|
Hacker schreibt auf meinem Pc mit mir! 8 Viren (z.B. DR/Zwangi.Cp) gefunden! Hallo Leute, gestern war ich bei ICQ ganz normal am schreiben, da fängt mein PC an zu spinnen. Er schloss eigenständig Fenster, die Maus bewegte sich ohne das ich sie angepackt hatte. Ich dachte sofort: VIRUS!! Aber plötzlich schreibt jemand in diese ICQ-Eingabe-Zeile "hey,hör mir zu und sprich mich mit herr an"!!! :balla: Erstmal stand ich unter Schock. :uglyhammer: Dann hab ich eine Word-Datei geöffnet, in der ich mit dem Hacker geschrieben habe (nur ganz kurz, da ich Angst um meine Dateien hatte). Er sagte er sei Albaner, hat aber ziemlich gut Deutsch gesprochen. Und er wollte das ich 3 "Tests" bestehe. Der erste war Grimassen schneiden, der zweite einen Apfel mit Ketchup essen oder einen Liter Wasser auf Ex, den dritten habe ich nich mehr ehrfahren. (klingt eher wie ein dummer Jungen Streich) Als er drohte Dateien zu löschen hab ich das Internetkabel gezogen, anschließend mit Avira einen Suchlauf gestartet. Dabei kamen ein paar Infizierte Dateien zum Vorschein. Ich kann erstmal nur den Virustyp an sich bennen,den Pfad kann ich aber auch noch nachgugen. ;) Die Viren: TR/Dropper.Gen EXP/Pidief.bvg.1 ADSPY/Agent.89552 JAVA/Dldr.Agen.Na.1 JAVA/Dldr.Age.nad.4 DR/Zwangi.CP TR/BHO.Zwangi.176 DR/Zwangi.Fe Es wär echt nett wenn ihr mir helfen könntet, ich hab keine Ahnung von Viren. Schonmal Danke im Vorraus, Siren |
Hallo und :hallo: Poste bitte das Logfile von AntiVir. Danach einen Vollscan mit malwarebytes machen und Log posten. Anschließend OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
|
Hallo ;) Schonmal Danke für die schnelle Antwort! :) Ich hab die Virenscanner installiert und "Malwarebytes" ist am scannen, dauert allerdings noch ein bisschen. Die Ergebnisse schicke ich bei Fertigstellung sofort hinterher, inclusive dem Log von Avira. Vielen Dank, Siren |
Sooo, alle Protokolle sind da. Ich fang mal mit Avira an. Avira AntiVir Personal Erstellungsdatum der Reportdatei: Sonntag, 25. April 2010 21:58 Es wird nach 2037171 Virenstämmen gesucht. Lizenznehmer : Avira AntiVir Personal - FREE Antivirus Seriennummer : 0000149996-ADJIE-0000001 Plattform : Windows Vista Windowsversion : (Service Pack 1) [6.0.6001] Boot Modus : Normal gebootet Benutzername : SYSTEM Computername : DERBESTE Versionsinformationen: BUILD.DAT : 9.0.0.422 21701 Bytes 09.03.2010 10:23:00 AVSCAN.EXE : 9.0.3.10 466689 Bytes 19.11.2009 14:15:53 AVSCAN.DLL : 9.0.3.0 49409 Bytes 13.02.2009 11:04:10 LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 10:35:44 LUKERES.DLL : 9.0.2.0 13569 Bytes 26.01.2009 09:41:59 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 14:15:53 VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 17:03:27 VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 14:23:30 VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 17:01:14 VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 19:08:43 VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 14:56:06 VBASE006.VDF : 7.10.6.83 2048 Bytes 15.04.2010 14:56:06 VBASE007.VDF : 7.10.6.84 2048 Bytes 15.04.2010 14:56:06 VBASE008.VDF : 7.10.6.85 2048 Bytes 15.04.2010 14:56:06 VBASE009.VDF : 7.10.6.86 2048 Bytes 15.04.2010 14:56:07 VBASE010.VDF : 7.10.6.87 2048 Bytes 15.04.2010 14:56:07 VBASE011.VDF : 7.10.6.88 2048 Bytes 15.04.2010 14:56:07 VBASE012.VDF : 7.10.6.89 2048 Bytes 15.04.2010 14:56:07 VBASE013.VDF : 7.10.6.90 2048 Bytes 15.04.2010 14:56:07 VBASE014.VDF : 7.10.6.123 126464 Bytes 19.04.2010 18:10:25 VBASE015.VDF : 7.10.6.152 123392 Bytes 21.04.2010 18:10:38 VBASE016.VDF : 7.10.6.178 122880 Bytes 22.04.2010 09:49:41 VBASE017.VDF : 7.10.6.179 2048 Bytes 22.04.2010 09:49:41 VBASE018.VDF : 7.10.6.180 2048 Bytes 22.04.2010 09:49:41 VBASE019.VDF : 7.10.6.181 2048 Bytes 22.04.2010 09:49:41 VBASE020.VDF : 7.10.6.182 2048 Bytes 22.04.2010 09:49:41 VBASE021.VDF : 7.10.6.183 2048 Bytes 22.04.2010 09:49:41 VBASE022.VDF : 7.10.6.184 2048 Bytes 22.04.2010 09:49:41 VBASE023.VDF : 7.10.6.185 2048 Bytes 22.04.2010 09:49:41 VBASE024.VDF : 7.10.6.186 2048 Bytes 22.04.2010 09:49:42 VBASE025.VDF : 7.10.6.187 2048 Bytes 22.04.2010 09:49:42 VBASE026.VDF : 7.10.6.188 2048 Bytes 22.04.2010 09:49:42 VBASE027.VDF : 7.10.6.189 2048 Bytes 22.04.2010 09:49:42 VBASE028.VDF : 7.10.6.190 2048 Bytes 22.04.2010 09:49:42 VBASE029.VDF : 7.10.6.191 2048 Bytes 22.04.2010 09:49:42 VBASE030.VDF : 7.10.6.192 2048 Bytes 22.04.2010 09:49:42 VBASE031.VDF : 7.10.6.197 65536 Bytes 23.04.2010 09:49:42 Engineversion : 8.2.1.224 AEVDF.DLL : 8.1.2.0 106868 Bytes 24.04.2010 09:49:44 AESCRIPT.DLL : 8.1.3.27 1294714 Bytes 24.04.2010 09:49:44 AESCN.DLL : 8.1.5.0 127347 Bytes 26.02.2010 17:31:46 AESBX.DLL : 8.1.3.1 254324 Bytes 24.04.2010 09:49:44 AERDL.DLL : 8.1.4.6 541043 Bytes 16.04.2010 14:56:12 AEPACK.DLL : 8.2.1.1 426358 Bytes 19.03.2010 20:55:39 AEOFFICE.DLL : 8.1.0.41 201083 Bytes 17.03.2010 21:17:26 AEHEUR.DLL : 8.1.1.24 2613623 Bytes 16.04.2010 14:56:11 AEHELP.DLL : 8.1.11.3 242039 Bytes 02.04.2010 19:37:25 AEGEN.DLL : 8.1.3.7 373106 Bytes 16.04.2010 14:56:08 AEEMU.DLL : 8.1.2.0 393588 Bytes 24.04.2010 09:49:43 AECORE.DLL : 8.1.13.1 188790 Bytes 02.04.2010 19:37:24 AEBB.DLL : 8.1.1.0 53618 Bytes 24.04.2010 09:49:42 AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 07:47:56 AVPREF.DLL : 9.0.3.0 44289 Bytes 08.09.2009 18:37:32 AVREP.DLL : 8.0.0.7 159784 Bytes 18.02.2010 14:33:06 AVREG.DLL : 9.0.0.0 36609 Bytes 07.11.2008 14:25:04 AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 14:05:37 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 09:37:04 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 14:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 07:21:28 NETNT.DLL : 9.0.0.0 11521 Bytes 07.11.2008 14:41:21 RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15.05.2009 14:35:17 RCTEXT.DLL : 9.0.73.0 87297 Bytes 19.11.2009 14:15:53 Konfiguration für den aktuellen Suchlauf: Job Name..............................: Vollständige Systemprüfung Konfigurationsdatei...................: c:\program files\avira\antivir desktop\sysscan.avp Protokollierung.......................: niedrig Primäre Aktion........................: interaktiv Sekundäre Aktion......................: ignorieren Durchsuche Masterbootsektoren.........: ein Durchsuche Bootsektoren...............: ein Bootsektoren..........................: C:, Durchsuche aktive Programme...........: ein Durchsuche Registrierung..............: ein Suche nach Rootkits...................: ein Integritätsprüfung von Systemdateien..: aus Datei Suchmodus.......................: Alle Dateien Durchsuche Archive....................: ein Rekursionstiefe einschränken..........: 20 Archiv Smart Extensions...............: ein Makrovirenheuristik...................: ein Dateiheuristik........................: mittel Beginn des Suchlaufs: Sonntag, 25. April 2010 21:58 Der Suchlauf nach versteckten Objekten wird begonnen. Es wurden '134119' Objekte überprüft, '0' versteckte Objekte wurden gefunden. Der Suchlauf über gestartete Prozesse wird begonnen: Durchsuche Prozess 'dllhost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'AcroRd32Info.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SearchFilterHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ICQ7.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SearchProtocolHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'cmd.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'notepad.exe' - '0' Modul(e) wurden durchsucht Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mobsync.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'iexplore.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'explorer.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PnkBstrB.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'jucheck.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SmpSys.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'vsnpstd3.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PDVD8Serv.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'LManager.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'traybar.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ePowerTray.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'BackupManagerTray.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'dwm.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'explorer.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'conime.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'conime.exe' - '0' Modul(e) wurden durchsucht Durchsuche Prozess 'SynTPHelper.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wuauclt.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'soffice.bin' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'soffice.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'CEC_MAIN.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ccSvcHst.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'iPodService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WmiPrvSE.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'TnglCtrl.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PnkBstrA.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'IoctlSvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'IScheduleSvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ccSvcHst.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'NBService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'FABS.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ePowerSvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'audiodg.exe' - '0' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht Es wurden '85' Prozesse mit '85' Modulen durchsucht Der Suchlauf über die Masterbootsektoren wird begonnen: Masterbootsektor HD0 [INFO] Es wurde kein Virus gefunden! Masterbootsektor HD1 [INFO] Es wurde kein Virus gefunden! Der Suchlauf über die Bootsektoren wird begonnen: Bootsektor 'C:\' [INFO] Es wurde kein Virus gefunden! Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen: Die Registry wurde durchsucht ( '52' Dateien ). Der Suchlauf über die ausgewählten Dateien wird begonnen: Beginne mit der Suche in 'C:\' <OS> C:\hiberfil.sys [WARNUNG] Die Datei konnte nicht geöffnet werden! [HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei. [HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann. C:\pagefile.sys [WARNUNG] Die Datei konnte nicht geöffnet werden! [HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei. [HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann. C:\Program Files\Zwunzi\Zwunzi_deleted_\zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen C:\Users\Wanja\AppData\Local\Temp\plugtmp\plugin-newplayer.pdf [0] Archivtyp: PDF Stream --> Object [FUND] Enthält Erkennungsmuster des Exploits EXP/Pidief.bvg.1 C:\Users\Wanja\AppData\Local\Temp\~nsu.tmp\Au_.exe [FUND] Enthält Erkennungsmuster der Ad- oder Spyware ADSPY/Agent.89552 C:\Users\Wanja\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\3ba1d6ad-10f727fe [0] Archivtyp: ZIP --> AppletX.class [FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Agen.NA.1 C:\Users\Wanja\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\7136f07d-153d5200 [0] Archivtyp: ZIP --> myf/y/AppletX.class [FUND] Enthält Erkennungsmuster des Java-Virus JAVA/OpenStrem.BN.2 --> myf/y/LoaderX.class [FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Age.nac.4 --> myf/y/PayloadX.class [FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Age.nad.4 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUT86SEZ\upgrade[1].cab [0] Archivtyp: CAB (Microsoft) --> upgrade.exe [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.CP --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FGY4WH7G\upgrade[1].cab [0] Archivtyp: CAB (Microsoft) --> upgrade.exe [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.FE --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen --> [UnknownDir]/uninstall.exe [FUND] Enthält Erkennungsmuster der Ad- oder Spyware ADSPY/Agent.89552 C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R60MKRG1\upgrade[1].cab [0] Archivtyp: CAB (Microsoft) --> upgrade.exe [FUND] Ist das Trojanische Pferd TR/BHO.Zwangi.176 --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen C:\Windows\System32\drivers\sptd.sys [WARNUNG] Die Datei konnte nicht geöffnet werden! C:\Windows\Temp\ZWU2D95.tmp\upgrade.exe [0] Archivtyp: NSIS [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.CP --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen C:\Windows\Temp\ZWU601A.tmp\upgrade.exe [0] Archivtyp: NSIS [FUND] Ist das Trojanische Pferd TR/BHO.Zwangi.176 --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen C:\Windows\Temp\ZWUFDB4.tmp\upgrade.exe [0] Archivtyp: NSIS [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.FE --> [UnknownDir]/zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen --> [UnknownDir]/uninstall.exe [FUND] Enthält Erkennungsmuster der Ad- oder Spyware ADSPY/Agent.89552 Beginne mit der Desinfektion: C:\Program Files\Zwunzi\Zwunzi_deleted_\zwunzi.dll [FUND] Ist das Trojanische Pferd TR/Dropper.Gen [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c4a04ef.qua' verschoben! C:\Users\Wanja\AppData\Local\Temp\plugtmp\plugin-newplayer.pdf [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c4a04e4.qua' verschoben! C:\Users\Wanja\AppData\Local\Temp\~nsu.tmp\Au_.exe [FUND] Enthält Erkennungsmuster der Ad- oder Spyware ADSPY/Agent.89552 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3404ed.qua' verschoben! C:\Users\Wanja\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\3ba1d6ad-10f727fe [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3604db.qua' verschoben! C:\Users\Wanja\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\7136f07d-153d5200 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c0804aa.qua' verschoben! C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CUT86SEZ\upgrade[1].cab [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3c04e9.qua' verschoben! C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FGY4WH7G\upgrade[1].cab [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3c04ea.qua' verschoben! C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R60MKRG1\upgrade[1].cab [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3c04eb.qua' verschoben! C:\Windows\Temp\ZWU2D95.tmp\upgrade.exe [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.CP [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ba57c6c.qua' verschoben! C:\Windows\Temp\ZWU601A.tmp\upgrade.exe [FUND] Ist das Trojanische Pferd TR/BHO.Zwangi.176 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c3c04ec.qua' verschoben! C:\Windows\Temp\ZWUFDB4.tmp\upgrade.exe [FUND] Enthält Erkennungsmuster des Droppers DR/Zwangi.FE [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ba08b35.qua' verschoben! Ende des Suchlaufs: Montag, 26. April 2010 05:11 Benötigte Zeit: 4:33:02 Stunde(n) Der Suchlauf wurde vollständig durchgeführt. 