Avast findet Trojaner "JS:Iframe-ZU"
Hallo zusammen
letztens hat Avast auf meinem PC einen Trojaner (JS:Iframe-ZU) „gefangen“, während ich auf ganz normalen WEB-Seiten unterwegs war.
Sign of "JS:Iframe-UZ [Trj]" has been found in "C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8FW5G1FM\renz-yachting_de[1].htm" file.
Der Prozess wurde geblockt und nach den Reboot und einem Full-Scan wurde das infizierte File in den Viren-Container verschoben.
Da „schmort“ er jetzt.
Bei dem Full-Scan wurde in einem VMWare-Disk-Flatfile noch ein anderer Trojaner gefunden.
Sign of "Win32:Patched-HO [Trj]" has been found in "C:\Projekte\Virtual_Machines\Windows XP_Professional\Windows XP Professional-flat.vmdk" file.
Aber das ist ja wohl ein anderes Thema und wert einen neuen Artikel aufzumachen.
Kann jemand bitte mal schauen, ob ich hier ev. ein Problem habe.
Die empfohlenen Aktionen habe ich ausgeführt und die gewünschten Log-Files sind unten angehangen.
Danke schon mal
LG-Fan
=============================================================================
OTL.Txt
=============================================================================OTL Logfile: Code:
OTL logfile created on: 27.01.2013 11:31:45 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,99 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 83,99% Memory free
4,32 Gb Paging File | 3,74 Gb Available in Paging File | 86,55% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 19,95 Gb Free Space | 13,38% Space Free | Partition Type: NTFS
Drive D: | 74,53 Gb Total Space | 44,28 Gb Free Space | 59,42% Space Free | Partition Type: NTFS
Drive U: | 18,34 Gb Total Space | 2,29 Gb Free Space | 12,49% Space Free | Partition Type: NTFS
Drive W: | 9,39 Gb Total Space | 0,06 Gb Free Space | 0,67% Space Free | Partition Type: NTFS
Drive X: | 18,34 Gb Total Space | 2,29 Gb Free Space | 12,49% Space Free | Partition Type: NTFS
Computer Name: ***3 | User Name: *** | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.01.27 11:31:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
PRC - [2012.02.03 17:50:26 | 000,021,392 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2012.02.03 17:50:18 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2011.09.23 19:19:58 | 000,064,112 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\hqtray.exe
PRC - [2010.10.29 14:49:28 | 000,249,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.12.21 18:39:12 | 000,015,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
PRC - [2009.11.25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Programme\Alwil Software\Avast4\ashDisp.exe
PRC - [2008.04.14 07:53:00 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rdpclip.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.02.05 16:00:00 | 000,188,928 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIEDE.EXE
========== Modules (No Company Name) ==========
MOD - [2012.03.03 23:40:30 | 000,115,137 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll
MOD - [2012.02.03 17:50:26 | 000,021,392 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2012.01.14 01:12:20 | 000,762,368 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\26437ea73e5bcc00a5845a4d70a1cb0d\System.Runtime.Remoting.ni.dll
MOD - [2012.01.14 01:12:05 | 001,781,760 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\0e06eb1acf979d6dfd95c9ebcf5550bb\System.Xaml.ni.dll
MOD - [2012.01.14 00:53:01 | 017,673,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\1418a81b6da08d4735b83a60f7525c8b\PresentationFramework.ni.dll
MOD - [2012.01.14 00:52:42 | 000,284,160 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\5ad95fffd68c6c29ead74009f3d89ec0\PresentationFramework.Classic.ni.dll
MOD - [2012.01.14 00:52:32 | 013,137,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\52e237bd9dcf62782e477d3caf451210\System.Windows.Forms.ni.dll
MOD - [2012.01.14 00:52:30 | 011,106,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\fb7a70d4f5b2df437d456ec82d658fea\PresentationCore.ni.dll
MOD - [2012.01.14 00:52:10 | 001,652,736 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\9f3d6ed58636f00b008eb84c2fecfffe\System.Drawing.ni.dll
MOD - [2012.01.14 00:52:04 | 003,798,016 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\81046d70594f88758b8b9b698d510fa8\WindowsBase.ni.dll
MOD - [2012.01.14 00:51:46 | 007,053,312 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\d3dab9ff9af3acc625d79329fc143357\System.Core.ni.dll
MOD - [2012.01.14 00:51:42 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\1117df4d861920db904cf596d64ca7e7\System.Xml.ni.dll
MOD - [2012.01.14 00:51:26 | 009,085,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\e3914597ed0a6c9bc82824f874ca21be\System.ni.dll
MOD - [2012.01.14 00:51:14 | 014,409,216 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\e5de681ee33ae6535462d070428f4f1b\mscorlib.ni.dll
MOD - [2011.09.23 19:20:38 | 000,970,352 | ---- | M] () -- C:\Programme\VMware\VMware Player\libxml2.dll
MOD - [2011.09.23 19:19:40 | 000,068,720 | ---- | M] () -- C:\Programme\VMware\VMware Player\zlib1.dll
MOD - [2009.12.21 23:57:32 | 007,573,504 | ---- | M] () -- c:\Programme\Adobe\Reader 9.0\Reader\RdLang32.DEU
MOD - [2009.12.21 20:09:26 | 000,016,832 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\ViewerPS.dll
MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2009.02.27 12:52:56 | 000,258,048 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\sqlite.dll
