| Kennybwoy | 28.07.2010 17:59 |
TR/PSW.Papras.AB -#2
Habe mir diesen "TR/PSW.Papras.AB" Trojaner eingefangen. In einem anderen aktuellen Thread gabs dazu schon ein paar Lösungsansätze, die ich hintereinander ausprobiert habe.
Hier der Malwarebytes Log Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4363
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
28.07.2010 14:53:28
mbam-log-2010-07-28 (14-53-28).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 133498
Laufzeit: 5 Minute(n), 12 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdpwr.exe -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Infizierte Dateien:
C:\resycled\boot.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Hier die OTL Logfile: Code:
OTL logfile created on: 28.07.2010 15:01:34 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Dokumente und Einstellungen\Ken\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 67,00% Memory free
3,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 465,75 Gb Total Space | 101,44 Gb Free Space | 21,78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: KENSEINPC
Current User Name: Ken
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2010.07.28 15:00:31 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ken\Desktop\OTL.exe
PRC - [2010.06.23 15:01:59 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2010.06.23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2010.06.23 13:51:30 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010.05.26 15:35:18 | 000,493,032 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2009.09.11 13:34:22 | 002,403,840 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2009.09.11 13:33:54 | 000,009,216 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2009.08.05 18:47:09 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.06.09 17:53:34 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.12 17:37:12 | 000,380,928 | ---- | M] (Bytemobile, Inc.) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Optimization Client\bmctl.exe
PRC - [2009.03.02 12:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.09.30 17:51:58 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2008.09.30 17:49:34 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.12.14 06:27:34 | 000,212,992 | ---- | M] (IDT, Inc.) -- c:\Programme\IDT\ECSXPV_5762_010208\WDM\stacsv.exe
PRC - [2007.12.14 06:26:40 | 000,413,696 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2006.07.23 16:55:10 | 001,585,152 | ---- | M] () -- C:\Programme\Multimedia Combo Set Driver\PS2USBKbdDrv.exe
PRC - [2006.01.07 15:01:28 | 000,307,200 | ---- | M] () -- C:\Programme\Multimedia Combo Set Driver\MouseDrv.exe
========== Modules (SafeList) ==========
MOD - [2010.07.28 15:00:31 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ken\Desktop\OTL.exe
MOD - [2010.05.26 15:35:24 | 000,640,488 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2009.07.12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009.07.12 01:09:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
MOD - [2009.07.08 11:58:18 | 001,507,328 | ---- | M] () -- C:\WINDOWS\system32\nview.dll
MOD - [2009.07.08 11:58:18 | 000,311,296 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvwrsde.dll
MOD - [2009.07.08 11:58:12 | 000,081,920 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvwddi.dll
MOD - [2008.04.14 04:21:06 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)
SRV - File not found [On_Demand | Stopped] -- C:\Programme\Windows Live\Messenger\usnsvc.exe -- (usnjsvc)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.06.23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010.05.26 15:35:18 | 000,493,032 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2009.09.11 13:33:54 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2009.08.05 18:47:09 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.06.09 17:53:34 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.08.17 10:40:50 | 000,217,088 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\PS3 Media Server\win32\service\wrapper.exe -- (PS3 Media Server)
SRV - [2007.12.14 06:27:34 | 000,212,992 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Programme\IDT\ECSXPV_5762_010208\WDM\stacsv.exe -- (STacSV)
========== Driver Services (SafeList) ==========
DRV - [2010.05.26 15:35:10 | 000,026,352 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2010.05.13 10:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009.12.07 16:40:08 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.07.08 10:07:00 | 007,967,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2009.06.29 19:00:50 | 000,112,640 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009.06.29 19:00:50 | 000,102,656 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2009.06.29 01:36:36 | 000,017,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2009.06.09 17:53:34 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.28 14:42:42 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.04.09 14:38:30 | 000,102,400 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.12.21 14:24:14 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008.11.26 10:28:49 | 000,027,904 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ndisprot.sys -- (Ndisprot)
