[16 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Benutzer\*.tmp files -> C:\Users\Benutzer\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.19 13:33:17 | 1073,274,880 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.19 10:03:33 | 000,002,365 | ---- | C] () -- C:\Users\Benutzer\Desktop\mbam-log-2011- Quicklog
[2011.04.19 10:03:03 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.04.17 19:21:37 | 220,986,431 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.04.17 19:05:32 | 000,000,944 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.17 15:56:21 | 004,323,235 | ---- | C] () -- C:\Users\Benutzer\Desktop\ComboFix.exe
[2011.04.16 12:57:02 | 000,001,885 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011.04.11 21:07:54 | 000,563,106 | ---- | C] () -- C:\Users\Benutzer\Desktop\rio_grande_blood.jpg
[2011.03.27 13:19:57 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2011.03.27 13:19:57 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2011.03.27 13:19:57 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2011.03.27 13:07:25 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2009.11.15 18:57:30 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.07.08 18:22:50 | 000,000,552 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\d3d8caps.dat
[2009.05.15 13:53:22 | 000,000,047 | ---- | C] () -- C:\Windows\WinInit.Ini
[2009.05.15 12:52:51 | 000,087,608 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\ezpinst.exe
[2009.05.15 12:52:51 | 000,001,144 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\pcouffin.inf
[2009.05.15 12:52:51 | 000,001,074 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\pcouffin.cat
[2009.05.15 12:36:39 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2008.12.04 15:42:04 | 000,187,637 | ---- | C] () -- C:\Windows\hphins25.dat
[2008.08.26 09:54:54 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.08.26 09:54:54 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.08.04 17:12:11 | 000,000,292 | ---- | C] () -- C:\Windows\vtmb.ini
[2008.06.09 08:35:16 | 000,000,361 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008.05.23 07:33:46 | 000,000,795 | ---- | C] () -- C:\Windows\hphmdl25.dat
[2008.02.15 14:08:26 | 000,000,000 | ---- | C] () -- C:\ProgramData\f7129022-a000-4847-db07-470265a73c4f
[2008.02.05 22:59:19 | 000,000,680 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\d3d9caps.dat
[2008.01.10 16:29:19 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.01.10 16:29:06 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2007.12.07 17:57:12 | 000,036,167 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2007.11.05 19:54:41 | 000,000,240 | ---- | C] () -- C:\Windows\RomeTW Demo.ini
[2007.11.05 14:46:25 | 000,036,734 | ---- | C] () -- C:\Windows\System32\OggDSuninst.exe
[2007.10.20 18:33:01 | 000,000,021 | ---- | C] () -- C:\Windows\SIERRA.INI
[2007.10.18 12:47:20 | 000,023,888 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\UserTile.png
[2007.08.20 12:17:56 | 000,000,000 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\wklnhst.dat
[2007.08.09 12:39:52 | 000,000,096 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\fusioncache.dat
[2007.07.23 11:01:08 | 000,331,776 | ---- | C] () -- C:\Windows\System32\lxddcoin.dll
[2007.07.23 10:56:23 | 000,036,864 | ---- | C] () -- C:\Windows\System32\lxf3oem.dll
[2007.07.23 10:56:23 | 000,012,288 | ---- | C] () -- C:\Windows\System32\LXF3PMRC.DLL
[2007.07.23 10:48:58 | 000,000,044 | ---- | C] () -- C:\Windows\System32\lxddrwrd.ini
[2007.07.23 10:47:43 | 000,278,528 | ---- | C] () -- C:\Windows\System32\LXDDinst.dll
[2007.07.23 10:47:31 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxddgrd.dll
[2007.07.21 08:47:58 | 000,209,920 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.07.19 18:50:07 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.07.18 15:15:30 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2007.07.18 15:15:29 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2007.07.18 15:14:15 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007.04.18 15:30:23 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.04.18 13:58:48 | 000,000,593 | ---- | C] () -- C:\Windows\generic.ini
[2007.04.18 13:58:48 | 000,000,107 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007.04.18 05:42:52 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.02.06 23:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.02.06 23:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.02.06 23:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.02.06 23:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.02.06 23:56:28 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.02.06 23:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2007.01.24 09:40:02 | 000,065,536 | ---- | C] () -- C:\Windows\System32\lxddcaps.dll
[2007.01.10 07:13:08 | 000,692,224 | ---- | C] () -- C:\Windows\System32\lxdddrs.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.11.13 05:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006.11.02 17:33:31 | 000,628,210 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,126,850 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | ---- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,347,120 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,595,308 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,104,742 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.07 07:08:04 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxddcnv4.dll
[2006.05.18 16:47:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxddvs.dll
[2002.10.06 20:42:57 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll
[2002.10.05 01:04:25 | 000,921,600 | ---- | C] () -- C:\Windows\System32\vorbisenc.dll
[2002.10.05 01:04:24 | 000,188,416 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2002.10.05 01:04:17 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ogg.dll
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 72 bytes -> C:\Windows:A55D3CFD3E68C41A
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B606BA34