37784 Verzeichnisse wurden überprüft 872719 Dateien wurden geprüft 21 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 11 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 3 Dateien konnten nicht durchsucht werden 872695 Dateien ohne Befall 7321 Archive wurden durchsucht 3 Warnungen 13 Hinweise 134119 Objekte wurden beim Rootkitscan durchsucht 0 Versteckte Objekte wurden gefunden OTL: OTL logfile created on: 26.04.2010 16:31:07 - Run 1 OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Wanja\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 65,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 285,08 Gb Total Space | 58,05 Gb Free Space | 20,36% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 996,20 Mb Total Space | 996,16 Mb Free Space | 100,00% Space Free | Partition Type: FAT F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded Drive I: | 2,03 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: DERBESTE Current User Name: Wanja Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Wanja\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH) PRC - C:\Programme\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) PRC - C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH) PRC - C:\Programme\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe (Symantec Corporation) PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Programme\PACKARD BELL\SetupMyPC\SmpSys.exe (Acer Incorporated) PRC - C:\Programme\PACKARD BELL\Packard Bell PowerSave Solution\ePowerTray.exe (Acer Incorporated) PRC - C:\Programme\PACKARD BELL\Packard Bell PowerSave Solution\ePowerSvc.exe (Acer Incorporated) PRC - C:\Programme\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.) PRC - C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Video Web Camera\CEC_MAIN.exe (Chicony) PRC - C:\Programme\Video Web Camera\traybar.exe (Chicony) PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Windows\System32\cmd.exe (Microsoft Corporation) PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe () PRC - C:\Windows\vsnpstd3.exe () ========== Modules (SafeList) ========== MOD - C:\Users\Wanja\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Programme\PACKARD BELL\Packard Bell PowerSave Solution\SysHook.dll (Acer Incorporated) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (HamachiService) -- C:\Program Files\Hamachi\hamachi.exe (LogMeIn Inc.) SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TunngleService) -- C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH) SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe (Symantec Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (GoogleDesktopManager-092308-165331) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (ePowerSvc) -- C:\Programme\PACKARD BELL\Packard Bell PowerSave Solution\ePowerSvc.exe (Acer Incorporated) SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.) SRV - (HsfXAudioService) -- C:\Windows\System32\XAudio32.dll (Conexant Systems, Inc.) SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe () ========== Driver Services (SafeList) ========== DRV - (ccHP) -- C:\Windows\System32\Drivers\NIS\1008000.029\ccHPx86.sys (Symantec Corporation) DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net) DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (eeCtrl) -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Programme\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090909.040\NAVEX15.SYS (Symantec Corporation) DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090909.040\NAVENG.SYS (Symantec Corporation) DRV - (SymEFA) -- C:\Windows\system32\drivers\NIS\1008000.029\SYMEFA.SYS (Symantec Corporation) DRV - (SRTSP) -- C:\Windows\System32\Drivers\NIS\1008000.029\SRTSP.SYS (Symantec Corporation) DRV - (BHDrvx86) -- C:\Windows\System32\Drivers\NIS\1008000.029\BHDrvx86.sys (Symantec Corporation) DRV - (SYMTDI) -- C:\Windows\System32\Drivers\NIS\1008000.029\SYMTDI.SYS (Symantec Corporation) DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\Windows\system32\drivers\NIS\1008000.029\SRTSPX.SYS (Symantec Corporation) DRV - (SymIM) -- C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation) DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090908.006\IDSvix86.sys (Symantec Corporation) DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio32.sys (Conexant Systems, Inc.) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation) DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\Windows\System32\drivers\snpstd3.sys (Sonix Co. Ltd.) DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.) DRV - (DritekPortIO) -- C:\Programme\Launch Manager\DPortIO.sys (Dritek System Inc.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce)) DRV - (sfsync04) StarForce Protection Synchronization Driver (version 4.x) -- C:\Windows\System32\drivers\sfsync04.sys (Protection Technology (StarForce)) DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV - (CLEDX) -- C:\Windows\System32\drivers\cledx.sys (Team H2O) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0409&m=easynote_lj65 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0409&m=easynote_lj65 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0409&m=easynote_lj65 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ecosia.org/?cc=de&lang=de&nocookie=1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.06 09:36:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.06 09:36:30 | 000,000,000 | ---D | M] [2010.01.01 21:26:56 | 000,000,000 | ---D | M] -- C:\Users\Wanja\AppData\Roaming\mozilla\Extensions [2010.04.25 12:07:29 | 000,000,000 | ---D | M] -- C:\Users\Wanja\AppData\Roaming\mozilla\Firefox\Profiles\5fnim5mp.default\extensions [2010.01.01 21:52:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Wanja\AppData\Roaming\mozilla\Firefox\Profiles\5fnim5mp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.06 09:36:42 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.01.01 22:26:53 | 000,000,000 | ---D | M] (Zwunzi) -- C:\Programme\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F} [2010.02.19 17:41:48 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.02.19 17:41:48 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.02.19 17:41:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.02.19 17:41:48 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.02.19 17:41:49 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml [2010.01.01 22:26:53 | 000,002,380 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\zwunzi133.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\16.8.0.41\IPSBHO.dll (Symantec Corporation) O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Programme\SGPSA\SearchAssistant.dll (Make The Web Better, LLC) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Programme\SGPSA\BHO.dll (MTWB) O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Programme\Fast Browser Search\IE\FBStoolbar.dll () O3 - HKLM\..\Toolbar: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Programme\Fast Browser Search\IE\FBStoolbar.dll () O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Programme\Fast Browser Search\IE\FBStoolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\PACKARD BELL\Packard Bell PowerSave Solution\ePowerTray.exe (Acer Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Video Web Camera\traybar.exe (Chicony) O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) O4 - HKLM..\Run: [H2O] C:\Programme\Syncrosoft\POS\H2O\cledx.exe (Team H2O) O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe () O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe () O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [AdobeUpdater6] C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [RGSC] C:\Spiele\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found O4 - HKCU..\Run: [SmpcSys] C:\Programme\PACKARD BELL\SetupMyPC\SmpSys.exe (Acer Incorporated) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus] File not found O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus Updater] File not found O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus Updater1] File not found O4 - HKLM..\RunOnce: [DeleteDir[CD8] Search Guard Plus1] File not found O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.) O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla\4.0 ( File not found O4 - Startup: C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Spiele\Xfire\Xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab (System Requirements Lab Class) O16 - DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} hxxp://webserver.dyyno.com/tng/dyyno-client/DyynoCAB.CAB (DyynoX Class) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object) O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab (Battlefield Heroes Updater) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\ezShellStart.exe) - C:\Windows\System32\ezShellStart.exe (EasyBits Software AS) O24 - Desktop WallPaper: C:\Users\Wanja\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Wanja\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\System32\ezUPBHook.dll (EasyBits Software Corp.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2007.08.10 17:52:56 | 000,106,496 | RH-- | M] () - I:\Autorun.exe -- [ UDF ] O32 - AutoRun File - [2007.08.08 10:11:43 | 000,000,050 | RH-- | M] () - I:\Autorun.inf -- [ UDF ] O32 - AutoRun File - [2007.08.10 18:24:29 | 000,000,414 | RH-- | M] () - I:\autorun.ini -- [ UDF ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.26 15:27:25 | 000,000,000 | ---D | C] -- C:\Users\Wanja\AppData\Roaming\Malwarebytes [2010.04.26 15:27:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.26 15:27:18 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.26 15:27:18 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.04.26 15:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.04.26 15:26:21 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Wanja\Desktop\mbam-setup.exe [2010.04.26 15:26:17 | 000,563,712 | ---- | C] (OldTimer Tools) -- C:\Users\Wanja\Desktop\OTL.exe [2010.04.25 22:11:55 | 000,000,000 | ---D | C] -- C:\Users\Wanja\AppData\Roaming\ICQ [2010.04.10 20:48:52 | 000,000,000 | ---D | C] -- C:\Users\Wanja\Desktop\Mama Musik [2010.04.06 00:42:01 | 000,000,000 | ---D | C] -- C:\Users\Wanja\Desktop\Musik-Produktiv Messe Bilder [2010.04.05 15:31:36 | 000,233,472 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\REX Shared Library.dll [2010.04.05 15:31:35 | 000,368,640 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\ReWire.dll [2010.04.05 15:28:17 | 000,000,000 | ---D | C] -- C:\Users\Wanja\Desktop\Reason [2010.04.05 15:26:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Propellerhead Software [2010.04.05 15:26:46 | 000,000,000 | ---D | C] -- C:\Users\Wanja\AppData\Roaming\Propellerhead Software [2007.03.12 11:41:52 | 000,061,440 | ---- | C] ( ) -- C:\Windows\System32\vsnpstd3.dll [2005.11.23 12:55:32 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnpstd3.dll [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.04.26 16:39:24 | 003,407,872 | -HS- | M] () -- C:\Users\Wanja\NTUSER.DAT [2010.04.26 16:34:59 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{9DAAB002-0573-4F99-8191-F73EA9DB858C}.job [2010.04.26 15:28:03 | 001,447,804 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.04.26 15:28:03 | 000,628,910 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.04.26 15:28:03 | 000,595,946 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.04.26 15:28:03 | 000,127,606 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.04.26 15:28:03 | 000,105,276 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.04.26 15:27:23 | 000,000,820 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.26 15:18:46 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Wanja\Desktop\mbam-setup.exe [2010.04.26 15:17:42 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Users\Wanja\Desktop\OTL.exe [2010.04.26 15:11:43 | 000,048,639 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.04.26 15:11:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.26 15:11:40 | 000,004,384 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.26 15:11:39 | 000,004,384 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.26 11:01:20 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2010.04.26 10:58:41 | 000,048,639 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.04.25 20:40:38 | 000,000,028 | ---- | M] () -- C:\Windows\Robota.INI [2010.04.25 20:15:22 | 000,003,364 | ---- | M] () -- C:\Users\Wanja\Desktop\DM805_72080_41007_22_3284.jpg [2010.04.24 20:35:20 | 000,024,119 | ---- | M] () -- C:\Users\Wanja\AppData\Roaming\addon.dat [2010.04.22 21:59:56 | 007,024,640 | ---- | M] () -- C:\Users\Wanja\Desktop\Peter