DRV - [2008.10.09 14:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008.05.02 11:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008.05.02 10:58:14 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2008.04.13 18:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.01.03 16:10:16 | 000,105,856 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007.12.14 06:28:20 | 001,270,872 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005.05.24 16:01:16 | 000,077,040 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w800obex.sys -- (w800obex)
DRV - [2005.05.24 16:00:56 | 000,079,216 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w800mgmt.sys -- (w800mgmt)
DRV - [2005.05.24 16:00:46 | 000,087,424 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w800mdm.sys -- (w800mdm)
DRV - [2005.05.24 16:00:44 | 000,006,096 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w800mdfl.sys -- (w800mdfl)
DRV - [2005.05.24 16:00:37 | 000,052,384 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w800bus.sys -- (w800bus) Sony Ericsson W800 driver (WDM)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\URLSearchHook: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Programme\ZoneAlarm\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "ZoneAlarm Customized Web Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd}:2.6.0.15
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&q="
FF - prefs.js..network.proxy.backup.ftp: "128.208.4.197"
FF - prefs.js..network.proxy.backup.ftp_port: 3128
FF - prefs.js..network.proxy.backup.gopher: "128.208.4.197"
FF - prefs.js..network.proxy.backup.gopher_port: 3128
FF - prefs.js..network.proxy.backup.socks: "128.208.4.197"
FF - prefs.js..network.proxy.backup.socks_port: 3128
FF - prefs.js..network.proxy.backup.ssl: "128.208.4.197"
FF - prefs.js..network.proxy.backup.ssl_port: 3128
FF - prefs.js..network.proxy.ftp: "128.135.11.151"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "128.135.11.151"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.http: "128.135.11.151"
FF - prefs.js..network.proxy.http_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "128.135.11.151"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "128.135.11.151"
FF - prefs.js..network.proxy.ssl_port: 3124
FF - HKLM\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Programme\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2010.03.22 17:40:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2010.06.30 17:56:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.24 22:01:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.24 22:01:50 | 000,000,000 | ---D | M]
[2008.11.05 21:11:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Extensions
[2010.07.23 17:59:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Firefox\Profiles\ldm1i4a0.default\extensions
[2010.04.30 15:35:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Firefox\Profiles\ldm1i4a0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.06.30 14:40:00 | 000,000,000 | ---D | M] (ZoneAlarm Toolbar) -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Firefox\Profiles\ldm1i4a0.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}
[2010.06.08 23:00:34 | 000,000,921 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Firefox\Profiles\ldm1i4a0.default\searchplugins\conduit.xml
[2008.12.21 14:27:54 | 000,000,523 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Mozilla\Firefox\Profiles\ldm1i4a0.default\searchplugins\daemon-search.xml
[2010.07.23 17:59:50 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.04.22 12:53:26 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.22 12:53:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.22 12:53:27 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.22 12:53:27 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.22 12:53:27 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Programme\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Burn4Free Toolbar Helper) - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll File not found
O2 - BHO: (WEB.DE Browser Configuration by mquadr.at) - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\WINDOWS\system32\ieconfig_1und1.dll (mquadr.at softwareengineering und consulting gmbh)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll File not found
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Programme\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD} - C:\Programme\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [C:\WINDOWS\system32\kdpwr.exe] C:\WINDOWS\System32\kdpwr.exe File not found
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [MobileConnect] C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [WireLessKeyboard] C:\Programme\Multimedia Combo Set Driver\StartAutorun.exe PS2USBKbdDrv.exe File not found
O4 - HKLM..\Run: [WireLessMouse] C:\Programme\Multimedia Combo Set Driver\StartAutorun.exe MouseDrv.exe File not found