MOD - [2009.01.18 15:50:02 | 000,417,792 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\AdobeXMP.dll
========== Services (SafeList) ==========
SRV - File not found [Disabled | Unknown] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2011.09.23 19:20:22 | 000,404,080 | ---- | M] (VMware, Inc.) [Auto | Unknown] -- C:\WINDOWS\system32\vmnat.exe -- (VMware NAT Service)
SRV - [2011.09.23 19:19:46 | 000,334,448 | ---- | M] (VMware, Inc.) [Auto | Unknown] -- C:\WINDOWS\system32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.09.23 19:19:38 | 000,113,264 | ---- | M] (VMware, Inc.) [Auto | Unknown] -- C:\Programme\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.09.23 18:21:12 | 000,539,248 | ---- | M] (VMware, Inc.) [Auto | Unknown] -- C:\Programme\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010.08.19 12:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Unknown] -- C:\Programme\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [Disabled | Unknown] -- C:\Programme\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010.03.19 10:22:38 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Unknown] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2009.11.25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Unknown] -- C:\Programme\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009.11.25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Unknown] -- C:\Programme\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009.11.25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Unknown] -- C:\Programme\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009.11.25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Unknown] -- C:\Programme\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)
SRV - [2007.12.17 14:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Unknown] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01)
SRV - [2007.01.11 14:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Unknown] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01)
SRV - [2006.05.17 16:02:44 | 000,168,960 | R--- | M] (Eicon Networks) [Disabled | Unknown] -- C:\Programme\Diva Client\divalog.exe -- (EiconDivaLogService)
SRV - [2002.07.19 00:00:00 | 000,430,127 | ---- | M] (Living Byte Software GmbH, München) [Disabled | Unknown] -- C:\Programme\RVS\WCOM\SYSTEM\RVSINST.EXE -- (RVSINST)
SRV - [2002.07.19 00:00:00 | 000,213,035 | ---- | M] (Living Byte Software GmbH, München) [Disabled | Unknown] -- C:\Programme\RVS\WCOM\SYSTEM\RVSCC.EXE -- (RvsCC)
SRV - [2002.07.19 00:00:00 | 000,139,313 | ---- | M] (Living Byte Software GmbH, München) [Disabled | Unknown] -- C:\Programme\RVS\WCOM\SYSTEM\RVSCOMSV.EXE -- (RvscomSv)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Unknown] -- -- (PCIDump)
DRV - File not found [Kernel | System | Unknown] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Unknown] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Unknown] -- -- (Changer)
DRV - [2012.01.31 18:15:42 | 000,020,032 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2011.12.08 05:22:38 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ssudobex.sys -- (ssudobex)
DRV - [2011.12.08 05:22:38 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2011.12.08 05:22:38 | 000,080,184 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2011.12.08 05:22:34 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2011.12.08 05:22:34 | 000,100,224 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ss_bserd.sys -- (ss_bserd)
DRV - [2011.12.08 05:22:34 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ss_bbus.sys -- (ss_bbus)
DRV - [2011.12.08 05:22:34 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV - [2011.09.23 19:20:48 | 000,854,256 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\vmx86.sys -- (vmx86)
DRV - [2011.09.23 19:20:48 | 000,070,768 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\vmci.sys -- (vmci)
DRV - [2011.09.23 19:19:44 | 000,023,792 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\vmparport.sys -- (VMparport)
DRV - [2011.09.23 19:19:16 | 000,024,688 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VMkbd.sys -- (vmkbd)
DRV - [2011.09.23 19:18:32 | 000,032,752 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2011.09.23 19:18:28 | 000,026,352 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2011.09.23 18:21:04 | 000,032,368 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\hcmon.sys -- (hcmon)
DRV - [2011.09.23 15:58:32 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2011.03.05 22:52:41 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2011.03.05 22:52:26 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2011.03.05 22:52:26 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2010.11.04 18:41:00 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\truecrypt.sys -- (truecrypt)