Gabriel-Sledgehammer.mp3 [2010.04.22 19:52:18 | 000,999,083 | ---- | M] () -- C:\Users\Wanja\Desktop\buntstattblau_rgb.jpg [2010.04.22 19:49:52 | 000,836,188 | ---- | M] () -- C:\Users\Wanja\Desktop\Jule22_bearbeitet-1.jpg [2010.04.22 19:49:15 | 031,251,758 | ---- | M] () -- C:\Users\Wanja\Desktop\Jule22.psd [2010.04.21 17:51:33 | 000,214,520 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2010.04.20 20:23:49 | 000,219,381 | ---- | M] () -- C:\Users\Wanja\Desktop\jule3.jpg [2010.04.20 20:23:43 | 000,427,136 | ---- | M] () -- C:\Users\Wanja\Desktop\jule2.jpg [2010.04.20 20:23:33 | 000,302,891 | ---- | M] () -- C:\Users\Wanja\Desktop\Jule1.jpg [2010.04.18 15:15:19 | 000,931,328 | ---- | M] () -- C:\Users\Wanja\Desktop\No23_Record_18.04.2010_15.14.55_.mp3 [2010.04.15 19:33:12 | 000,498,742 | ---- | M] () -- C:\Users\Wanja\Desktop\Dokument .rns [2010.04.14 17:41:30 | 000,071,319 | ---- | M] () -- C:\Users\Wanja\Desktop\JUle 022.jpg [2010.04.14 17:40:22 | 000,100,135 | ---- | M] () -- C:\Users\Wanja\Desktop\Jule mit Tonwertumkehrung.jpg [2010.04.11 09:39:36 | 000,074,240 | ---- | M] () -- C:\Users\Wanja\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.04.10 18:17:35 | 130,281,736 | ---- | M] () -- C:\Users\Wanja\Desktop\stuff.wmv [2010.04.07 21:00:12 | 000,143,210 | ---- | M] () -- C:\Users\Wanja\Desktop\DirtOnMySkinedit.rns [2010.04.06 14:10:51 | 000,000,418 | ---- | M] () -- C:\Users\Wanja\Desktop\Musik - Verknüpfung.lnk [2010.04.05 15:31:36 | 000,368,640 | ---- | M] (Propellerhead Software AB) -- C:\Windows\System32\ReWire.dll [2010.04.05 15:31:36 | 000,233,472 | ---- | M] (Propellerhead Software AB) -- C:\Windows\System32\REX Shared Library.dll [2010.04.05 12:42:56 | 000,000,510 | ---- | M] () -- C:\Windows\WORDPAD.INI [2010.03.31 18:37:12 | 000,163,650 | ---- | M] () -- C:\Users\Wanja\Desktop\sackreis.jpg [2010.03.30 11:50:36 | 000,137,464 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.03.29 15:24:53 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib [2010.03.29 15:24:20 | 002,773,210 | -H-- | M] () -- C:\Users\Wanja\AppData\Local\IconCache.db [2010.03.29 15:19:53 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.03.29 15:19:43 | 3184,513,024 | -HS- | M] () -- C:\hiberfil.sys [2010.03.29 15:18:46 | 000,524,288 | -HS- | M] () -- C:\Users\Wanja\NTUSER.DAT{b5aed42d-10f1-11df-9d32-00235a89b724}.TMContainer00000000000000000001.regtrans-ms [2010.03.29 15:18:46 | 000,065,536 | -HS- | M] () -- C:\Users\Wanja\NTUSER.DAT{b5aed42d-10f1-11df-9d32-00235a89b724}.TM.blf [2010.03.29 15:18:26 | 000,000,000 | ---- | M] () -- C:\Windows\System32\Access.dat [2010.03.29 13:57:26 | 000,330,907 | ---- | M] () -- C:\Users\Wanja\Desktop\28032010251.jpg [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.04.26 15:27:23 | 000,000,820 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.25 20:23:41 | 000,003,364 | ---- | C] () -- C:\Users\Wanja\Desktop\DM805_72080_41007_22_3284.jpg [2010.04.22 21:44:56 | 007,024,640 | ---- | C] () -- C:\Users\Wanja\Desktop\Peter Gabriel-Sledgehammer.mp3 [2010.04.22 19:52:15 | 000,999,083 | ---- | C] () -- C:\Users\Wanja\Desktop\buntstattblau_rgb.jpg [2010.04.22 19:49:36 | 000,836,188 | ---- | C] () -- C:\Users\Wanja\Desktop\Jule22_bearbeitet-1.jpg [2010.04.22 19:49:14 | 031,251,758 | ---- | C] () -- C:\Users\Wanja\Desktop\Jule22.psd [2010.04.20 20:23:48 | 000,219,381 | ---- | C] () -- C:\Users\Wanja\Desktop\jule3.jpg [2010.04.20 20:23:41 | 000,427,136 | ---- | C] () -- C:\Users\Wanja\Desktop\jule2.jpg [2010.04.20 20:23:31 | 000,302,891 | ---- | C] () -- C:\Users\Wanja\Desktop\Jule1.jpg [2010.04.18 15:14:55 | 000,931,328 | ---- | C] () -- C:\Users\Wanja\Desktop\No23_Record_18.04.2010_15.14.55_.mp3 [2010.04.15 21:18:21 | 000,498,742 | ---- | C] () -- C:\Users\Wanja\Desktop\Dokument .rns [2010.04.14 17:41:46 | 000,071,319 | ---- | C] () -- C:\Users\Wanja\Desktop\JUle 022.jpg [2010.04.14 17:40:51 | 000,100,135 | ---- | C] () -- C:\Users\Wanja\Desktop\Jule mit Tonwertumkehrung.jpg [2010.04.12 21:12:02 | 000,494,077 | ---- | C] () -- C:\Users\Wanja\Desktop\IMAG0028.JPG [2010.04.10 18:11:56 | 130,281,736 | ---- | C] () -- C:\Users\Wanja\Desktop\stuff.wmv [2010.04.07 21:00:49 | 000,143,210 | ---- | C] () -- C:\Users\Wanja\Desktop\DirtOnMySkinedit.rns [2010.04.06 14:10:51 | 000,000,418 | ---- | C] () -- C:\Users\Wanja\Desktop\Musik - Verknüpfung.lnk [2010.03.31 18:37:11 | 000,163,650 | ---- | C] () -- C:\Users\Wanja\Desktop\sackreis.jpg [2010.03.29 13:57:26 | 000,330,907 | ---- | C] () -- C:\Users\Wanja\Desktop\28032010251.jpg [2010.03.17 20:53:21 | 000,000,046 | ---- | C] () -- C:\Windows\Speed.INI [2010.03.05 02:11:22 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll [2009.12.08 17:23:22 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI [2009.12.08 16:28:33 | 000,000,000 | ---- | C] () -- C:\Windows\MusicEditor.INI [2009.10.20 20:58:23 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI [2009.08.27 19:40:32 | 000,000,185 | ---- | C] () -- C:\Windows\MusicStudio.INI [2009.08.27 19:39:00 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll [2009.08.27 19:37:16 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2009.08.27 19:36:57 | 000,005,937 | ---- | C] () -- C:\Windows\mgxoschk.ini [2009.06.23 16:43:04 | 000,000,083 | ---- | C] () -- C:\Windows\wa.INI [2009.06.22 21:17:45 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2009.06.15 21:45:38 | 000,000,230 | ---- | C] () -- C:\Windows\wininit.ini [2009.06.12 23:54:34 | 000,137,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.06.12 16:02:59 | 000,722,416 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2009.06.12 14:44:20 | 000,000,252 | ---- | C] () -- C:\Windows\game.ini [2009.06.12 13:19:51 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2004.02.27 16:36:18 | 000,015,498 | ---- | C] () -- C:\Windows\snpstd3.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 48 bytes -> C:\Windows:E33C047FABD68827 < End of report > Der 2. Teil folgt. Ich hoffe mal das alles ist einigermaßen überschaubar,sonst kann ich es als Anhang senden ;) Gruß, Siren |
Und hier nun der 2. Teil! OTL EXTRAS: OTL Extras logfile created on: 26.04.2010 16:31:07 - Run 1 OTL by OldTimer - Version 3.2.3.0 Folder = C:\Users\Wanja\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 65,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 285,08 Gb Total Space | 58,05 Gb Free Space | 20,36% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 996,20 Mb Total Space | 996,16 Mb Free Space | 100,00% Space Free | Partition Type: FAT F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded Drive I: | 2,03 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: DERBESTE Current User Name: Wanja Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "UacDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "FirstRunDisabled" = 0 "UacDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0C4C84AC-C193-48CD-8A97-C8C7B5C125FA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{0EFA7E74-C8F6-445A-A1A1-D1FA7C77F5C9}" = rport=137 | protocol=17 | dir=out | app=system | "{1C15D0D9-2847-44CC-8112-21A8171D0150}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{1D2E297E-CA10-4DE3-B00D-CBF9105BC2EA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{26532466-99C8-4CAC-916A-722313E64B24}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{2DC7C45A-2EB2-4D57-83DB-985EE28EBF7A}" = lport=139 | protocol=6 | dir=in | app=system | "{525C1CCB-8FD0-4A7B-B625-9A8E791608F6}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{64CCB3E2-AE96-4300-A34C-33429353B07B}" = lport=137 | protocol=17 | dir=in | app=system | "{6715E920-27BD-4B50-93A8-ED68B1961799}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{6E47958F-CC62-4118-8AE1-0F8C1313ED3A}" = lport=2869 | protocol=6 | dir=in | app=system | "{8DF0A3E9-253D-4D64-9E64-2222F44782AE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{8E3EE70A-8A58-4440-A525-F2EAEB225FAF}" = rport=139 | protocol=6 | dir=out | app=system | "{8EE5E443-7B74-47C0-AC33-1FD2379255A0}" = lport=138 | protocol=17 | dir=in | app=system | "{A3710242-19EE-4C30-B173-F712971A321D}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{A490BF40-7532-4AB6-AAE7-6E609FC448A3}" = rport=10243 | protocol=6 | dir=out | app=system | "{A90B0828-0A45-462F-860C-D0FDB7418C19}" = lport=2869 | protocol=6 | dir=in | app=system | "{B2FF5B36-6904-446A-8221-871B8783F217}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{B45B4A38-34C9-4E7A-8468-3FBF89A0584D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{C382BF6D-BE4E-419C-961B-432A65EB211F}" = rport=445 | protocol=6 | dir=out | app=system | "{C9D93815-0637-4C55-9527-DADF3432B506}" = lport=10243 | protocol=6 | dir=in | app=system | "{CEBAFCEC-1178-4380-B01E-8250D67B8A63}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{CF14D7EE-3EA9-4794-9CCF-D92F2BDDC61A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{D43710EC-B84E-4737-A112-E7AD7C28DCE5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{DA845197-9FCD-4528-9F68-C98D02DD4AD4}" = rport=138 | protocol=17 | dir=out | app=system | "{E20F512C-4705-4A59-9B61-800040664BFE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{E3B2381A-059C-44D8-9D33-4DD90762F604}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{F4657A9D-670E-4854-B3B8-FF2B4DA43498}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F65203FB-3833-464A-8BBE-E9167E0462A7}" = lport=445 | protocol=6 | dir=in | app=system | "{FD452CFC-216D-444F-9477-6F12E4D72921}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0D948058-52A1-4019-95F1-A48C39044C17}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{0E000A8D-B2C1-49EF-B0B4-D5703AAD7555}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{0E2D2952-FFB2-4B59-97E2-19E7199489E5}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{1261A832-72E2-4094-8612-3CD01221A311}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{135EFB9F-4A19-40D7-A1BE-768632588681}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{1F3A89FF-66BA-46FB-9A8B-9FF34C18FF08}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{2424017F-23D9-412E-898C-9C73A71CE705}" = protocol=6 | dir=in | app=c:\spiele\cod5\codwawmp.exe | "{245789E4-2E0D-40D0-B769-488E96C5771A}" = protocol=6 | dir=in | app=c:\program files\tunngle\tnglctrl.exe | "{26AAD7BE-637E-4420-95AE-E3E4E47A287E}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{2824886A-9C71-49BF-A50F-FB9F73F001EB}" = protocol=6 | dir=in | app=c:\spiele\fragon rising\ofdr.exe | "{29296D9D-F622-4E7B-B126-4D75065CD1DB}" = protocol=17 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\fc2editor.exe | "{2E6B0028-D785-47AC-8554-E8BB0AAAC66A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{3613DCEC-70F8-4B11-9116-8059D899A865}" = protocol=6 | dir=in | app=c:\spiele\wolfenstein\mp\wolf2mp.exe | "{3747E80F-D795-4801-A52B-9AA6623C5BE2}" = protocol=17 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\fc2launcher.exe | "{38F5B8C1-89FA-4A8B-A713-7F99A32DABEC}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{3A858A8B-6FA4-4CD1-8484-1D4887B7E632}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{3B6A5C79-C7D3-4FE3-AB4B-99B51CB18982}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{3D857D15-147E-40A8-B212-270EF8715D27}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{43FFAED1-0643-4E33-BF3A-2CCB2395CEDF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{49684664-9253-45E2-9C89-23AAD42C5CB0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{49C9F3E6-6090-4724-AF6A-1BA01F5014BD}" = protocol=6 | dir=in | app=c:\spiele\crysisgame\bin32\crysisdedicatedserver.exe | "{4D510A45-4CEB-41DC-B9FA-6E1D5782766F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{51605C48-AB73-45C9-9154-ED0ECB80F853}" = protocol=1 | dir=in | name=@firewallapi.dll,-26140 | "{55F67260-F26D-4DC3-8DBD-6E058D9274D0}" = protocol=6 | dir=out | app=system | "{56289D72-1052-41FE-A382-9445D1D051A8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{5690CC1F-F128-46A1-BB11-CC74F9CC4DE4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{56E5DF82-D4CB-443D-960E-4EE7F259CD49}" = protocol=6 | dir=in | app=c:\program files\tunngle\tunngle.exe | "{56FD9855-F322-4717-8464-A1E057DFAE22}" = protocol=17 | dir=in | app=c:\spiele\crysisgame\bin32\crysis.exe | "{57A19C93-8109-4D2B-86B9-B2E625CE0293}" = protocol=6 | dir=in | app=c:\spiele\wolfenstein\mp\wolf2mplite.exe | "{5B431383-1D9C-43AE-B63A-771B44B58080}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{60122510-69EE-4A31-9294-B2430A8D5568}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{606D247B-D2A7-4493-A325-500DCBF3507E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{6A111FD8-A772-4F73-8003-20439984FBF1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{6DF6F828-CF9F-4B7D-8D16-443E393F1DE2}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | "{716BD229-FFB6-4F94-BA17-C054D6DA91F5}" = protocol=6 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\fc2launcher.exe | "{71E86B1F-C394-46DD-97E0-6F48707CE4B6}" = protocol=6 | dir=in | app=c:\spiele\grip\grid.exe | "{7396CB5D-54CF-42BE-B651-70D6CAED5E03}" = protocol=17 | dir=in | app=c:\spiele\fragon rising\ofdr.exe | "{79AD238F-6A8C-4E52-BDA2-1BB496A1A00D}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{79BE87A5-9107-4548-BAF5-43AE4176CAB2}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{7C62552C-FF37-4C6C-8D53-C3F5C364692A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{883F9BC4-A6DE-4B7C-81A6-D4A3580FEE3C}" = protocol=17 | dir=in | app=c:\program files\tunngle\tnglctrl.exe | "{88D1C27C-1188-409C-8B22-6FAC92E6C7C6}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{8CA2CA03-305F-4D97-9AB5-4FFB3B48F02A}" = protocol=6 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\fc2editor.exe | "{91A66E57-3ED3-4600-90A1-9D392D3896BC}" = protocol=17 | dir=in | app=c:\spiele\crysisgame\bin32\crysisdedicatedserver.exe | "{92F12D10-AEC6-45DD-9983-2FDF60F30BC5}" = protocol=17 | dir=in | app=c:\spiele\cod5\codwawmp.exe | "{97F11BB7-70AF-4584-8E13-F69250FAA0F0}" = protocol=6 | dir=in | app=c:\spiele\crysisgame\bin32\crysis.exe | "{98A968DE-F3AD-4791-B716-8CC7CEB03E43}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{992AF130-E17F-4043-A32B-BA16E91BE633}" = protocol=6 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\farcry2.exe | "{9B3C3448-D058-4DAB-8E7C-80AF3F12C31E}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{9CA4E0A0-66E8-41DE-AF49-EFF3EAD216AD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{9E0BD5E0-9472-44CD-A1B0-848B413BADF0}" = protocol=17 | dir=in | app=c:\program files\tunngle\tunngle.exe | "{A283633F-2D82-4230-A711-C09A2F534194}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{A803230C-FBE4-4ADC-AB9E-AFBC86EF32C3}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{A85DE5C0-3BB0-4FB6-ACFF-746824E105EF}" = protocol=6 | dir=in | app=c:\spiele\cod5\codwaw.exe | "{A9FA5DBB-6BB3-4068-9B88-A860B4643C77}" = protocol=17 | dir=in | app=c:\spiele\wolfenstein\mp\wolf2mp.exe | "{AA270F10-9242-4313-953A-7CDE2E551194}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{B155E26A-46BE-4156-BE8B-B5C432500629}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{C71C7B63-73B3-4184-9D55-BC8C16DB3D34}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{CB84E355-6054-478C-8080-F44FBE7453FF}" = protocol=17 | dir=in | app=c:\spiele\wolfenstein\mp\wolf2mplite.exe | "{CB9EA41F-1A47-4C33-876D-EE49F0010634}" = protocol=17 | dir=in | app=c:\spiele\lotr\game.dat | "{CC506476-FCB1-4151-B03C-74D7126EBD2C}" = protocol=17 | dir=in | app=c:\spiele\sldkfjsl\far cry 2\bin\farcry2.exe | "{CE19FDB8-C8BD-4388-8590-C02E872787D5}" = protocol=6 | dir=in | app=c:\spiele\lotr\game.dat | "{CF8937FE-D907-4BFE-9684-08C5AF3EBBC2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{D1AB576E-ABB1-4919-809F-2104B6781D56}" = protocol=58 | dir=in | name=@firewallapi.dll,-26142 | "{D43298C4-6F2E-4997-948D-E5348B324F61}" = protocol=17 | dir=in | app=c:\spiele\cod5\codwaw.exe | "{D819ED5A-BDAF-48EE-AA28-BB3436B162D0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{DB390426-34E1-46CA-8869-D36A01835DDB}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{E70D98BB-C573-4D4E-9C6E-F5DFC67B0241}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{EB721398-3B77-4CE7-B83F-F17F6AF57690}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{F454CA95-321C-476B-8E3D-0A7F1F431C84}" = protocol=17 | dir=in | app=c:\spiele\grip\grid.exe | "{F6C2DA2B-CA92-4E25-AA51-840F2786FFC0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{FAF2CA8F-79B9-4B34-B490-8A4882EFCFFA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{FC24C0D6-FE1B-4ABC-843A-475E59320629}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{FFC36770-F784-45CC-811A-63183C3CE59D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "TCP Query User{03E260B4-7BF9-4452-8C09-F28B26254DF3}C:\spiele\jediknight\gamedata\jk2mp.exe" = protocol=6 | dir=in | app=c:\spiele\jediknight\gamedata\jk2mp.exe | "TCP Query User{0A2FCAF0-03B4-4751-BD49-5A5CF174E028}C:\spiele\call of duty 4\iw3mp.exe" = protocol=6 | dir=in | app=c:\spiele\call of duty 4\iw3mp.exe | "TCP Query User{10E22E44-34F7-41AE-B46F-33D57AC61FF0}C:\spiele\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\spiele\counter-strike 1.6\hl.exe | "TCP Query User{18E0DECA-6E07-4A51-9DDF-C52B7833AB2A}C:\spiele\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\spiele\xfire\xfire.exe | "TCP Query User{1D3C5949-0ABC-4BE4-881D-4980F00A3319}C:\spiele\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\spiele\counter-strike 1.6\hl.exe | "TCP Query User{2C28E259-BFC5-47BB-BCB8-38B937C0773A}C:\spiele\cod5\codwaw_lanfixed.exe" = protocol=6 | dir=in | app=c:\spiele\cod5\codwaw_lanfixed.exe | "TCP Query User{3673BB0D-CBB4-4804-98C4-129D66A458A6}C:\spiele\cod2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\spiele\cod2\cod2mp_s.exe | "TCP Query User{44524AE7-B6B6-42F0-90A6-C8A0F41DED1D}C:\spiele\battlefield 2\bf2.exe" = protocol=6 | dir=in | app=c:\spiele\battlefield 2\bf2.exe | "TCP Query User{68B57D28-2025-4004-8215-6F19BC5A5D1A}C:\spiele\cod2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\spiele\cod2\cod2mp_s.exe | "TCP Query User{A0821673-D6DB-4397-A6BD-979C8DBB1843}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | "TCP Query User{B1DF4129-D6C4-494B-9DC9-F4C3687B7380}C:\spiele\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\spiele\xfire\xfire.exe | "TCP Query User{BF2CC50C-2914-4C47-9350-8E32CFA24B61}C:\spiele\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe" = protocol=6 | dir=in | app=c:\spiele\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe | "TCP Query User{E104BDA0-77DD-4BE2-B632-ED352803261F}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "TCP Query User{FDCE64C7-7038-4042-94AD-6B832998CFAF}C:\spiele\call of duty 4\lanfix.exe.exe" = protocol=6 | dir=in | app=c:\spiele\call of duty 4\lanfix.exe.exe | "UDP Query User{115E4F0B-76A4-4DBE-B377-652B8A7794CE}C:\spiele\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe" = protocol=17 | dir=in | app=c:\spiele\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe | "UDP Query User{193B580D-0965-428A-A936-0979AE0239C3}C:\spiele\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\spiele\counter-strike 1.6\hl.exe | "UDP Query User{33257112-C646-451E-9680-41D003B2E4D5}C:\spiele\cod5\codwaw_lanfixed.exe" = protocol=17 | dir=in | app=c:\spiele\cod5\codwaw_lanfixed.exe | "UDP Query User{4AF3C7BE-30E6-481C-BE80-789E5EE745B0}C:\spiele\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\spiele\xfire\xfire.exe | "UDP Query User{6AF6F54E-B3F7-4B7A-941A-551CB38CDA40}C:\spiele\jediknight\gamedata\jk2mp.exe" = protocol=17 | dir=in | app=c:\spiele\jediknight\gamedata\jk2mp.exe | "UDP Query User{86A13A2E-59E9-4648-A6A6-2CBDAAD1BCE5}C:\spiele\battlefield 2\bf2.exe" = protocol=17 | dir=in | app=c:\spiele\battlefield 2\bf2.exe | "UDP Query User{891258B8-22E5-4B2B-A981-A180E9D5D71C}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "UDP Query User{8FBFF0BB-02E3-486B-B71D-651E4FFF16DA}C:\spiele\call of duty 4\iw3mp.exe" = protocol=17 | dir=in | app=c:\spiele\call of duty 4\iw3mp.exe | "UDP Query User{D870DE0F-E3E6-4E79-AA0B-7A92D93C88D8}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | "UDP Query User{E1DDBC10-647A-4BFD-BE11-605F5CE98A1F}C:\spiele\call of duty 4\lanfix.exe.exe" = protocol=17 | dir=in | app=c:\spiele\call of duty 4\lanfix.exe.exe | "UDP Query User{E68BACA8-B0A0-40F0-A008-57D804F18D4A}C:\spiele\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\spiele\xfire\xfire.exe | "UDP Query User{F36F7080-D704-4F2F-B950-977B5E8A2639}C:\spiele\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\spiele\counter-strike 1.6\hl.exe | "UDP Query User{F8CD42B5-AF40-4B2D-B6AC-2B349A3325B6}C:\spiele\cod2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\spiele\cod2\cod2mp_s.exe | "UDP Query User{FCE622AF-8EA8-4E16-A832-556C945FA85E}C:\spiele\cod2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\spiele\cod2\cod2mp_s.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R) "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{00D15456-F679-4AD4-8BD2-56450D4C3F72}" = WarRock "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty(R) - World at War(TM) 1.6 Patch "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie "{12A1B519-5934-4508-ADBD-335347B0DC87}" = Video Web Camera "{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter "{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty(R) - World at War(TM) 1.3 Patch "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate "{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16 "{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty(R) - World at War(TM) 1.2 Patch "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{3293C06B-003F-4027-8380-FFD79E38167D}" = Tony Hawk's American Wasteland "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell PowerSave Solution "{3F290582-3F4E-4B96-009C-E0BABAA40C42}" = Die Schlacht um Mittelerde(tm) "{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker "{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{52E1698D-8B87-4B79-B609-77C763C3E6D9}" = YouTube Video Converter "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{576E71DA-3000-48F6-9B21-B9A70D47DFCF}" = Star Wars JK II Jedi Outcast "{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID "{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail "{5C1BF3AC-B19D-4C26-B0A0-90833A521031}" = Nero 8 Essentials "{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder "{709817E4-5439-4206-8738-796B34B623BD}" = MetaBoli "{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security "{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime "{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3 "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management "{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer "{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{8AAB4176-A747-493A-A42C-B63CFADFD8E3}" = NVIDIA PhysX "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials "{9312191B-30A5-44E1-8D8D-6936FE06CDE8}" = Wanted: Weapons of Fate "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source "{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty(R) - World at War(TM) 1.4 Patch "{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder "{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter "{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch "{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder "{AF37F9DE-0726-439E-BC10-43D9195394D0}" = Firebird SQL Server - MAGIX Edition "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes "{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty(R) - World at War(TM) 1.5 Patch "{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime "{C920EFB6-59DB-472D-B445-21821477AD17}" = True Crime® New York City "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2 "{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM) "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{E4511CEC-2E60-4076-95B6-0E193269EB86}" = MicroMachines V4 "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EBB794ED-D282-4334-92FB-254481EFF514}" = Pro Evolution Soccer 6 "{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2 "{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0 "{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "18 Wheels of Steel American Long Haul 1.00" = 18 Wheels of Steel American Long Haul 1.00 "82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2006 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0 "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "Age Of Pirates 1.41_is1" = Age Of Pirates - Caribbean Tales 1.41 "AnyDVD" = AnyDVD "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Blitzkrieg 2" = Blitzkrieg 2 "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters "divx650vfw_is1" = DivX Pro 6.8.0 VFW "EasyBits Magic Desktop" = EasyBits Magic Desktop "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2 "Game Booster_is1" = Game Booster "Google Desktop" = Google Desktop "Hamachi" = Hamachi 1.0.1.5 "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "Identity Card" = Identity Card "InfoCentre" = InfoCentre "InstallShield_{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty(R) - World at War(TM) 1.6 Patch "InstallShield_{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty(R) - World at War(TM) 1.3 Patch "InstallShield_{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty(R) - World at War(TM) 1.2 Patch "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup "InstallShield_{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty(R) - World at War(TM) 1.4 Patch "InstallShield_{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty(R) - World at War(TM) 1.5 Patch "InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2 "InstallShield_{EBB794ED-D282-4334-92FB-254481EFF514}" = Pro Evolution Soccer 6 "InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein "LManager" = Launch Manager "MAGIX Music Maker 16 Premium Download-Version D" = MAGIX Music Maker 16 Premium Download-Version "MAGIX Screenshare D" = MAGIX Screenshare "MAGIX Speed burnR D" = MAGIX Speed burnR "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9) "NIS" = Norton Internet Security "NVIDIA Drivers" = NVIDIA Drivers "OpenAL" = OpenAL "Packard Bell Customer Registration" = Packard Bell Customer Registration "PackardBell Screensaver" = PackardBell ScreenSaver "PunkBusterSvc" = PunkBuster Services "Saiteninstrument-Stimmgerät für Open-Tunings (De~FEB13E95_is1" = Saiteninstrument-Stimmgerät für Open-Tunings (Demoversion), ver "SetupMyPC" = SetupMyPC "Steinberg Cubase SX v3.1.1.944" = Steinberg Cubase SX v3.1.1.944 "SyncroSoft Emu" = SyncroSoft Emu (Remove only) "Syncrosoft's License Control" = Syncrosofts Lizenz Kontrolle "SynTPDeinstKey" = Synaptics Pointing Device Driver "SystemRequirementsLab" = System Requirements Lab "TBSB07183.TBSB07183Toolbar" = Fast Browser Search (My Tattoons) "Tunngle beta_is1" = Tunngle beta "TuxGuitar 1.1" = TuxGuitar "Uninstall_is1" = Uninstall 1.0.0.1 "Updator" = Updator "VirtualCloneDrive" = VirtualCloneDrive "VLC media player" = VLC media player 0.9.9 "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR "Xfire" = Xfire (remove only) ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Move Networks Player - IE" = Move Networks Media Player for Internet Explorer ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 12.01.2010 12:42:18 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 15.01.2010 11:40:14 | Computer Name = DerBeste | Source = Windows Search Service | ID = 3013 Description = Error - 15.01.2010 11:40:14 | Computer Name = DerBeste | Source = Windows Search Service | ID = 3013 Description = Error - 29.01.2010 15:05:10 | Computer Name = DerBeste | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe". Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". [ System Events ] Error - 19.03.2010 04:06:52 | Computer Name = DerBeste | Source = Service Control Manager | ID = 7026 Description = Error - 27.03.2010 08:59:57 | Computer Name = DerBeste | Source = Dhcp | ID = 1002 Description = Die IP-Adresslease 192.168.1.150 für die Netzwerkkarte mit der Netzwerkadresse 00235A89B724 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error - 29.03.2010 09:17:09 | Computer Name = DerBeste | Source = Dhcp | ID = 1002 Description = Die IP-Adresslease 192.168.1.150 für die Netzwerkkarte mit der Netzwerkadresse 00235A89B724 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error - 29.03.2010 09:19:22 | Computer Name = DerBeste | Source = Application Popup | ID = 875 Description = Treiber sfdrv01.sys konnte nicht geladen werden. Error - 29.03.2010 09:19:53 | Computer Name = DerBeste | Source = HTTP | ID = 15016 Description = Error - 29.03.2010 09:21:15 | Computer Name = DerBeste | Source = Service Control Manager | ID = 7009 Description = Error - 29.03.2010 09:21:15 | Computer Name = DerBeste | Source = Service Control Manager | ID = 7000 Description = Error - 29.03.2010 09:21:15 | Computer Name = DerBeste | Source = Service Control Manager | ID = 7026 Description = Error - 06.04.2010 06:43:50 | Computer Name = DerBeste | Source = Service Control Manager | ID = 7034 Description = Error - 25.04.2010 16:11:39 | Computer Name = DerBeste | Source = Dhcp | ID = 1002 Description = Die IP-Adresslease 192.168.1.150 für die Netzwerkkarte mit der Netzwerkadresse 00235A89B724 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). < End of report > Und zu guter Letzt MALWAREBYTES: Malwarebytes' Anti-Malware 1.44 Datenbank Version: 3510 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 26.04.2010 18:04:55 mbam-log-2010-04-26 (18-04-49).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 407574 Laufzeit: 2 hour(s), 34 minute(s), 32 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 3 Infizierte Dateien: 6 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\YouTube Video Converter\codec\YoutubeDown.exe (Trojan.FakeAlert) -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\ProgramData\Zwunzi (Adware.Zwunzi) -> No action taken. C:\Program Files\Zwunzi (Adware.Zwunzi) -> No action taken. C:\Program Files\Zwunzi\Zwunzi_deleted_ (Adware.Zwunzi) -> No action taken. Infizierte Dateien: C:\Program Files\Steinberg\Cubase SX 3\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. C:\Program Files\YouTube Video Converter\codec\YoutubeDown.exe (Trojan.FakeAlert) -> No action taken. C:\Program Files\Zwunzi\Zwunzi_deleted_\zwunzi.exe (Adware.Agent) -> No action taken. C:\ProgramData\Zwunzi\zwunzi133.exe (Adware.Agent) -> No action taken. C:\Users\Wanja\AppData\Roaming\addon.dat (Malware.Trace) -> No action taken. C:\Program Files\setup.exe (Rogue.Installer) -> No action taken. :dankeschoen: Gruß, Siren |
Zitat:
|
Guten Tach :) Ich habe nun erneut einen Malwarebytes Scan gemacht, diesmal mit Version 1.45 und Datenbankversion 4042. ;) Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 4042 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 27.04.2010 18:23:14 neuerlog.txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 380655 Laufzeit: 2 Stunde(n), 33 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 4 Infizierte Dateien: 5 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F} (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\chrome (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\defaults (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\defaults\preferences (Adware.Zwunzi) -> No action taken. Infizierte Dateien: C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\chrome.manifest (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\install.rdf (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\chrome\zwunzi.jar (Adware.Zwunzi) -> No action taken. C:\Program Files\Mozilla Firefox\extensions\{F270F1AF-34D6-41CB-A9F5-8200EF7DB41F}\defaults\preferences\prefs.js (Adware.Zwunzi) -> No action taken. C:\Users\Wanja\AppData\Roaming\addon.dat (Malware.Trace) -> No action taken. Die infizierten Dateien sollten auf jeden Fall gelöscht werden,oder? Vieeeeelen Dank für die Hilfe, Siren |
Ja, die Funde löschen. Danach: Starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code: :OTLDas Logfilemüsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. |
Nabend. Ich hab die besagten Zeilen eingefügt, allerdings bin ich mir nicht sicher ob ich bei "Extra Registry" wieder "Use Safe List" ankreuzen muss?? Grad eben stand er auf "None",und beim Fixen ist das Programm abgestürzt und ich musste mich abmelden. Soll ich alles wiederholen? Gruß |
Ja probier nochmal bitte. Wenn es auch nicht geht, werd ich den Text kürzen. |
So, habe alles wiederholt, und der Log kam auch. Nachdem ich mich abmelden musste wurde ein 1. Log erstellt,ich poste ih vorsichtshalber auch nochmal. 1.Log (nach Absturz): Files\Folders moved on Reboot... File move failed. C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll scheduled to be moved on reboot. File move failed. I:\Autorun.exe scheduled to be moved on reboot. File move failed. I:\Autorun.inf scheduled to be moved on reboot. File move failed. I:\autorun.ini scheduled to be moved on reboot. File move failed. C:\Windows\temp\JETDF08.tmp scheduled to be moved on reboot. Registry entries deleted on Reboot... 2.Log (nach Wiederholung): All processes killed ========== OTL ========== File C:\Programme\Mozilla Firefox\searchplugins\zwunzi133.xml not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Programme\Ask.com\GenericAskToolbar.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ not found. File C:\Programme\SGPSA\BHO.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ not found. File C:\Programme\Fast Browser Search\IE\FBStoolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ not found. File C:\Programme\Fast Browser Search\IE\FBStoolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ not found. File C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ . File move failed. C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll scheduled to be moved on reboot. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Programme\Ask.com\GenericAskToolbar.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ not found. File C:\Programme\Fast Browser Search\IE\FBStoolbar.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. File C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ . File move failed. C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll scheduled to be moved on reboot. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Programme\Ask.com\GenericAskToolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DeleteDir[CD8 not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DeleteDir[CD8 not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DeleteDir[CD8 not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DeleteDir[CD8 not found. File move failed. I:\Autorun.exe scheduled to be moved on reboot. File move failed. I:\Autorun.inf scheduled to be moved on reboot. File move failed. I:\autorun.ini scheduled to be moved on reboot. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Wanja ->Temp folder emptied: 455732 bytes ->Temporary Internet Files folder emptied: 1194515 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3547445 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 5,00 mb OTL by OldTimer - Version 3.2.3.0 log created on 04272010_204602 Files\Folders moved on Reboot... File\Folder C:\Programme\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll not found! File\Folder I:\Autorun.exe not found! File\Folder I:\Autorun.inf not found! File\Folder I:\autorun.ini not found! File\Folder C:\Windows\temp\JETDF08.tmp not found! Registry entries deleted on Reboot... :dankeschoen: |
Deinstallier mal unbedingt Norton Internet Security, anscheinend ist das noch aktiv. Ich hab erst nur geglaubt da Reste von zu sehen, aber das Teil ist noch installiert und macht Probleme v.a. wenns parallel mit AntiVir von Avira läuft! |
Ja, Norton war als Gratis Testversion beim Kauf des Laptops dabei, ist allerdings schon abgelaufen. ^^ Meinst du das deswegen die Firewall nicht richtig gearbeitet hat? Und muss ich danach noch etwas tun oder hat sich das Problem damit erledigt? Danke und Gruß, Siren |
Möchte ich so noch nicht beurteilen. Lass uns mal tiefer graben, erstell bitte Logs mit GMER und OSAM und poste sie. |
Guten Tag ;) Hab nun den OSAM-Scan gemacht,GMER geht bei mir nicht,ich habs 3 mal probiert, allerdings hat sich der PC jedes mal aufgehängt und als ich auf "Stop" geklicktet hab abgestürzt. :balla: Aber erstmal der OSAM-Scan,vll. kannst du da ja schon was mit anfangen :P Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 18:34:05 on 28.04.2010 OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit Default Browser: Mozilla Corporation Firefox 3.5.9 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [AppInit DLLs] -----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )----- "AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [Control Panel Objects] -----( %SystemRoot%\system32 )----- "PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\Windows\System32\Drivers\AnyDVD.sys "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "Dritek General Port I/O" (DritekPortIO) - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\DPortIO.sys "EagleNT" (EagleNT) - ? - C:\Windows\system32\drivers\EagleNT.sys (File not found) "ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys "sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys (File is exclusively opened, access blocked) "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfdrv01.sys "StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfhlp02.sys "StarForce Protection Synchronization Driver (version 4.x)" (sfsync04) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfsync04.sys "Team H2O CLEDX service" (CLEDX) - "Team H2O" - C:\Windows\System32\DRIVERS\cledx.sys "UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys "Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\Drivers\NTIDrvr.sys [Explorer] -----( HKCU\Software\Classes\Folder\shellex\ColumnHandlers )----- {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {E54729E8-BB3D-4270-9D49-7389EA579090} "EasyBits ShellExecute Hook" - "EasyBits Software Corp." - C:\Windows\system32\EZUPBH~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {00020d75-0000-0000-c000-000000000046} "lnkfile" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - (File not found | COM-object registry key not found) {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - (File not found | COM-object registry key not found) {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - (File not found | COM-object registry key not found) {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - (File not found | COM-object registry key not found) {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {B7056B8E-4F99-44f8-8CBD-282390FE5428} "VirtualCloneDrive Shell Extension" - "Elaborate Bytes AG" - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} "{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {784797A8-342D-4072-9486-03C8D0F2F0A1} "Battlefield Heroes Updater" - "EA Digital Illusions CE AB" - C:\Windows\Downloaded Program Files\BFHUpdater.dll / https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab {67DABFBF-D0AB-41FA-9C46-CC0F21721616} "DivXBrowserPlugin Object" - "DivX,Inc." - C:\Program Files\DivX\DivX Web Player\npdivx32.dll / hxxp://download.divx.com/player/DivXBrowserPlugin.cab {4E218431-2F07-40BD-A9D3-035324C1F13F} "DyynoX Class" - "Dyyno" - C:\Windows\Downloaded Program Files\DyynoX.dll / hxxp://webserver.dyyno.com/tng/dyyno-client/DyynoCAB.CAB {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\Windows\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab {1E54D648-B804-468d-BC78-4AFFED8E262E} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_srl.dll / hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL {77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} "BrowserHelper Class" - "Make The Web Better, LLC" - C:\Program Files\SGPSA\SearchAssistant.dll {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "Google Dictionary Compression sdch" - "Google Inc." - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (File not found) {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "OpenOffice.org 3.1.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe (Shortcut exists | File found, but it contains no detailed information | File exists) "Xfire.lnk" - "Xfire Inc." - C:\Spiele\Xfire\Xfire.exe (Shortcut exists | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "Hamachi.lnk" - "LogMeIn Inc." - C:\Program Files\Hamachi\hamachi.