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [MsnMsgr] C:\Programme\Windows Live\Messenger\MsnMsgr.Exe File not found
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103472 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; Mozilla\4.0 (compatible; MSIE 8.0; Win32; WEB.DE); GTB6.5; Mozilla\4.0 ( File not found
O4 - Startup: C:\Dokumente und Einstellungen\Ken\Startmenü\Programme\Autostart\OpenOffice.org 3.0.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1225878680111 (WUWebControl Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Ken\Eigene Dateien\Eigene Bilder\amazing\artest-245x300.png
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.10.14 14:17:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{38796caa-d349-11dd-81cf-001e90efe6d4}\Shell - "" = AutoRun
O33 - MountPoints2\{38796caa-d349-11dd-81cf-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{38796caa-d349-11dd-81cf-001e90efe6d4}\Shell\Open\command - "" = E:\resycled\boot.com -- File not found
O33 - MountPoints2\{44cd63c4-a415-11dd-9e99-001e90efe6d4}\Shell - "" = AutoRun
O33 - MountPoints2\{44cd63c4-a415-11dd-9e99-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{44cd63c4-a415-11dd-9e99-001e90efe6d4}\Shell\AutoRun\command - "" = E:\laucher.exe -- File not found
O33 - MountPoints2\{95156ef5-359e-11df-a755-001e90efe6d4}\Shell - "" = AutoRun
O33 - MountPoints2\{95156ef5-359e-11df-a755-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{95156ef5-359e-11df-a755-001e90efe6d4}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe -- File not found
O33 - MountPoints2\{95157318-359e-11df-a755-001e90efe6d4}\Shell - "" = AutoRun
O33 - MountPoints2\{95157318-359e-11df-a755-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{95157318-359e-11df-a755-001e90efe6d4}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe -- File not found
O33 - MountPoints2\{951577c6-359e-11df-a755-001e90efe6d4}\Shell - "" = AutoRun
O33 - MountPoints2\{951577c6-359e-11df-a755-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{951577c6-359e-11df-a755-001e90efe6d4}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe -- File not found
O33 - MountPoints2\{fd5e02c6-bb8d-11dd-9ec6-001e90efe6d4}\Shell - "" = Autorun
O33 - MountPoints2\{fd5e02c6-bb8d-11dd-9ec6-001e90efe6d4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fd5e02c6-bb8d-11dd-9ec6-001e90efe6d4}\Shell\Open\command - "" = F:\resycled\boot.com -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: pingol32 - (C:\WINDOWS\system32\dwwiinfo.dll) - C:\WINDOWS\system32\dwwiinfo.dll ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (65878699467079680)
========== Files/Folders - Created Within 90 Days ==========
[2010.07.28 15:00:31 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ken\Desktop\OTL.exe
[2010.07.28 14:46:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Malwarebytes
[2010.07.28 14:46:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.07.28 14:46:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.07.28 14:46:30 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.07.28 14:46:29 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.07.28 14:44:04 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Ken\Desktop\mbam-setup-1.46.exe
[2010.07.27 18:59:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\Love Parade Masses In Motion
[2010.07.26 15:30:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\TNA.iMPACT.2010.07.08.HDTV.XViD-KYR.0299.DedicatedTV.net.part1
[2010.07.22 21:14:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\immersion mp3
[2010.07.19 22:40:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\WWE.Money.In.The.Bank.2010
[2010.07.18 23:08:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\Best of Smackdown
[2010.07.18 12:40:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\cache
[2010.07.17 12:55:22 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Adobe
[2010.07.17 12:55:22 | 000,000,000 | ---D | C] -- C:\Programme\Adobe
[2010.07.17 12:54:23 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.06.30 14:39:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm
[2010.06.30 14:39:56 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.06.30 14:39:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.06.30 14:39:55 | 000,000,000 | ---D | C] -- C:\Programme\ZoneAlarm
[2010.06.14 19:06:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Desktop\NBA.2010.Finals.Game.5.Lakers.vs.Celtics.HDTV.XviD-FQM.a79c.DedicatedTV.net.part1
[2010.05.29 02:35:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Apple Computer
[2010.05.07 15:08:01 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.05.07 15:07:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
[2010.05.07 15:07:39 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Apple
[2010.05.07 15:07:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\Apple
[2010.05.07 15:07:28 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2010.05.07 15:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