DRV - [2010.08.19 12:56:38 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Unknown] -- C:\Programme\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2010.06.25 18:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2009.11.25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Unknown] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009.11.25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Unknown] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2009.11.25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Unknown] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009.11.25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Unknown] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009.11.25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009.11.25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Unknown] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009.02.20 18:09:16 | 000,044,032 | R--- | M] (Siemens Home and Office Communication Devices GmbH & Co. KG) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\GigasetGenericUSB.sys -- (GigasetGenericUSB)
DRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)
DRV - [2008.04.14 00:10:52 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\4mmdat.sys -- (4mmdat)
DRV - [2008.04.13 22:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
DRV - [2006.11.02 07:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006.08.14 17:21:58 | 002,251,376 | R--- | M] (Eicon Networks) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\disdn\Diwan.sys -- (DiWan)
DRV - [2006.06.28 00:00:00 | 004,304,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.01.25 16:14:06 | 000,472,644 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\HCWBT8xx.sys -- (HCWBT8XX)
DRV - [2006.01.24 15:41:40 | 000,208,704 | R--- | M] (Eicon Networks) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\disdn\diport40.sys -- (DiPort)
DRV - [2005.11.09 11:41:30 | 000,554,240 | R--- | M] (Eicon Networks) [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\disdn\dimaint.sys -- (DiMaint)
DRV - [2005.07.25 10:04:08 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005.03.25 00:00:00 | 000,132,608 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2005.01.07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004.09.14 15:50:22 | 000,223,570 | R--- | M] (Eicon Networks) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\disdn\capi202k.sys -- (DiCapi)
DRV - [2003.05.01 13:26:34 | 000,005,220 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2002.07.19 00:00:00 | 000,039,936 | ---- | M] (Living Byte Software GmbH, München) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\RVSPORT.SYS -- (rvsport)
DRV - [2002.01.27 14:03:00 | 000,051,011 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\m_sscan.sys -- (ScannerService)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {BD2A9109-82DB-4861-8923-4CC849D9D38F}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{BD2A9109-82DB-4861-8923-4CC849D9D38F}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ***1:81
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.backup.ftp: "***1"
FF - prefs.js..network.proxy.backup.ftp_port: 81
FF - prefs.js..network.proxy.backup.gopher: "***1"
FF - prefs.js..network.proxy.backup.gopher_port: 81
FF - prefs.js..network.proxy.backup.socks: "***1"
FF - prefs.js..network.proxy.backup.socks_port: 81
FF - prefs.js..network.proxy.backup.ssl: "***1"
FF - prefs.js..network.proxy.backup.ssl_port: 81
FF - prefs.js..network.proxy.ftp: "***1"
FF - prefs.js..network.proxy.ftp_port: 81
FF - prefs.js..network.proxy.gopher: "***1"
FF - prefs.js..network.proxy.gopher_port: 81
FF - prefs.js..network.proxy.http: "***1"
FF - prefs.js..network.proxy.http_port: 81
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1,192.168.2.0/24, 192.168.3.0/24"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "***1"
FF - prefs.js..network.proxy.socks_port: 81
FF - prefs.js..network.proxy.ssl: "***1"
FF - prefs.js..network.proxy.ssl_port: 81
FF - prefs.js..network.proxy.type: 1
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Programme\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Programme\AVAST Software\Avast\WebRep\FF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.11.07 19:28:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.11.28 18:59:00 | 000,000,000 | ---D | M]
[2010.03.20 21:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2012.12.24 12:49:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\s1mmjjs4.default\extensions
[2012.04.09 10:08:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\s1mmjjs4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.03.04 02:25:26 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.08 23:00:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.03.08 22:59:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.03.08 22:59:58 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2010.11.07 19:28:53 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.11.07 19:28:53 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010.11.07 19:28:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.11.07 19:28:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.11.07 19:28:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2010.10.23 10:26:24 | 000,001,056 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 192.168.2.1 ***1
O1 - Hosts: 192.168.2.2 ***2
O1 - Hosts: 192.168.2.3 ***3
O1 - Hosts: 192.168.2.3 ***4
O1 - Hosts: 192.168.2.5 ***5
O1 - Hosts: 192.168.2.6 ***6
O1 - Hosts: 192.168.2.7 ***7
O1 - Hosts: 65.54.52.254 messenger.hotmail.com
O1 - Hosts: 127.1.1.1 google.com
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll File not found
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll File not found
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Programme\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.)
