nabend =)
danke für die schnelle Antwort. Habe die Anweisungen Schritt für Schritt durchgelesen. Hier das Ergebnis:
zu Punkt 1:
hat leider nicht funktioniert (hatte Internet raus und keine Programme laufen, sowie keine Anti-Viren-Programme)
Gmer hat gescant, aber direkt nach dem Scan (zumindest denke ich dass der scan zuende war^^) hat sich Gmer beendet und ich konnte nicht auf Copy klicken =/
habe diesen Schritt übersprungen
zu Punkt 2: Code:
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net
Windows 5.1.2600 Disk: ExcelStor_Technology_J880 rev.PF2OA21B -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xF77D3660]<<
1 ntkrnlpa!IofCallDriver[0x804EDE00] -> \Device\Harddisk0\DR0[0x86F3DAB8]
3 CLASSPNP[0xF75DD05B] -> ntkrnlpa!IofCallDriver[0x804EDE00] -> [0x869F0D70]
\Driver\00001196[0x86AA6270] -> IRP_MJ_CREATE -> 0xF77D3660
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi -> 0x86fdb1f8
user & kernel MBR OK
Warning: possible MBR rootkit infection ! zu Punkt 3:
->Extras.txt Code:
OTL Extras logfile created on: 12.08.2011 16:40:14 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Dokumente und Einstellungen\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1023,23 Mb Total Physical Memory | 589,65 Mb Available Physical Memory | 57,63% Memory free
2,40 Gb Paging File | 2,11 Gb Available in Paging File | 87,72% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 76,68 Gb Total Space | 16,69 Gb Free Space | 21,76% Space Free | Partition Type: NTFS
Drive E: | 6,70 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: HOME-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /k "cd %L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallDisableNotify" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"22489:TCP" = 22489:TCP:*:Enabled:spport
"12327:TCP" = 12327:TCP:*:Enabled:spport
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ.exe
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0893078B-8A9A-84D6-D393-119B9B0B033A}" = CCC Help French
"{0E2A60F7-2907-5718-FF16-7D8FAF70051E}" = CCC Help Chinese Standard
"{143BE018-D8F8-4014-8CB6-AF63F5799D21}" = ULi LAN Driver
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{14FAE013-AE19-4FC9-B5BF-E56ADC01ECE6}" = CCC Help Turkish
"{17BB2784-6EE4-D7FF-FE63-58A3AD2B3708}" = CCC Help Russian
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{233588CF-96D5-46AF-EF74-7EC382662791}" = Catalyst Control Center Graphics Full Existing
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{3260ECBC-9DDF-E7A3-0863-449473BC7BD5}" = CCC Help Chinese Traditional
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39C6C229-CFFD-639E-229A-E463FCD87478}" = CCC Help German
"{4F11FC80-CE8C-1BD4-5C39-EBE5744E5135}" = CCC Help Portuguese
"{4FAB2BA7-E16C-95D2-F326-60A68409373F}" = Catalyst Control Center HydraVision Full
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{529AA9A8-5020-6CFB-A809-BC5943C87077}" = CCC Help Thai
"{53604297-26FD-516D-6FF7-1063BA64A0A4}" = Catalyst Control Center Graphics Light
"{55BD3B0B-F054-9341-514F-295A5F7EA450}" = CCC Help Spanish
"{5A4FA9C8-ED56-08C3-153B-FC5C19256290}" = CCC Help Dutch
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{6C390D51-E5F0-4FCD-24C4-731ACAF34571}" = CCC Help Japanese
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7AA8FA9A-1656-7DBD-633B-FE7A62BBED0C}" = CCC Help Czech
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{868D7896-99D4-4513-BC62-2B3AD3E24926}" = TuneUp Utilities 2006
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C22131B-8634-CECF-F0D1-A2ECC160B450}" = CCC Help Norwegian
"{90FBE4D0-2ACA-A8A8-2CC4-CFFBAE528504}" = CCC Help Finnish
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D74375E-3012-E7D2-9229-B220C91F326A}" = Catalyst Control Center Core Implementation
"{9EE8BDCA-7505-4895-D91E-8108DD16292E}" = CCC Help English
"{A8AF8BD3-61B5-7945-4D1B-217421F604FC}" = CCC Help Hungarian
"{AA46E1C5-A709-6D9B-D99D-92E4C6E042A9}" = CCC Help Korean
"{AA62A33C-9E5E-3913-7D88-7E58A8CB1493}" = CCC Help Greek
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B653F643-A1B4-9936-2DB6-FEA9A3110D8D}" = ccc-core-preinstall
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B71C4637-0247-78CE-6A3D-D61645CB8921}" = ccc-utility
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{BC2E7C0B-1AC6-5F6C-F31D-E1E72D8E0B5C}" = CCC Help Danish
"{BF8C7DA7-2DE6-ED67-6C82-6BE82F8BA8D3}" = Catalyst Control Center Graphics Full New
"{C409F338-BB20-6C4A-F40D-20CA07AF714C}" = CCC Help Polish
"{D4B7B2DC-E688-A9D6-6EC0-56AE540E074C}" = Catalyst Control Center Localization All
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D9CD701B-3F04-FC69-D974-F3A7F5E9BA30}" = CCC Help Swedish
"{D9D93D74-107D-4BD3-87D0-AABCF7C98BD5}" = Catalyst Control Center - Branding
"{E213321B-1E88-B38D-DAB2-D8CB9355984A}" = Skins