[2010.05.07 15:07:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\Apple Computer
[2010.05.03 22:10:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ken\.dvdcss
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 90 Days ==========
[2010.07.28 15:00:44 | 007,864,320 | -H-- | M] () -- C:\Dokumente und Einstellungen\Ken\NTUSER.DAT
[2010.07.28 15:00:31 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Ken\Desktop\OTL.exe
[2010.07.28 14:59:45 | 001,042,054 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.07.28 14:59:45 | 000,448,470 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.07.28 14:59:45 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.07.28 14:59:45 | 000,079,910 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.07.28 14:59:45 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.07.28 14:55:38 | 000,231,949 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.07.28 14:55:34 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.28 14:55:33 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.28 14:55:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.28 14:55:27 | 1609,814,016 | -HS- | M] () -- C:\hiberfil.sys
[2010.07.28 14:54:49 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Ken\ntuser.ini
[2010.07.28 14:53:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.28 14:44:04 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Ken\Desktop\mbam-setup-1.46.exe
[2010.07.27 23:51:44 | 000,000,414 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F05407B7-CBCB-48A7-BEA4-7F82C2A87F12}.job
[2010.07.27 20:44:34 | 090,109,808 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\PIE34-Hazard_Sub-Zero_Original-Sin_Majistrate_Sly.mp3
[2010.07.27 17:24:41 | 000,146,944 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.27 14:21:19 | 813,772,397 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\USA.Basketball.Showcase.2010.7.24.Blue.vs.White.x264.mp4
[2010.07.27 00:19:24 | 084,940,635 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\BRYANGEE-D_BTVLIVE107-7JULY2010.mp3
[2010.07.26 15:45:57 | 028,579,027 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Need_For_Mirrors_-_Breakbeat.co.uk_Podcast.mp3
[2010.07.26 14:22:16 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.25 14:37:13 | 000,047,104 | ---- | M] () -- C:\WINDOWS\System32\dwwiinfo.dll
[2010.07.25 05:23:38 | 086,533,100 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\DJHazard-LiveatDieselClub_Budapest_2010.07.03..mp3
[2010.07.24 22:59:08 | 030,355,487 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\01-pendulum_-_live_at_space__ibiza_-sat-07-13-2010-talion.mp3
[2010.07.22 13:18:58 | 074,055,615 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Rusher_live_at_Retaliation_3rd_July_2010.mp3
[2010.07.17 12:56:22 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk
[2010.07.08 22:24:54 | 100,818,274 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Neurovs.JumpUp_Wobble-July2010.mp3
[2010.06.30 14:40:23 | 000,421,442 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.06.30 14:18:02 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.06.30 14:18:02 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\ZoneAlarm Security.lnk
[2010.06.29 12:39:47 | 000,174,239 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Eigene Dateien\BuzzerBeater Berlin Haze Spielerkader.htm
[2010.06.29 12:30:11 | 000,002,533 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Vodafone Mobile Connect.lnk
[2010.06.26 00:20:46 | 085,320,768 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\DjHype_Kiss100_2010_06_24_qrip.mp3
[2010.06.17 04:16:16 | 057,640,396 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Desktop\HAZARDBREAKINSCIENCENORTHVSSOUTH.mp3
[2010.06.11 00:24:35 | 000,112,584 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.11 00:08:48 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.05.28 13:21:45 | 001,802,397 | ---- | M] () -- C:\Dokumente und Einstellungen\Ken\Eigene Dateien\berhaz.ods
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010.07.27 20:44:30 | 090,109,808 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\PIE34-Hazard_Sub-Zero_Original-Sin_Majistrate_Sly.mp3
[2010.07.27 14:18:06 | 813,772,397 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\USA.Basketball.Showcase.2010.7.24.Blue.vs.White.x264.mp4
[2010.07.26 21:38:22 | 084,940,635 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\BRYANGEE-D_BTVLIVE107-7JULY2010.mp3
[2010.07.26 15:45:55 | 028,579,027 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Need_For_Mirrors_-_Breakbeat.co.uk_Podcast.mp3
[2010.07.24 22:58:43 | 086,533,100 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\DJHazard-LiveatDieselClub_Budapest_2010.07.03..mp3
[2010.07.24 21:25:43 | 030,355,487 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\01-pendulum_-_live_at_space__ibiza_-sat-07-13-2010-talion.mp3
[2010.07.24 12:12:47 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\dwwiinfo.dll
[2010.07.22 13:18:53 | 074,055,615 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Rusher_live_at_Retaliation_3rd_July_2010.mp3