O4 - HKLM..\Run: [CallGuard] C:\Programme\Diva Client\cgserver.exe (Eicon Networks)
O4 - HKLM..\Run: [DiTask] C:\Programme\Diva Client\ditask.exe (Eicon Networks)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SkyTel] ~SkyTel.EXE File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Programme\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O4 - HKCU..\Run: [EPSON SX100 Series (von ***9)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [EPSON SX100 Series auf ***3 (von ***9)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [TrueCrypt] "N:\Programme\TrueCrypt\TrueCrypt.exe" /q preferences /a logon /a devices File not found
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-EBDU5.exe ()
O4 - HKLM..\RunOnce: [WIAWizardMenu] C:\WINDOWS\System32\sti_ci.dll (Microsoft Corporation)
O4 - HKCU..\RunOnce: [CommCenter] C:\Programme\RVS\WCOM\SYSTEM\ccui.exe (Living Byte Software GmbH, München)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VR-NetWorld Auftragsprüfung.lnk = C:\Programme\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Get_Price.lnk = C:\Programme\putty\PLINK.EXE ()
O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\PPTUSER.lnk = C:\Programme\putty\PLINK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Translate with &Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Programme\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O15 - HKCU\..Trusted Domains: hp.com ([*.rooms] https in Trusted sites)
O15 - HKCU\..Trusted Domains: msn.com ([*.contacts] https in Trusted sites)
O16 - DPF: {00000035-9593-4264-8B29-930B3E4EDCCD} https://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall35.cab (HPVirtualRooms35 Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1355088630218 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1355088617031 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ***.***
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D0D3990-B768-4ECA-974D-00FBA8424DB5}: NameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.02.02 19:25:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.01.27 11:31:08 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2013.01.14 19:07:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\SP
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.01.27 11:31:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2013.01.27 11:30:00 | 000,000,270 | ---- | M] () -- C:\WINDOWS\tasks\counter.job
[2013.01.27 11:27:52 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2013.01.27 11:08:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.27 10:59:36 | 000,000,600 | ---- | M] () -- C:\Dokumente und Einstellungen\***\PUTTY.RND
[2013.01.27 10:59:01 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.27 10:49:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.01.27 10:49:31 | 3211,251,712 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.26 11:40:47 | 000,003,002 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2013.01.25 22:47:44 | 000,079,410 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\UM_digital_20130125.pdf
[2013.01.22 22:57:02 | 000,028,269 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\kataster.pdf
[2013.01.22 21:47:37 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.01.14 21:43:46 | 000,016,089 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Auftragsbestätigung für DHL Portoprodukte 14.01.2013.htm
[2013.01.13 22:45:26 | 000,256,599 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\SP-SFT-Freistellungsauftrag.pdf
[2013.01.01 19:42:44 | 000,017,108 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\https online-services.rundfunkbeitrag.pdf
[2012.12.30 19:06:40 | 002,113,720 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\UM_digital_20121230.pdf
[2012.12.30 19:00:37 | 000,012,484 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\UM_analog_20121230.pdf
[2012.12.29 22:12:21 | 000,025,817 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\vrexport.html
[2012.12.29 22:07:51 | 000,062,660 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\VR-NetWorld.pdf
[2012.12.29 00:05:46 | 000,025,258 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\42LM620S_LAN-Problem.htm
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.01.27 11:27:52 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2013.01.25 22:47:44 | 000,079,410 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\UM_digital_20130125.pdf
[2013.01.22 22:40:53 | 000,028,269 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\kataster.pdf
[2013.01.14 21:43:46 | 000,016,089 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Auftragsbestätigung für DHL Portoprodukte 14.01.2013.htm
[2013.01.13 22:45:26 | 000,256,599 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\SP-SFT-Freistellungsauftrag.pdf