"{E280923D-C5D9-4728-8C79-AC9A0DC75875}" = BioShock
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{F4148D8F-ED3A-3097-509C-04D5560220F9}" = ccc-core-static
"{F7E68997-E626-952B-A7BF-F72066CD5D77}" = Catalyst Control Center Graphics Previews Common
"{FA36C82B-464D-51F2-A6A1-0BC9140BE067}" = CCC Help Italian
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ATI Display Driver" = ATI Display Driver
"Company of Heroes" = Company of Heroes
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"FreeFileSync" = FreeFileSync v3.18
"GIGA F-Tasten_is1" = GIGA F-Tasten v6.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.1.1800
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox 5.0.1 (x86 de)" = Mozilla Firefox 5.0.1 (x86 de)
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Uninstall_is1" = Uninstall 1.0.0.1
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World of Warcraft" = World of Warcraft
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 06.08.2011 10:42:41 | Computer Name = HOME-PC | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung mslldygc.exe, Version 0.0.0.0, fehlgeschlagenes
Modul mslldygc.exe, Version 0.0.0.0, Fehleradresse 0x0000176d.
Error - 07.08.2011 13:29:07 | Computer Name = HOME-PC | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung mslldygc.exe, Version 0.0.0.0, fehlgeschlagenes
Modul mslldygc.exe, Version 0.0.0.0, Fehleradresse 0x0000176d.
[ System Events ]
Error - 11.07.2011 17:39:01 | Computer Name = HOME-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "ICQ Service" wurde unerwartet beendet. Dies ist bereits 1
Mal passiert.
Error - 11.07.2011 18:07:50 | Computer Name = HOME-PC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ImapiService"
mit den Argumenten "-Service" gestartet wurde, um den folgenden Server zu verwenden:
{520CCA63-51A5-11D3-9144-00104BA11C5E}
Error - 11.07.2011 18:37:57 | Computer Name = HOME-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 12.07.2011 06:50:04 | Computer Name = HOME-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
< End of report > -> OTL.txt Code:
OTL logfile created on: 12.08.2011 16:40:14 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Dokumente und Einstellungen\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1023,23 Mb Total Physical Memory | 589,65 Mb Available Physical Memory | 57,63% Memory free
2,40 Gb Paging File | 2,11 Gb Available in Paging File | 87,72% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 76,68 Gb Total Space | 16,69 Gb Free Space | 21,76% Space Free | Partition Type: NTFS
Drive E: | 6,70 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: HOME-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - File not found -- C:\WINDOWS\2378395611:613432434.exe
PRC - [2011.08.12 16:36:02 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
PRC - [2011.08.09 20:38:11 | 000,036,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\ncdgdnx\svchost.exe
PRC - [2011.08.09 20:38:11 | 000,036,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\ncdgdnx\svchost.exe
PRC - [2011.07.08 09:31:38 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.09.21 20:37:40 | 000,932,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2006.06.01 21:06:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.06.01 21:06:00 | 000,067,072 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
========== Modules (SafeList) ==========
MOD - [2011.08.12 16:36:02 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
MOD - [2006.06.01 21:06:00 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2005.08.24 02:29:52 | 000,118,272 | ---- | M] (TuneUp Software GmbH) [On_Demand | Stopped] -- C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe -- (TUWinStylerThemeSvc)
========== Driver Services (SafeList) ==========
DRV - [2010.02.24 00:53:53 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.07.21 18:30:48 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.06.01 21:06:00 | 000,622,172 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2006.06.01 21:06:00 | 000,400,384 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2005.03.22 21:36:40 | 000,028,672 | ---- | M] (ULi Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ULILAN51.SYS -- (ULI5261XP)
DRV - [2004.08.04 00:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2001.08.17 15:04:08 | 000,173,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\philcam2.sys -- (phil2vid) Philips VGA-Kamera (USB)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.9
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1390
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.9&q="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Programme\AVG\AVG10\Firefox4\ [2011.07.13 16:02:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.07.20 21:34:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.07.20 21:33:59 | 000,000,000 | ---D | M]