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "AnyDVD" - "SlySoft, Inc." - C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe "ICQ" - "ICQ, LLC." - "C:\Program Files\ICQ6.5\ICQ.exe" silent "msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background "RGSC" - ? - C:\Spiele\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent (File not found) "SmpcSys" - "Acer Incorporated" - C:\Program Files\PACKARD BELL\SetupMyPC\SmpSys.exe "swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "{B7A00906-FC95-2A68-11D1-83169E2B26EB}" - "Trend Micro Inc" - C:\Users\Wanja\AppData\Roaming\Micos\Kernel39.exe -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )----- "Shockwave Updater" - "Adobe Systems, Inc." - C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET CLR 1.1.4322; AskTB5.4)" -"hxxp://www.habbo.de/shockwave_client" -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Acer ePower Management" - "Acer Incorporated" - C:\Program Files\Packard Bell\Packard Bell PowerSave Solution\ePowerTray.exe "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "BackupManagerTray" - "NewTech Infosystems, Inc." - "C:\Program Files\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -k "Camera Assistant Software" - "Chicony" - "C:\Program Files\Video Web Camera\traybar.exe" "Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup "H2O" - "Team H2O" - C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\LManager.exe "Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "PDVD8LanguageShortcut" - ? - "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "RemoteControl8" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe" "VirtualCloneDrive" - "Elaborate Bytes AG" - "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\PACKARD BELL\Packard Bell PowerSave Solution\ePowerSvc.exe "Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe (File found, but it contains no detailed information) "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "Easybits Shared Services for Windows" (ezSharedSvc) - "EasyBits Sofware AS" - C:\Windows\System32\ezsvc7.dll "FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe "FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe "Google Desktop Manager 5.8.809.23506" (GoogleDesktopManager-092308-165331) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe "Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "Hamachi Service" (HamachiService) - "LogMeIn Inc." - C:\Program Files\Hamachi\hamachi.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe "NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe "NTI IScheduleSvc" (NTI IScheduleSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe "PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe (File found, but it contains no detailed information) "PnkBstrB" (PnkBstrB) - ? - C:\Windows\system32\PnkBstrB.exe (File found, but it contains no detailed information) "Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe "TunngleService" (TunngleService) - "Tunngle.net GmbH" - C:\Program Files\Tunngle\TnglCtrl.exe [Winlogon] -----( HKCU\Control Panel\Desktop )----- "SCRNSAVE.EXE" - "EasyBits Software AS" - C:\Windows\system32\ezScrSvr.scr [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru :dankeschoen: Gruß |
Das sieht unauffällig aus. Kriegste das mit GMER auch noch hin? |
Das ist eine gute Nachricht! :) Ich probiers nochmal, aber versprechen kann ich nichts. :D Meld mich dann gleich wieder. Gruß, Siren |
Soo. Ich habs noch 2 mal probiert,aber immer das Gleiche. Er startet ganz kurz das Programm, dann hakt der PC und er macht garnichts. Wieder "Stopp" gedrükt,und dann ist er endgültig abgestürzt. ^^ Gibts vll. ne Alternative zu GMER? Gruß |
Dann probier sonst mal RootRepeal wenn GMER nich will.
Code: Drivers
|
Tagchen ;) Hab jetzt den RootRepeal-Scan gemacht, hier die Ergebnisse. ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/04/29 14:02 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP1 ================================================== Drivers ------------------- Name: dump_dumpata.sys Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys Address: 0x90239000 Size: 45056 File Visible: No Signed: - Status: - Name: dump_msahci.sys Image Path: C:\Windows\System32\Drivers\dump_msahci.sys Address: 0x90244000 Size: 40960 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0xA1FCC000 Size: 49152 File Visible: No Signed: - Status: - Name: spij.sys Image Path: C:\Windows\System32\Drivers\spij.sys Address: 0x80693000 Size: 1052672 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: C:\System Volume Information\{14431315-332e-11df-aae0-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{1443131e-332e-11df-aae0-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{1443132c-332e-11df-aae0-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3ce5e-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3ceb9-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cefb-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cf02-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cf17-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cf31-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cf47-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cf87-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3ce4f-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{3a48b609-51fc-11df-93f3-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{a43aeca9-52e1-11df-98ff-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cdb1-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cde5-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3cdfe-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\System Volume Information\{aff3ce2f-3b35-11df-8107-00235a89b724}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Locked to the Windows API! Path: C:\Program Files\Windows Media Player\Network Sharing\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\System32\wbem\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_81c25f21d3d46d84.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_03ca5532205cb096.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f0efb442f8a0f46c.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.4053_none_3b0e32bdc9afe437.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9818.0_none_b7e811947b297f6d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_818f59bf601aa775.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.4053_none_6b86c0e9b0196766.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_cbf21254470d8752.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_7dd1e0ebd6590e0b.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_49ef489714173a89.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4db266e67dd280ef.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_516e2e610f48bda6.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_8550c6b5d18a9128.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_e29d1181971ae11e.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\ab5212c08b080c18511d0f344aedd3cbb0cfda87bc12ac2bb88e9f8ef7635b5e.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\1154a0dd8ec7062351d700a2d07b3bb5154c840bfc84077d20f6947d1e08bb6f.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\611281d2ae7e5728e1298dcbf5aa626dad5a5a746964c9c425d183f86d0289de.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\534cf013667c78b2ecf44e00183c95e4c2336f1e150a38452cd7e61ec2a73bfc.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\17187dd8585ec10ff914a12b3996436e3822c0d7ab634fd243562bf6b0a10711.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\935df4549e21123a2efb986a707f54475380a037519679510e4b4dfc4bdb5767.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\74ff96d7d46907976c63c8c8e3a7457e950c6fd8a7661600aab23382051de0e0.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\a768d09fe494b7325cb036213b4704e844529604bd7621580cc69b6c76e3baa8.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\a951d53950c367acc37622f0dd619a954df5de2c4ec40296e6636605aa33714a.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\2d3cb7907b1336ea5889a2b731d5e97ad40903a4efd2287c1c117bc30f208f46.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\3dd5a727f2a1142223c6d9a7bff73ae7676aac714a4da8192f66123045b11c41.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\bd83dce340498e7c363093c2fc74dfb58e1ec17770453905172c7471fadd9333.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\dd72f7ab2def5f75f58d01b24643b308750c38685daaed50bcddf61c18460dee.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\d14225a52543aa5a9605b00dd7574812bf89c605ebc73a9730e1e386bfc965f8.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\d5ecf2ab9387e082648bbcccd6eceb9d67b096939150833d0ae3066b3a1a676e.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\91ca50cec42075fff02b366323bf3b45d2053b24544bd12b622b65621bd0edd5.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\f7bf65ca621d8ad32ead1500a08827be239d0f49d83dc20dabf57d2eb17adbd7.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\ae866863bd234bc6fd016eab6d40c7fc996cb58ab511179d087596835c8182ab.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\be665d05f40feae483878d15c39e6fff25800f58d7364b309a49983afcd19841.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\ec6ab08cec3c4a5939ec1a58eda071d547416f00bee0e337715c0e20fbe1e1bf.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\610730c853431925508643e33960e750427cd10c421d9ddced230f74ec671e4b.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\b643d2bc101b4fb5e41380ec953ffef572cd8c97f43c6cff8fa6b4538e188ba0.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\5ba439378027b451247f04ae2a57f0cfe7c12eb038148c7ce49ae9af2ee3822b.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\88b03fe13d2710ad787d5d96cd0e5cbeda3a61c2a0a2bdc0c0984a48365242e2.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\26340819d2ef86080d9001c6f2737d70fd6602ddf4b86b6c26b326ef81cc3342.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\Manifests\ef483ae0673e2975dd4224fe26749623c1c702b8b3fded10161417459e1771a7.cat Status: Locked to the Windows API! Path: C:\Windows\winsxs\msil_system.servicemodel.resources_b77a5c561934e089_6.0.6000.16716_de-de_25025fdedb611a73\SYSTEM~1.DLL Status: Locked to the Windows API! Path: C:\Windows\winsxs\msil_system.servicemodel.resources_b77a5c561934e089_6.0.6000.20876_de-de_0e3abadaf5031283\SYSTEM~1.DLL Status: Locked to the Windows API! Path: C:\Windows\winsxs\msil_system.servicemodel.resources_b77a5c561934e089_6.0.6001.18106_de-de_24dd5b5cdbb30d73\SYSTEM~1.DLL Status: Locked to the Windows API! Path: C:\Windows\winsxs\msil_system.servicemodel.resources_b77a5c561934e089_6.0.6001.22221_de-de_0e122718f5582002\SYSTEM~1.DLL Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.0.6002.18005_none_04642e8a80bb8b27\MI2095~1.MAN Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.0.6002.18005_none_04642e8a80bb8b27\MIC237~1.MAN Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6001.18330_none_0b49590d4f3204dd\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6002.22172_none_0d9028a465949c3d\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16789_none_09360999522be962\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16885_none_09320a57522f812d\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.16926_none_0973ec0f51fdf005\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.20976_none_09c777586b441e5d\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.21083_none_09b97eb06b4f218b\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6000.21125_none_09fc60b26b1ca9ba\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6001.18185_none_0b1847174f5614f7\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6001.18289_none_0b1c4a254f52777a\RENDER~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6000.16830_none_29a6eeebde589a97\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6000.21023_none_2a3e34a2f76b9db7\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6001.18226_none_2b9dff39db71a7a1\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6001.22389_none_2be9bd5af4bd3b16\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6002.18005_none_2d991295d888a8b3\PRINTF~1.MOF Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.16708_en-us_9eec237d3c4b6ca7\_SERVI~3.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.16708_en-us_9eec237d3c4b6ca7\_SERVI~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.16708_en-us_9eec237d3c4b6ca7\_TRANS~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.16716_de-de_f5ee7d044d774a25\9A6B6C~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.20864_en-us_9f30df98559d4ebb\_SERVI~3.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.20864_en-us_9f30df98559d4ebb\_SERVI~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.20864_en-us_9f30df98559d4ebb\_TRANS~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6000.20876_de-de_f6373a4766c59195\9A6B6C~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.18096_en-us_a06f105d39bcc93c\_SERVI~3.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.18096_en-us_a06f105d39bcc93c\_SERVI~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.18096_en-us_a06f105d39bcc93c\_TRANS~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.18106_de-de_f7df8b964a95bf25\9A6B6C~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.22208_en-us_a15bfeee528f9d62\_SERVI~3.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.22208_en-us_a15bfeee528f9d62\_SERVI~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.22208_en-us_a15bfeee528f9d62\_TRANS~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6001.22221_de-de_f84e871763c8181e\9A6B6C~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.0.6002.18005_de-de_f9c5010047bcf540\9A6B6C~1.INI Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_appdata_b03f5f7f11d50a3a_6.0.6000.16720_none_9b31bbe79077558b\GROUPE~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_appdata_b03f5f7f11d50a3a_6.0.6000.20883_none_8469d28baa199a7e\GROUPE~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_appdata_b03f5f7f11d50a3a_6.0.6001.18111_none_9b0ca09d90c9622c\GROUPE~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_appdata_b03f5f7f11d50a3a_6.0.6001.22230_none_84411139aa6edb3f\GROUPE~1.XML Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\CREATE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\CREATE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_none_4c8d95d6b79b93f6\CREATE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_none_4c8d95d6b79b93f6\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.22230_none_35c20672d1410d09\CREATE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.22230_none_35c20672d1410d09\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\CHOOSE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\MANAGE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\MANAGE~2.