[2013.01.01 19:42:41 | 000,017,108 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\https online-services.rundfunkbeitrag.pdf
[2012.12.30 20:32:36 | 3211,251,712 | -HS- | C] () -- C:\hiberfil.sys
[2012.12.30 19:06:40 | 002,113,720 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\UM_digital_20121230.pdf
[2012.12.29 22:12:21 | 000,025,817 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\vrexport.html
[2012.12.29 22:07:48 | 000,062,660 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\VR-NetWorld.pdf
[2012.12.29 00:05:46 | 000,025,258 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\42LM620S_LAN-Problem.htm
[2012.12.08 23:53:00 | 000,711,240 | ---- | C] () -- C:\WINDOWS\is-EBDU5.exe
[2012.11.21 23:49:58 | 000,572,206 | ---- | C] () -- C:\WINDOWS\System32\_C6DBDLL.DLL
[2012.11.21 23:49:58 | 000,402,432 | ---- | C] () -- C:\WINDOWS\System32\C4fox.dll
[2012.11.21 23:49:58 | 000,216,064 | ---- | C] () -- C:\WINDOWS\System32\MDI16KH.DLL
[2012.11.21 23:49:56 | 000,000,148 | ---- | C] () -- C:\WINDOWS\ptkfz.INI
[2012.04.07 12:24:35 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.12.29 14:24:47 | 000,000,664 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\d3d9caps.dat
[2011.04.25 21:13:22 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\$_hpcst$.hpc
[2011.01.29 16:00:24 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2011.01.29 16:00:22 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2011.01.29 16:00:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011.01.29 16:00:22 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011.01.29 16:00:22 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010.11.05 21:14:37 | 000,000,064 | ---- | C] () -- C:\Dokumente und Einstellungen\***\xxxx
[2010.09.11 22:44:44 | 000,001,130 | ---- | C] () -- C:\Dokumente und Einstellungen\***\***.asc
[2010.08.23 20:24:18 | 000,000,114 | ---- | C] () -- C:\Dokumente und Einstellungen\***\test.bat
[2010.05.21 21:11:02 | 000,000,042 | ---- | C] () -- C:\Dokumente und Einstellungen\***\default.pls
[2010.04.19 22:29:39 | 000,039,936 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.15 23:48:04 | 000,000,335 | ---- | C] () -- C:\Dokumente und Einstellungen\***\nil
[2010.02.23 22:57:21 | 000,000,008 | ---- | C] () -- C:\Dokumente und Einstellungen\***\pdf995port
[2010.02.18 00:10:50 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\***\PUTTY.RND
========== ZeroAccess Check ==========
[2011.08.10 22:09:59 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010.09.09 15:17:08 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2010.03.06 01:15:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
[2012.03.18 21:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software
[2013.01.26 20:27:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2011.08.10 21:55:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cached Installations
[2010.02.20 11:37:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2012.04.07 19:08:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Garmin
[2011.08.10 23:20:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Gigaset QuickSync
[2010.02.24 23:36:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\pdf995
[2010.02.20 22:03:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RVS
[2012.03.03 23:35:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2012.12.07 23:35:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2010.02.20 11:45:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2010.12.30 15:06:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Babylon
[2010.05.01 10:20:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EPSON
[2012.04.07 20:05:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Garmin
[2010.09.11 22:22:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\gnupg
[2010.02.17 18:21:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\IrfanView
[2010.03.01 23:44:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mp3tag
[2010.02.23 00:37:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\pdf995
[2011.04.25 21:13:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Samsung
[2011.05.08 21:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TrueCrypt
[2012.12.29 23:19:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\XBMC
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 4292 bytes -> C:\Dokumente und Einstellungen\***\Desktop\virus_20090622.jpg:Q30lsldxJoudresxAaaqpcawXc
< End of report >
--- --- ---
=============================================================================
Extras.TxtOTL Logfile: Code:
OTL Extras logfile created on: 27.01.2013 11:31:45 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,99 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 83,99% Memory free