[2010.02.24 00:19:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2011.07.21 15:12:51 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\extensions
[2011.08.11 16:29:45 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\searchplugins\icqplugin-1.xml
[2011.07.14 01:54:48 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\searchplugins\icqplugin-2.xml
[2011.07.20 02:30:46 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\searchplugins\icqplugin-3.xml
[2011.07.21 11:33:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\searchplugins\icqplugin-4.xml
[2010.02.03 14:38:36 | 000,000,947 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\rg7p1ax5.default\searchplugins\icqplugin.xml
[2011.07.20 21:34:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) --
[2011.07.13 16:02:21 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAMME\AVG\AVG10\FIREFOX4
[2011.07.08 09:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006.06.01 21:06:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [mslivemsn] C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\ncdgdnx\svchost.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Programme\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [Security Protection] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\defender.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\rprevgwx.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (svdhalp.exe) - C:\WINDOWS\System32\svdhalp.exe (Remix Luck Sentry Kite Sweep)
O20 - HKLM Winlogon: UserInit - (C:\Programme\jjarldnh\rprevgwx.exe) - C:\Programme\jjarldnh\rprevgwx.exe (Macromedia, Inc.)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.02.23 19:15:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.09.11 00:46:44 | 000,564,218 | R--- | M] () - E:\Autorun.dbd -- [ UDF ]
O32 - AutoRun File - [2007.08.31 20:16:25 | 000,000,044 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2007.09.06 08:18:49 | 000,004,039 | R--- | M] () - E:\Autorun.txt -- [ UDF ]
O33 - MountPoints2\{54bde826-b254-11e0-b283-000b6abd0692}\Shell - "" = AutoRun
O33 - MountPoints2\{54bde826-b254-11e0-b283-000b6abd0692}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{54bde826-b254-11e0-b283-000b6abd0692}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-1-4-67-7528420263-3670141873-185815584-1855\qfKtZgJM.exe
O33 - MountPoints2\{54bde826-b254-11e0-b283-000b6abd0692}\Shell\explore\command - "" = \RECYCLER\S-1-4-67-7528420263-3670141873-185815584-1855\qfKtZgJM.exe
O33 - MountPoints2\{54bde826-b254-11e0-b283-000b6abd0692}\Shell\Open\command - "" = \RECYCLER\S-1-4-67-7528420263-3670141873-185815584-1855\qfKtZgJM.exe
O33 - MountPoints2\{54bde827-b254-11e0-b283-000b6abd0692}\Shell - "" = AutoRun
O33 - MountPoints2\{54bde827-b254-11e0-b283-000b6abd0692}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{54bde827-b254-11e0-b283-000b6abd0692}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL \RECYCLER\S-3-7-42-0880727645-6250485848-284677058-3610\fRYYgMuS.exe
O33 - MountPoints2\{54bde827-b254-11e0-b283-000b6abd0692}\Shell\explore\command - "" = \RECYCLER\S-3-7-42-0880727645-6250485848-284677058-3610\fRYYgMuS.exe
O33 - MountPoints2\{54bde827-b254-11e0-b283-000b6abd0692}\Shell\Open\command - "" = \RECYCLER\S-3-7-42-0880727645-6250485848-284677058-3610\fRYYgMuS.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.08.12 16:36:00 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2011.08.11 19:45:24 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.11 19:45:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.08.11 19:45:20 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.08.11 19:45:20 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.08.11 19:16:23 | 000,000,000 | ---D | C] -- C:\Programme\jjarldnh
[2011.08.11 19:00:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2011.08.11 18:49:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools
[2011.08.11 17:25:41 | 000,083,843 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\explorermgr.exe
[2011.08.09 20:48:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy
[2011.08.09 20:38:21 | 000,129,536 | ---- | C] (Remix Luck Sentry Kite Sweep) -- C:\WINDOWS\System32\svdhalp.exe.ini
[2011.08.09 20:38:21 | 000,129,536 | ---- | C] (Remix Luck Sentry Kite Sweep) -- C:\WINDOWS\System32\svdhalp.exe
[2011.08.09 13:39:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2011.07.29 20:47:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\GetRightToGo
[2011.07.29 18:08:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Help
[2011.07.29 18:08:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Help
[2011.07.27 21:02:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Ynme
[2011.07.27 21:02:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Agfoa