< End of report >
--- --- ---

cosinus 20.04.2011 17:33
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{c5fe23e3-255b-11e0-b8a8-001921ec8294}\Shell - "" = AutoRun
O33 - MountPoints2\{c5fe23e3-255b-11e0-b8a8-001921ec8294}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
@Alternate Data Stream - 72 bytes -> C:\Windows:A55D3CFD3E68C41A
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B606BA34
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Akkumolator 21.04.2011 11:03
Nach eingen Überlegungen und Forenbeiträgen hab ich entschlossen den PC neu aufzusetzen, da ich doch ziemlich nachsichtig beim Umgang mit der Sicherheit war und mir meinen Rechner einen Neuanfang gönnen wollte :heilig:

Ich habe den PC schließlich mittels Recovery DVD (war im Lieferumfang des PC's dabei) den in den Auslieferungszustand versetzt.
Per DVD hab ich dann das Service Pack 1+2, Antivir, Opera Browser draufgespielt und bin nur per eingeschränkten Benutzerkonto, sowie aktiver Firewall ins Netz gegangen. Trotzdem verbindet mich der Browser immernoch mit dubiosen Seiten und Windows läuft sehr langsam.

Kann es sein, dass das Recovern nichts gebracht hat und die Störprogramme auf irgend eine Weise immer noch aktiv sind? :confused:

Wenn ja, wie bekomme Ich meinen Rechner zu 100 % sauber?

Nachtrag: Habe gerade versucht die Windows Update funktion zu nutzen klappt aber nicht, Fehlercode 8007041D

PS:Tausend Dank für die Hilfe bisher:daumenhoc

cosinus 21.04.2011 15:35
hast du rein zufällig einen Router? Wenn ja wurde da das Adminpasswort geändert?
Wenn nicht, setz diesen Router auf Werkseinstellungen zurück und konfiguriere ihn neu. Wichtig ist, dass du das unsichere vordefinierte Adminkennwort zum Router änderst!

Akkumolator 21.04.2011 17:25
Öhhm, Ich habe eine Speedport W701V, habe aber absolut keine Ahnung welches Passwort das Ding hat (wurde vom Telekom Mitarbeiter eingerichtet und ist schon ein paar Jahre her = vergessen) , geschweige denn wie ich ins Konfigurationsmenü des Speedports komme.

Ist bei der Situation Hopfen und Malz verloren oder gibts noch was zu Retten ,was die Änderung des Passworts betrifft:confused:

cosinus 21.04.2011 18:47
Wie ich schon sagte: Router in die Werkseinstellungen zurücksetzen und neu konfigurieren.

Wenn du prüfen willst ob es noch das Standardpasswort ist:
Hier rauf klicken => http://192.168.2.1
Versuch dich mit dem Passwort 0000 einzuloggen (vier Nullen)

Akkumolator 23.04.2011 12:45
So, ich hab den Router jetzt auf Werkseinstellungen zurückgesetzt, neu konfiguriert (nach Telekom Anleitung) und mit neuem Passwort versehen.

Trotz all dem versucht mein PC mich weiterhin in den Wahn zu treiben, in dem er mich in ca 80% der Fälle weiterhin auf irgendwelche Schrottseiten umleitet :headbang:

Es muss doch irgendwas geben damit der Müll endlich aufhört. Mir wär's egal wenn ich das System nochmal neu Recovern müsste, hauptsache das Internet läuft einigermaßen Stabil und ohne diese dusseligen Weiterverbindungen.

Danke für die Hilfe und frohe Ostern außerdem.

cosinus 23.04.2011 15:50
Ich würde erstmal versuchen rauszufinden, ob das nur unter Windows so ist, oder auch mit anderen Betriebssystemen.
Lad dir mal sowas wie Knoppix oder Ubuntu herunter, brenn die iso Datei per Imagebrennfunktion auf eine CD und boote den Rechner davon.
Teste dann mal ausgiebig die Internetverbindung unter Linux und berichte ob die Verbindung und das System dort normal schnell oder auch langsam ist.

Akkumolator 24.04.2011 16:13
So ich hab jetzt mal Ubuntu installiert und das Internet läuft Stabil soweit und auch Weiterverbindungen treten nicht auf. Alles in Ordnung bisher ich werd's mal weiter austesten und mich dann wieder melden.
Danke für die Hilfe soweit.


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:20 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19