4,32 Gb Paging File | 3,74 Gb Available in Paging File | 86,55% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 19,95 Gb Free Space | 13,38% Space Free | Partition Type: NTFS
Drive D: | 74,53 Gb Total Space | 44,28 Gb Free Space | 59,42% Space Free | Partition Type: NTFS
Drive U: | 18,34 Gb Total Space | 2,29 Gb Free Space | 12,49% Space Free | Partition Type: NTFS
Drive W: | 9,39 Gb Total Space | 0,06 Gb Free Space | 0,67% Space Free | Partition Type: NTFS
Drive X: | 18,34 Gb Total Space | 2,29 Gb Free Space | 12,49% Space Free | Partition Type: NTFS
Computer Name: ***3 | User Name: *** | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\VMware\VMware Player\vmware-authd.exe" = C:\Programme\VMware\VMware Player\vmware-authd.exe:*:Enabled:VMware Authd -- (VMware, Inc.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Programme\VMware\VMware Player\vmware-authd.exe" = C:\Programme\VMware\VMware Player\vmware-authd.exe:*:Enabled:VMware Authd -- (VMware, Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{0D9E1F52-CE29-B03B-D79F-8EC434821031}" = Nero 7 Demo
"{17079027-EB8A-42C6-9BF8-825B78889F6A}" = Garmin Communicator Plugin
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{2c2f4c57-83a8-4790-a281-e83d306a9199}" = Gigaset QuickSync
"{307780E3-1720-4310-AF3C-13771E069677}" = Samsung PC Studio II PIMS & File Manager
"{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3744B641-61DE-417F-BCDC-9CCED4224DF8}" = LightScribe System Software
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{421BFF57-4EBB-4821-8453-6F8F3685D540}" = Samsung PC Studio II Sample
"{4544CA3D-601F-4B90-8941-9B93256F27BF}" = RVS-COM Lite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}" = VR-NetWorld
"{88A4002B-BDBA-49A2-927C-D81E8DF32B1B}" = LightScribe Applications
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D134213-C5F4-4D55-9E36-FEB4C12FD27A}" = PC-Trainer Kfz-Technik
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B28311A2-EA16-4F85-80CE-1BF2B0912C8F}" = Garmin City Navigator Europe NT 2012.40 Update
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}" = Steuer-Spar-Erklärung 2012
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2
"{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}" = AAVUpdateManager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFD9383C-01D5-4897-A954-43AF599AED30}" = tools-windows
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast!" = avast! Antivirus
"Babylon" = Babylon
"EPSON Scanner" = EPSON Scan
"EPSON Stylus SX100_TX100 Benutzerhandbuch" = EPSON Stylus SX100_TX100 Handbuch
"EPSON SX100 Series" = EPSON SX100 Series Printer Uninstall
"GnuPG" = GNU Privacy Guard
"GPL Ghostscript 9.00" = GPL Ghostscript 9.00
"Hauppauge WinTV2000" = Hauppauge WinTV2000
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"LHTTSGED" = L&H TTS3000 Deutsch
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"Mp3tag" = Mp3tag v2.45a
"Nero BurnRights!UninstallKey" = Nero BurnRights
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Pdf995" = Pdf995
"TrueCrypt" = TrueCrypt
"VMware_Player" = VMware Player
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPcapInst" = WinPcap 4.1.2
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
========== Last 20 Event Log Errors ==========
Error: Unable to start EventLog service!
< End of report >
--- --- ---
=============================================================================
Gmer.txt
=============================================================================GMER Logfile: Code:
GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-27 15:28:59
Windows 5.1.2600 Service Pack 3 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-e SAMSUNG_HD160JJ rev.WU100-33 149,05GB
Running: gmer-2.0.18444.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\fgtdypog.sys
---- System - GMER 2.0 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA8D436B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA8D43574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA8D43A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA8D4314C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA8D4364E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA8D4308C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA8D430F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA8D4376E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA8D4372E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA8D438AE]
---- Kernel code sections - GMER 2.0 ----
? dimaint.sys Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 2.0 ----
.text C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[452] ntdll.dll!DbgUiRemoteBreakin 7C9620EC 1 Byte [C3]
---- EOF - GMER 2.0 ----
--- --- --- |
AdwCleaner auf deinen Desktop.
SecurityCheck und:
Textbox.