[2011.07.26 23:33:12 | 000,000,000 | ---D | C] -- C:\Programme\ageye
[2011.07.25 18:45:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Extyum
[2011.07.25 18:45:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adne
[2011.07.22 18:53:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\ICQ
[2011.07.21 23:16:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\Playlist
[2011.07.21 11:39:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Lang
[2011.07.20 13:17:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\THQ
[2011.07.20 12:56:24 | 000,000,000 | ---D | C] -- C:\Programme\THQ
[2011.07.20 12:19:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Winamp Erkennungs-Plug-in
[2011.07.20 12:19:05 | 000,000,000 | ---D | C] -- C:\Winamp Detect
[2011.07.20 12:18:48 | 000,000,000 | ---D | C] -- C:\Winamp
[2011.07.20 12:18:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Winamp
[2011.07.20 12:04:58 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.5
[2011.07.20 00:55:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FreeFileSync
[2011.07.20 00:55:45 | 000,000,000 | ---D | C] -- C:\Programme\FreeFileSync
[2011.07.20 00:55:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2011.07.20 00:05:22 | 000,030,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rndismpx.sys
[2011.07.20 00:05:12 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft ActiveSync
[2011.07.19 20:20:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ICQ7.5
[2011.07.19 19:30:14 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2011.07.19 19:23:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Talkback
[2011.07.19 15:36:04 | 000,000,000 | ---D | C] -- C:\WINDOWS.0
[2011.07.19 14:23:35 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN
[2011.07.19 14:04:43 | 000,000,000 | ---D | C] -- C:\Programme\msn gaming zone
[2011.07.19 13:56:39 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isignup.exe
[2011.07.18 12:04:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2011.07.16 04:23:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2011.07.13 16:58:08 | 013,522,064 | ---- | C] (Mozilla) -- C:\Dokumente und Einstellungen\Administrator\Desktop\Firefox Setup 5.0.1.exe
[56 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.08.12 16:36:02 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2011.08.12 16:34:21 | 000,089,088 | ---- | M] () -- C:\WINDOWS\System32\mbr.exe
[2011.08.12 16:18:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\2378395611
[2011.08.12 16:18:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.11 19:48:46 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.11 19:20:18 | 000,083,843 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\explorermgr.exe
[2011.08.11 19:20:18 | 000,083,843 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\rprevgwx.exe
[2011.08.11 19:14:36 | 000,000,325 | -HS- | M] () -- C:\boot.ini
[2011.08.11 19:01:33 | 000,537,422 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011.08.11 18:49:19 | 000,512,992 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\sdsetup_revwire207.exe
[2011.08.11 17:27:17 | 003,932,214 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Taskmanager.bmp
[2011.08.11 16:24:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.10 16:26:49 | 000,405,118 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.08.10 16:26:49 | 000,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.10 16:26:49 | 000,070,580 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.08.10 16:26:49 | 000,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.09 20:54:56 | 000,000,095 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2011.08.09 20:48:06 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011.08.09 20:39:03 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011.08.09 20:38:56 | 000,951,697 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\defender.exe
[2011.08.09 20:38:21 | 000,129,536 | ---- | M] (Remix Luck Sentry Kite Sweep) -- C:\WINDOWS\System32\svdhalp.exe.ini
[2011.08.09 20:38:21 | 000,129,536 | ---- | M] (Remix Luck Sentry Kite Sweep) -- C:\WINDOWS\System32\svdhalp.exe
[2011.08.09 20:38:21 | 000,000,017 | ---- | M] () -- C:\WINDOWS\syskey2i.drv
[2011.08.09 20:38:03 | 000,191,488 | ---- | M] () -- C:\WINDOWS\Pmyroa.exe
[2011.08.05 18:18:33 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.08.04 16:20:14 | 001,171,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\KoRn - Twist.mp3
[2011.07.26 21:49:33 | 005,149,322 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Sean Kingston - Eenie Meenie.mp3
[2011.07.21 11:39:55 | 000,146,650 | ---- | M] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2011.07.21 11:39:55 | 000,125,690 | ---- | M] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2011.07.20 21:34:04 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.07.20 12:05:45 | 000,001,451 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.5.lnk