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\CHOOSE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\MANAGE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\MANAGE~2.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\CHOOSE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\MANAGE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\MANAGE~2.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\CHOOSE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~1.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~2.ASP Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\CHOOSE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~2.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\PROVID~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\CHOOSE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~2.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\PROVID~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\CHOOSE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~2.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\PROVID~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.16720_none_b103fb905f6db0d9\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.20883_none_9a3c1234790ff5cc\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.18111_none_b0dee0465fbfbd7a\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.22230_none_9a1350e27965368d\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~2.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~3.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~4.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI1344~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI5BF5~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~2.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~3.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~4.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI1344~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI5BF5~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~2.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~3.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~4.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI1344~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI5BF5~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_e2c358ab062e054b\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_cbfb6f4f1fd04a3e\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_e29e3d61068011ec\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_cbd2adfd20258aff\WEB_MI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6000.16720_none_879a188098bde787\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.0.6000.20883_none_70d22f24b2602c7a\CSCEXE~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\CHOOSE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~2.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\PROVID~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.0.6001.18111_none_87ae800b19ca9087\MANAGE~1.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.0.6001.18111_none_87ae800b19ca9087\MANAGE~2.RES Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~2.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~3.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~4.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI1344~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI5BF5~1.ASC Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_netfx-config_files_.._gacutil_exe_config_31bf3856ad364e35_6.0.6001.18111_none_9cf3b4d9d654a956\GACUTI~1.CON Status: Locked to the Windows API! Path: C:\Windows\winsxs\x86_policy.1.2.microsof..op.security.azroles_31bf3856ad364e35_6.0.6000.16386_none_ea83414c2e75b887\Microsoft.Interop.Security.AzRole s.config Status: Locked to the Windows API! Path: Processes ------------------- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1268 Status: Locked to the Windows API! SSDT ------------------- #: 078 Function Name: NtCreateThread Status: Hooked by "<unknown>" at address 0x9b5b54d4 #: 194 Function Name: NtOpenProcess Status: Hooked by "<unknown>" at address 0x9b5b54c0 #: 201 Function Name: NtOpenThread Status: Hooked by "<unknown>" at address 0x9b5b54c5 #: 334 Function Name: NtTerminateProcess Status: Hooked by "<unknown>" at address 0x9b5b54cf Stealth Objects ------------------- Object: Hidden Module [Name: msgsres.dll] Process: msnmsgr.exe (PID: 3944) Address: 0x66610000 Size: 11403264 Object: Hidden Module [Name: msgslang.14.0.8064.0206.dll] Process: msnmsgr.exe (PID: 3944) Address: 0x6e280000 Size: 372736 Object: Hidden Module [Name: msgrvsta.thm] Process: msnmsgr.exe (PID: 3944) Address: 0x71420000 Size: 20480 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x858fa1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_CREATE] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_CLOSE] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_READ] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_WRITE] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_SET_INFORMATION] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_QUERY_EA] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_SET_EA] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_SHUTDOWN] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_CLEANUP] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: fastfat, IRP_MJ_PNP] Process: System Address: 0x88b3e1f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_CREATE] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_CLOSE] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_READ] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_WRITE] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_CLEANUP] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: udfsЃ浍楓, IRP_MJ_PNP] Process: System Address: 0x8a3f01f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_CREATE] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_CLOSE] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_READ] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_WRITE] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_SHUTDOWN] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_POWER] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: cdrom薫, IRP_MJ_PNP] Process: System Address: 0x86b8a1f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_POWER] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_PNP] Process: System Address: 0x858f81f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_CREATE] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_CLOSE] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_POWER] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: usbuhci舳П牄ꀰ謆垨賄, IRP_MJ_PNP] Process: System Address: 0x86a471f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_CREATE] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_CLOSE] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_CLEANUP] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: Smb†І瑎湦܇$, IRP_MJ_PNP] Process: System Address: 0x885b51f8 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_CREATE] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_CLOSE] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_CLEANUP] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: netbt蛝, IRP_MJ_PNP] Process: System Address: 0x887f8500 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_CREATE] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_CLOSE] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_POWER] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: iScsiPrtП牄ꀰ謆䘘趫, IRP_MJ_PNP] Process: System Address: 0x86a8e1f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_CREATE] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_READ] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_WRITE] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_SHUTDOWN] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_CLEANUP] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_POWER] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: volmgr, IRP_MJ_PNP] Process: System Address: 0x84b351f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x86a581f8 Size: 121 Object: Hidden Code [Driver: msahci, IRP_MJ_POWER] Process: System Address: 0x858f91f8 Size: 121 Object: Hidden Code [Driver: msahci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x858f91f8 Size: 121 Object: Hidden Code [Driver: msahci, IRP_MJ_PNP] Process: System Address: 0x858f91f8 Size: 121 Object: Hidden Code [Driver: VClone, IRP_MJ_CREATE] Process: System Address: 0x86c861f8 Size: 121 Object: Hidden Code [Driver: VClone, IRP_MJ_CLOSE] Process: System Address: 0x86c861f8 Size: 121 Object: Hidden Code [Driver: VClone, IRP_MJ_POWER] Process: System Address: 0x86c861f8 Size: 121 Object: Hidden Code [Driver: VClone, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86c861f8 Size: 121 Object: Hidden Code [Driver: VClone, IRP_MJ_PNP] Process: System Address: 0x86c861f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_CREATE] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_CLOSE] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_READ] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_WRITE] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SET_INFORMATION] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_QUERY_EA] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SET_EA] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SHUTDOWN] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_CLEANUP] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SET_SECURITY] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_POWER] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_SET_QUOTA] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: mrxsmb㚸覼Ї慖獀訔掠評觓䩰䫑ܠ, IRP_MJ_PNP] Process: System Address: 0x88b901f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_CREATE] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_CLOSE] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_READ] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_WRITE] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_SET_INFORMATION] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_SHUTDOWN] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_CLEANUP] Process: System Address: 0x867861f8 Size: 121 Object: Hidden Code [Driver: cdfsП牄謆쐀ꆺ, IRP_MJ_PNP] Process: System Address: 0x867861f8 Size: 121 ==EOF== Dankeschön und Gruß, Siren |
Zitat:
Das kann ich absolut nicht einordnen. Beachte, dass eine Bereinigung nicht immer Erfolgreich sein kann und Du nur nach einem format c: die Garantie hast, dass der Albaner keinen Zugang zu Deinem PC mehr hat! |
:D Irgendwie haben sich da unergründliche Zeichen eingeschlichen. :D Sollte ich evt. nocheinmal scannen? Vll. würden die dann weggehen. Oder geht es um den Driver an sich? :D Ja,ich hab schon überlegt alles neu aufzuspielen. ^^ Aber ich denke ich warte erstmal ab, bin schon wieder ne ganze Zeit im Internet, und es hat sich noch nichts getan (zum Glück). Gruß |
Hatten wir schon CF angewendet? Wenn nicht, bitte mal machen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
http://saved.im/mtm0nzyzmzd5/cofi.jpg
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! |
Hier erstmal der CombiFix Scan-Log. ComboFix 10-04-28.08 - Wanja 29.04.2010 16:58:01.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3038.2236 [GMT 2:00] ausgeführt von:: c:\users\Wanja\Desktop\cofi.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ADS - Windows: deleted 48 bytes in 1 streams. (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1404076782-1682293008-319507863-500 c:\$recycle.bin\S-1-5-21-2411504786-2722078166-2254585214-500 c:\program files\Fast Browser Search c:\program files\Fast Browser Search\IE\1.bat c:\program files\Fast Browser Search\IE\about.html c:\program files\Fast Browser Search\IE\affid.dat c:\program files\Fast Browser Search\IE\basis.xml c:\program files\Fast Browser Search\IE\basis_br.xml c:\program files\Fast Browser Search\IE\basis_de.xml c:\program files\Fast Browser Search\IE\basis_en.xml c:\program files\Fast Browser Search\IE\basis_es.xml c:\program files\Fast Browser Search\IE\basis_fr.xml c:\program files\Fast Browser Search\IE\basis_it.xml c:\program files\Fast Browser Search\IE\basis_nr.xml c:\program files\Fast Browser Search\IE\basis_pt.xml c:\program files\Fast Browser Search\IE\basis_ru.xml c:\program files\Fast Browser Search\IE\basis_tr.xml c:\program files\Fast Browser Search\IE\BHO.dll c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe c:\program files\Fast Browser Search\IE\error.html c:\program files\Fast Browser Search\IE\fbsProtection.xml c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml c:\program files\Fast Browser Search\IE\search_de.bmp c:\program files\Fast Browser Search\IE\search_es.bmp c:\program files\Fast Browser Search\IE\search_fr.bmp c:\program files\Fast Browser Search\IE\search_it.bmp c:\program files\Fast Browser Search\IE\search_pt.bmp c:\program files\Fast Browser Search\IE\search_ru.bmp c:\program files\Fast Browser Search\IE\SearchAssistant.dll c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico c:\program files\Fast Browser Search\IE\SGPU.ico c:\program files\Fast Browser Search\IE\sgpUpdater.exe c:\program files\Fast Browser Search\IE\sgpUpdater.xml c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe c:\program files\Fast Browser Search\IE\tbhelper.dll c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js c:\program files\Fast Browser Search\IE\Toolbar Help.htm c:\program files\Fast Browser Search\IE\uninstall.exe c:\program files\Fast Browser Search\IE\uninstalSGP.exe c:\program files\Fast Browser Search\IE\uninstalSGPU.exe c:\program files\Fast Browser Search\IE\update.exe c:\program files\Fast Browser Search\IE\version.txt c:\program files\SGPSA c:\program files\SGPSA\SearchAssistant.dll c:\users\Wanja\AppData\Roaming\addon.dat . ((((((((((((((((((((((( Dateien erstellt von 2010-03-28 bis 2010-04-29 )))))))))))))))))))))))))))))) . 