[2010.07.17 12:55:38 | 000,001,709 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk
[2010.07.08 13:00:16 | 100,818,274 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\Neurovs.JumpUp_Wobble-July2010.mp3
[2010.06.29 12:39:47 | 000,174,239 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Eigene Dateien\BuzzerBeater Berlin Haze Spielerkader.htm
[2010.06.25 21:05:30 | 085,320,768 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\DjHype_Kiss100_2010_06_24_qrip.mp3
[2010.06.16 17:35:01 | 057,640,396 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Desktop\HAZARDBREAKINSCIENCENORTHVSSOUTH.mp3
[2010.05.28 13:21:34 | 001,802,397 | ---- | C] () -- C:\Dokumente und Einstellungen\Ken\Eigene Dateien\berhaz.ods
[2009.07.08 11:58:18 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009.07.08 11:58:18 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009.07.08 11:58:18 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009.07.08 11:58:18 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009.02.18 18:03:41 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2008.12.21 14:24:14 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008.12.11 17:10:11 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2008.10.28 19:05:37 | 000,000,297 | ---- | C] () -- C:\WINDOWS\thug2.ini
[2008.09.19 23:55:10 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.09.19 23:55:10 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008.09.19 23:54:18 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008.08.01 14:48:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008.06.11 02:07:20 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
========== LOP Check ==========
[2010.01.10 19:42:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AA3DeployClient
[2008.12.21 14:28:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.11.09 20:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverScanner
[2009.06.22 17:27:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2009.06.27 18:43:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IEConfiguration1und1
[2008.12.20 11:47:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
[2010.03.22 17:40:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2009.01.22 19:53:04 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\.#
[2008.11.05 18:42:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\2K Sports
[2010.06.10 00:37:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\BitTorrent
[2009.01.31 18:24:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Canneverbe_Limited
[2010.03.24 20:39:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\CheckPoint
[2008.12.21 14:29:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\DAEMON Tools
[2008.12.21 14:33:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\DAEMON Tools Lite
[2008.12.21 14:31:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\DAEMON Tools Pro
[2009.01.31 15:44:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\DeepBurner
[2008.11.25 13:54:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\OpenOffice.org
[2010.04.02 14:36:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\RayV
[2009.11.09 20:31:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Uniblue
[2009.04.05 02:22:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\uTorrent
[2010.03.22 17:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Vodafone
[2010.03.22 18:33:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ken\Anwendungsdaten\Vodafone Mobile Connect
[2010.07.27 23:51:44 | 000,000,414 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{F05407B7-CBCB-48A7-BEA4-7F82C2A87F12}.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2008.10.14 14:17:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2008.10.14 14:12:50 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2006.02.28 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2008.10.14 14:17:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010.07.28 14:55:27 | 1609,814,016 | -HS- | M] () -- C:\hiberfil.sys
[2008.10.14 14:17:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008.10.14 14:17:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2006.02.28 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008.11.08 10:04:27 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.07.28 14:55:26 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2010.07.25 14:37:13 | 000,047,104 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\dwwiinfo.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< %systemroot%\Tasks\*.job /lockedfiles >
< %systemroot%\System32\config\*.sav >
[2008.10.14 16:05:35 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008.10.14 16:05:35 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008.10.14 16:05:35 | 000,438,272 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
< %systemroot%\system32\drivers\*.sys /90 >
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbam.sys
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 04:22:32 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
|