[2011.07.20 00:55:45 | 000,000,702 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FreeFileSync.lnk
[2011.07.20 00:05:49 | 000,002,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\$_hpcst$.hpc
[2011.07.19 14:52:23 | 000,004,268 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\4708p5ono2oqxsqqye1usj8fgc0r10nfj8c
[2011.07.19 14:52:23 | 000,004,268 | -HS- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\4708p5ono2oqxsqqye1usj8fgc0r10nfj8c
[2011.07.18 23:15:26 | 000,040,960 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ihzkw.exe
[2011.07.13 16:58:42 | 013,522,064 | ---- | M] (Mozilla) -- C:\Dokumente und Einstellungen\Administrator\Desktop\Firefox Setup 5.0.1.exe
[56 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.08.12 16:34:52 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\mbr.exe
[2011.08.11 19:45:24 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.11 19:01:26 | 000,537,422 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB
[2011.08.11 18:49:41 | 000,512,992 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\sdsetup_revwire207.exe
[2011.08.11 17:26:59 | 003,932,214 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Taskmanager.bmp
[2011.08.11 16:42:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\2378395611
[2011.08.09 20:54:56 | 000,000,095 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011.08.09 20:48:06 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011.08.09 20:38:55 | 000,951,697 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\defender.exe
[2011.08.09 20:38:21 | 000,000,017 | ---- | C] () -- C:\WINDOWS\syskey2i.drv
[2011.08.09 20:38:12 | 000,191,488 | ---- | C] () -- C:\WINDOWS\Pmyroa.exe
[2011.08.09 20:38:07 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011.08.09 16:51:28 | 000,083,843 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\rprevgwx.exe
[2011.08.04 16:20:07 | 001,171,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\KoRn - Twist.mp3
[2011.07.26 21:49:11 | 005,149,322 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Sean Kingston - Eenie Meenie.mp3
[2011.07.21 11:39:55 | 000,146,650 | ---- | C] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2011.07.21 11:39:55 | 000,125,690 | ---- | C] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2011.07.20 21:34:04 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.07.20 12:21:35 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.07.20 12:05:45 | 000,001,451 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ICQ7.5.lnk
[2011.07.20 01:00:29 | 000,001,808 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft ActiveSync.lnk
[2011.07.20 00:55:45 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FreeFileSync.lnk
[2011.07.20 00:05:49 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\$_hpcst$.hpc
[2011.07.18 23:12:34 | 000,040,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ihzkw.exe
[2011.07.18 20:04:10 | 000,004,268 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\4708p5ono2oqxsqqye1usj8fgc0r10nfj8c
[2011.07.18 20:04:10 | 000,004,268 | -HS- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\4708p5ono2oqxsqqye1usj8fgc0r10nfj8c
[2011.07.13 16:59:26 | 000,002,855 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.pif
[2010.03.04 16:57:03 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.02.24 01:11:45 | 000,016,535 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat
[2010.02.24 00:19:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.02.24 00:15:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010.02.24 00:13:35 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2010.02.23 19:37:45 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\UnLAN.exe
[2010.02.23 19:22:17 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.02.23 19:13:08 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.02.23 19:09:02 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.02.23 19:06:15 | 000,090,296 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.07.21 17:17:04 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2009.07.21 17:17:04 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2009.04.23 23:29:16 | 000,189,051 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2006.06.01 21:06:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006.06.01 21:06:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006.06.01 21:06:00 | 000,405,118 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006.06.01 21:06:00 | 000,392,296 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006.06.01 21:06:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006.06.01 21:06:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006.06.01 21:06:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006.06.01 