2010-04-27 18:08 . 2010-04-27 18:08 -------- d-----w- C:\_OTL 2010-04-26 13:27 . 2010-04-26 13:27 -------- d-----w- c:\users\Wanja\AppData\Roaming\Malwarebytes 2010-04-26 13:27 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-26 13:27 . 2010-04-27 12:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-26 13:27 . 2010-04-26 13:27 -------- d-----w- c:\programdata\Malwarebytes 2010-04-26 13:27 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-25 20:11 . 2010-04-28 19:30 -------- d-----w- c:\users\Wanja\AppData\Roaming\ICQ 2010-04-05 13:31 . 2010-04-05 13:31 233472 ----a-w- c:\windows\system32\REX Shared Library.dll 2010-04-05 13:31 . 2010-04-05 13:31 368640 ----a-w- c:\windows\system32\ReWire.dll 2010-04-05 13:26 . 2010-04-05 13:27 -------- d-----w- c:\programdata\Propellerhead Software 2010-04-05 13:26 . 2010-04-05 13:26 -------- d-----w- c:\users\Wanja\AppData\Roaming\Propellerhead Software . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-29 15:02 . 2008-01-21 07:15 628910 ----a-w- c:\windows\system32\perfh007.dat 2010-04-29 15:02 . 2008-01-21 07:15 127606 ----a-w- c:\windows\system32\perfc007.dat 2010-04-29 14:53 . 2009-10-20 04:21 0 ----a-w- c:\windows\system32\Access.dat 2010-04-29 14:53 . 2009-06-12 20:39 -------- d-----w- c:\users\Wanja\AppData\Roaming\Hamachi 2010-04-28 19:27 . 2009-04-21 10:46 48639 ----a-w- c:\programdata\nvModes.dat 2010-04-28 12:50 . 2009-03-20 01:20 -------- d-----w- c:\programdata\Norton 2010-04-27 18:08 . 2009-08-23 19:18 -------- d-----w- c:\program files\Ask.com 2010-04-25 18:23 . 2009-06-12 11:48 -------- d-----w- c:\users\Wanja\AppData\Roaming\Skype 2010-04-25 14:06 . 2009-06-12 11:52 -------- d-----w- c:\users\Wanja\AppData\Roaming\skypePM 2010-04-21 15:51 . 2009-06-12 21:54 214520 ----a-w- c:\windows\system32\PnkBstrB.exe 2010-04-18 14:16 . 2009-11-30 18:49 -------- d-----w- c:\program files\No23 Recorder 2010-03-30 09:50 . 2009-06-12 21:54 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-03-30 09:11 . 2009-06-12 13:58 -------- d-----w- c:\users\Wanja\AppData\Roaming\Xfire 2010-03-30 09:11 . 2009-06-12 13:58 -------- d-----w- c:\programdata\Xfire 2010-03-29 13:31 . 2010-03-30 09:11 6319632 ----a-w- c:\programdata\Xfire\123.exe 2010-03-19 08:22 . 2009-06-25 14:49 680 ----a-w- c:\users\Wanja\AppData\Local\d3d9caps.dat 2010-03-19 08:06 . 2009-06-12 11:21 588472 ----a-w- c:\windows\system32\ezsvc7x.dll 2010-03-17 19:18 . 2010-02-14 14:43 -------- d-----w- c:\users\Wanja\AppData\Roaming\DivX 2010-03-08 18:25 . 2010-03-08 18:25 317760 ----a-w- c:\users\Public\RemoveSGP0.exe 2010-03-05 00:11 . 2010-03-05 00:11 41872 ----a-w- c:\windows\system32\xfcodec.dll 2010-02-24 08:16 . 2009-10-02 16:07 181632 ------w- c:\windows\system32\MpSigStub.exe 2010-02-21 12:21 . 2009-11-28 12:56 1 ----a-w- c:\users\Wanja\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-08-19 08:43 . 2009-08-19 08:43 336 ----a-w- c:\program files\setup.ini 2002-03-11 09:06 . 2002-03-11 09:06 1822520 ----a-w- c:\program files\instmsiw.exe 2002-03-11 08:45 . 2002-03-11 08:45 1708856 ----a-w- c:\program files\instmsia.exe 2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmpcSys"="c:\program files\PACKARD BELL\SetupMyPC\SmpSys.exe" [2009-03-18 1160736] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-12 68856] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] "AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-11-11 3124160] "ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2009-11-16 172792] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "{B7A00906-FC95-2A68-11D1-83169E2B26EB}"="c:\users\Wanja\AppData\Roaming\Micos\Kernel39.exe" [2008-10-29 196331] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "BackupManagerTray"="c:\program files\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" [2009-03-09 250624] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-20 30192] "Acer ePower Management"="c:\program files\Packard Bell\Packard Bell PowerSave Solution\ePowerTray.exe" [2009-03-11 715296] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13605408] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 92704] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-24 6789664] "Camera Assistant Software"="c:\program files\Video Web Camera\traybar.exe" [2009-02-24 630784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-06 1430824] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2009-02-12 862728] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160] "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392] "H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-22 385024] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-28 149280] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-03-29 1086856] c:\users\Wanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000] Xfire.lnk - c:\spiele\Xfire\Xfire.exe [2010-3-5 3233168] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-10-3 599592] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-02 722416] R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2008-01-21 21504] R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800] R3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-03-20 30192] S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] S2 ePowerSvc;Acer ePower Service;c:\program files\PACKARD BELL\Packard Bell PowerSave Solution\ePowerSvc.exe [2009-03-11 666144] S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504] S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-05-06 1220608] S2 HamachiService;Hamachi Service;c:\program files\Hamachi\hamachi.exe [2009-10-03 599592] S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2009-03-09 44800] S2 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2009-09-16 666360] S3 CLEDX;Team H2O CLEDX service;c:\windows\system32\DRIVERS\cledx.sys [2005-05-09 33792] S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-09-03 223232] S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-09-24 3666432] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-01-22 52768] S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . Inhalt des "geplante Tasks" Ordners 2010-04-29 c:\windows\Tasks\User_Feed_Synchronization-{9DAAB002-0573-4F99-8191-F73EA9DB858C}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:24] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://ecosia.org/?cc=de&lang=de&nocookie=1 mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0409&m=easynote_lj65 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Save YouTube Video as MP3 - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab FF - ProfilePath - c:\users\Wanja\AppData\Roaming\Mozilla\Firefox\Profiles\5fnim5mp.default\ FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . - - - - Entfernte verwaiste Registrierungseinträge - - - - HKCU-Run-RGSC - c:\spiele\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe AddRemove-Age Of Pirates 1.41_is1 - c:\spiele\Age of Pirates - Caribbean Tales\unins000.exe AddRemove-Blitzkrieg 2 - c:\spiele\Blitzkkrieg\Uninstall\uninstall.exe AddRemove-Saiteninstrument-Stimmgerät für Open-Tunings (De~FEB13E95_is1 - c:\program files\Stimmgerät für Open-Tunings (Demoversion)\unins000.exe AddRemove-Steinberg Cubase SX v3.1.1.944 - c:\progra~1\STEINB~1\CUBASE~1\UNWISE.EXE AddRemove-{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4} - c:\spiele\Battlefield Heroes\uninstaller.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net Rootkit scan 2010-04-29 17:12 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_USERS\S-1-5-21-2411504786-2722078166-2254585214-1000\Software\SecuROM\License information*] "datasecu"=hex:f3,d1,0c,6a,fe,fd,3a,ed,98,91,90,aa,a0,58,59,b6,8a,8a,24,cc,d2, 5b,a1,99,00,43,01,f2,9a,89,4e,77,53,dc,8e,7b,be,6e,cc,b4,24,a7,13,52,74,59,\ "rkeysecu"=hex:cc,c2,01,52,e2,9f,50,f1,a0,d4,a5,59,78,5a,21,f1 . Zeit der Fertigstellung: 2010-04-29 17:16:57 ComboFix-quarantined-files.txt 2010-04-29 15:16 Vor Suchlauf: 14 Verzeichnis(se), 66.399.289.344 Bytes frei Nach Suchlauf: 19 Verzeichnis(se), 66.358.374.400 Bytes frei - - End Of File - - D669438EB5BB6DA69898988657655E7F CCleaner kommt gleich :D Gruß |
CCleaner hab ich auch durchgeführt wie beschrieben. Hat alles super geklappt. :) Jetzt hab ich noch ne Frage: Wärs ratsam mir ein besseres Anti-Virenprogramm zu kaufen? :confused: Gruß |
Zitat:
Auch ist die Schutzwirkung einer Bezahlversion nicht unbedingt besser, Du musst auch wissen, dass ein Virenscanner nur ein kleiner Teil des Sicherheitskonzept ist: wichtiger als der Virenscanner ist zB das regelmäßig Einspielen von Updates und Anfertigen von Backups, Nutzen von eingeschränkter Rechte usw. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! |
Jetzt hab ich noch ne Frage: Wärs ratsam mir ein besseres Anti-Virenprogramm zu kaufen? Also ich habe momentan Windows Defender Avira Antivir Professional und Microsofrt SE(security essentials) auf meinem laptop^^ klappt alles wunderbar werden beim downloaden schon sofort erkannt ob viren oder anderweitig böse dateien drin sind. alle 3 sind freeware kannst dich ja mal erkundigen ob diese für dich ausreichen :P P.S habe diese jetzt auch auf meinem rechner nach der bösen attacke ^^ |
Zitat:
http://www.malte-wetz.de/wiki/pmwiki.php/De/KompromittierungUnvermeidbar http://www.oschad.de/wiki/Virenscanner |
@ ich appeliere schon an den menschlichen verstand das man nicht wahllos auf irgendwelche seiten geht und da einfach alles downloaded was geht^^ aber du hast recht ich habe mich ein bisschen zu allgemein ausgedrückt :P |
Guten Tag. :) Hier is dann mal der SUPERAntiSpyware-Scan. Muss ich die Dateien in der Quarantäne löschen? SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 04/29/2010 at 10:51 PM Application Version : 4.36.1006 Core Rules Database Version : 4867 Trace Rules Database Version: 2679 Scan type : Complete Scan Total Scan Time : 03:24:17 Memory items scanned : 745 Memory threats detected : 0 Registry items scanned : 7892 Registry threats detected : 26 File items scanned : 248686 File threats detected : 11 Adware.Tracking Cookie C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@sevenoneintermedia.112.2o7[1].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@bs.serving-sys[1].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@ad.yieldmanager[2].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@ar.atwola[1].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@content.yieldmanager[2].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@atwola[1].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@serving-sys[2].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@content.yieldmanager[3].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@tradedoubler[2].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@doubleclick[1].txt C:\Users\Wanja\AppData\Roaming\Microsoft\Windows\Cookies\wanja@ad.adnet[1].txt Browser Hijacker.Deskbar HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10} HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0 HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0 HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0\win32 HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\FLAGS HKCR\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\HELPDIR HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B} HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid32 HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib#Version HKCR\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A} HKCR\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\ProxyStubClsid HKCR\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\ProxyStubClsid32 HKCR\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\TypeLib HKCR\Interface\{9EBB289A-2D7B-465B-825F-1530B813E95A}\TypeLib#Version HKCR\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF} HKCR\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\ProxyStubClsid HKCR\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\ProxyStubClsid32 HKCR\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\TypeLib HKCR\Interface\{CD5C92AE-97B0-4BC3-BA65-BA0308D543BF}\TypeLib#Version HKCR\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F} HKCR\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}\ProxyStubClsid HKCR\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}\ProxyStubClsid32 HKCR\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}\TypeLib HKCR\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}\TypeLib#Version Gruß, Siren P.S.: Malwarebytes kommt gleich, also in ca. 2 Stunden. :D |
Ja, bitte alles entfernen. |
Nabend. Malwarebytes is auch fertig, hat allerdings nichts bösartiges gefunden. :applaus: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4054 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 30.04.2010 19:03:02 mbam-log-2010-04-30 (19-03-02).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 367932 Laufzeit: 2 Stunde(n), 4 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Könnte ich sonst noch was tuen? Gruß, Siren |
Ok. Wenn der Rechner wieder normal läuft bitte die Updates prüfen. Anscheinend fehlt das min. das SP2 für Vista. Und auch der IE8 fehlt, auch wenn man ihn nicht nutzt sollte er installiert werden. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 17:15 Uhr. |
Copyright ©2000-2025, Trojaner-Board