21:06:00 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2006.06.01 21:06:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2006.06.01 21:06:00 | 000,070,580 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006.06.01 21:06:00 | 000,058,596 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006.06.01 21:06:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006.06.01 21:06:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006.06.01 21:06:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006.06.01 21:06:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2006.06.01 21:06:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006.06.01 21:06:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006.06.01 21:06:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006.06.01 21:06:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
========== LOP Check ==========
[2011.07.11 18:24:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Acreon
[2011.07.26 16:26:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adne
[2011.07.28 16:24:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Agfoa
[2011.07.12 13:24:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\AVG10
[2010.03.31 00:50:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Bioshock
[2011.07.26 17:43:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Extyum
[2011.07.20 00:58:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FreeFileSync
[2011.07.29 20:51:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\GetRightToGo
[2011.08.11 22:25:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ
[2011.06.26 19:30:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TS3Client
[2010.02.23 19:26:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TuneUp Software
[2011.07.29 20:16:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Ynme
[2011.07.12 13:21:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files
[2011.07.14 01:01:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.07.13 15:58:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
[2011.08.10 16:25:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2011.08.11 19:45:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.02.23 19:26:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2011.08.05 18:18:33 | 000,000,408 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
[2011.08.09 20:39:03 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\2378395611:613432434.exe
@Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
< End of report > zu Punkt 4:
hier mal die Programmliste die mir der CCleaner ausgespuckt hat Code:
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 09.08.2011 10.0.45.2
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 09.08.2011 10.3.181.26
Adobe Reader 9.3 - Deutsch Adobe Systems Incorporated 31.03.2010 242MB 9.3.0
ATI Catalyst Control Center 2.009.0721.1106
ATI Display Driver 12.08.2011 8.593.100.2-090721a-085695C-ATI
BioShock 2K Games 24.02.2010 2.62.0000
CCleaner Piriform 12.08.2011 3.09
Company of Heroes THQ Inc. 11.08.2011 2.0.0.1
DivX Codec DivX, Inc. 12.08.2011 6.9.1
DivX Converter DivX, Inc. 12.08.2011 7.1.0
DivX Player DivX, Inc. 12.08.2011 7.2.0
DivX Plus DirectShow Filters DivX, Inc. 12.08.2011
DivX Plus Web Player DivX,Inc. 12.08.2011 2.0.0
Free Audio CD Burner version 1.2 DVDVideoSoft Limited. 24.04.2010
Free YouTube to MP3 Converter version 3.3 DVDVideoSoft Limited. 24.04.2010
FreeFileSync v3.18 12.08.2011
GIGA F-Tasten v6.0 12.08.2011
HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs Microsoft Corporation 23.02.2010 2,14MB 1.1.1905.1
Malwarebytes' Anti-Malware Version 1.51.1.1800 Malwarebytes Corporation 11.08.2011 1.51.1.1800
Microsoft .NET Framework 2.0 Microsoft Corporation 26.02.2010
Microsoft ActiveSync Microsoft Corporation 20.07.2011 18,4MB 4.5.5096.0
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348) Microsoft Corporation 23.02.2010
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 24.02.2010 5,72MB 8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 23.06.2011 10,3MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 12.07.2011 10,2MB 9.0.30729.4148
Mozilla Firefox 5.0.1 (x86 de) Mozilla 12.08.2011 5.0.1
Project64 1.6 Project64 13.06.2011 3,47MB 1.6
Skype Toolbars Skype Technologies S.A. 19.06.2011 5,87MB 5.3.7555
Skype™ 5.3 Skype Technologies S.A. 19.06.2011 16,6MB 5.3.120
Spybot - Search & Destroy Safer Networking Limited 09.08.2011 1.6.2
TeamSpeak 3 Client TeamSpeak Systems GmbH 11.08.2011
TuneUp Utilities 2006 TuneUp Software 23.02.2010 18,8MB 5.0.2327
ULi LAN Driver 12.08.2011
Uninstall 1.0.0.1 24.04.2010
Winamp Nullsoft, Inc 12.08.2011 5.62
Winamp Erkennungs-Plug-in Nullsoft, Inc 20.07.2011 1.0.0.1
WinRAR 4.01 (32-Bit) win.rar GmbH 11.08.2011 4.01.0
World of Warcraft Blizzard Entertainment 12.08.2011 4.2.0.14333 |