Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   HTML/Infected.WebPage.Gen2 (https://www.trojaner-board.de/98550-html-infected-webpage-gen2.html)

Schumacher 01.05.2011 11:53
HTML/Infected.WebPage.Gen2
 
Hallo zusammen,

ich habe folgenden Virus über AntiVir entdeckt und weiss nicht wo der herkommt.
--> HTML/Infected.WebPage.Gen2

Löschen unter AntiVir bringt leider nichts, der IE öffnet immer eine Werbeseite. Wenn ich meinen Laptop abmelde und zwar unter "Energie sparen" stürzt Windows mit "bluescreen" ab usw. Hab mir jetzt Malwarebytes gedownloadet und poste die Logdatei.

Ist der Rechner clean nachdem ich unter Malwarebytes die Viren gelöscht habe?
Sollte ich das System neu aufsetzen?
Wie sieht es mit Passwörtern im Netz aus? Alle nochmals neu vergeben?

Im Vorfeld vielen Dank!

Hier die Log-Datei:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6483

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

01.05.2011 12:43:03
mbam-log-2011-05-01 (12-43-03).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 186829
Laufzeit: 10 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Windows\System32\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Recycle.Bin\recycle.bin.exe (Trojan.SpyEyes) -> Quarantined and deleted successfully.
c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

cosinus 01.05.2011 16:17
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!


Danach OTL-Custom:


CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schumacher 01.05.2011 17:54
Ich hab mit Malwarebytes einen kompletten Scan durchgeführt mit folgendem Ergebnis:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6483

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

01.05.2011 18:36:59
mbam-log-2011-05-01 (18-36-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|Y:\|)
Durchsuchte Objekte: 454221
Laufzeit: 1 Stunde(n), 55 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Uwe\AppData\Roaming\Pyol\vopu.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
e:\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully.
y:\Arbeit\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully.

OTL-Quick-Scan bringt folgendes Ergebnis:OTL Logfile:
Code:
OTL logfile created on: 01.05.2011 18:43:03 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Schumacher\Desktop
Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 53,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 68,36 Gb Total Space | 26,06 Gb Free Space | 38,12% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 46,85 Gb Free Space | 68,53% Space Free | Partition Type: NTFS
Drive E: | 161,37 Gb Total Space | 140,56 Gb Free Space | 87,11% Space Free | Partition Type: NTFS
Drive G: | 569,83 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive I: | 697,98 Gb Total Space | 177,10 Gb Free Space | 25,37% Space Free | Partition Type: NTFS
Drive J: | 1,89 Gb Total Space | 1,79 Gb Free Space | 94,73% Space Free | Partition Type: FAT
Drive Y: | 249,94 Gb Total Space | 223,67 Gb Free Space | 89,49% Space Free | Partition Type: FAT32
 
Computer Name: LIFEBOOK | User Name: Schumacher | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe
PRC - [2011.03.24 15:21:01 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2009.03.19 19:14:14 | 002,521,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\Updater6\Adobe_Updater.exe
PRC - [2009.02.27 13:14:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2008.11.06 23:09:22 | 000,777,656 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SclStart.exe
PRC - [2008.10.15 14:31:50 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008.10.15 14:29:58 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.08.09 16:34:04 | 000,277,576 | ---- | M] () -- C:\Programme\SmartCase Logon+\Password Manager\SmartCaseServer.exe
PRC - [2008.08.09 16:33:54 | 000,237,568 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\logonuser.exe
PRC - [2008.08.09 16:33:54 | 000,098,388 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SmartyLog.exe
PRC - [2008.08.09 16:33:54 | 000,064,952 | ---- | M] (TODO: <Company name>) -- C:\Programme\SmartCase Logon+\System\SecureDriveInterface.exe
PRC - [2008.08.09 16:33:54 | 000,036,280 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SecuFil.exe
PRC - [2008.08.07 22:31:18 | 001,664,248 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\AtService.exe
PRC - [2008.08.07 22:31:18 | 000,124,152 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\ATSwpNav.exe
PRC - [2008.06.13 14:52:52 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.06.12 14:28:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.05.01 09:41:38 | 000,136,488 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008.05.01 09:40:44 | 003,032,360 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe
PRC - [2008.04.07 14:55:40 | 000,647,168 | ---- | M] (Fujitsu Computer Systems) -- C:\Programme\Fujitsu\Utils\FjMenu.exe
PRC - [2008.04.07 14:53:40 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjEvents.exe
PRC - [2008.04.07 14:53:02 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjDspMon.exe
PRC - [2008.01.21 04:25:55 | 000,198,656 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe
PRC - [2008.01.21 04:25:54 | 000,300,032 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2008.01.21 04:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.21 04:23:59 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.06.09 00:23:50 | 000,208,896 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMWDSrv.exe
PRC - [2007.06.08 11:19:22 | 000,397,312 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMCONFIG.exe
PRC - [2007.04.04 11:30:40 | 000,327,680 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMProcess.exe
PRC - [2007.03.06 14:51:14 | 000,212,992 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\StartAutorun.exe
PRC - [2006.11.07 15:45:38 | 000,097,072 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
PRC - [2005.11.11 11:49:50 | 000,204,800 | ---- | M] (National Instruments, Inc.) -- C:\Programme\National Instruments\shared\Security\nidmsrv.exe
PRC - [2005.11.11 11:46:58 | 000,053,248 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lktsrv.exe
PRC - [2005.11.11 11:46:56 | 000,045,056 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lkads.exe
PRC - [2005.11.01 00:58:54 | 000,005,728 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\MAX\nimxs.exe
PRC - [2005.10.10 15:08:32 | 000,049,152 | ---- | M] (National Instruments Corp.) -- C:\Windows\System32\nisvcloc.exe
PRC - [2005.09.22 18:16:08 | 000,005,728 | ---- | M] (National Instruments Corporation) -- C:\Windows\System32\nipalsm.exe
PRC - [2005.09.13 08:30:00 | 000,057,344 | ---- | M] (O2Micro International) -- C:\Windows\System32\o2flash.exe
PRC - [2005.08.25 14:43:14 | 000,688,190 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lkcitdl.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe
MOD - [2008.01.21 04:25:52 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2008.01.21 04:24:11 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2009.03.18 13:18:34 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.10.15 14:31:50 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008.10.15 14:29:58 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008.08.15 06:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)
SRV - [2008.08.09 16:34:04 | 000,277,576 | ---- | M] () [Auto | Running] -- C:\Programme\SmartCase Logon+\Password Manager\SmartCaseServer.exe -- (SmartCaseServer)
SRV - [2008.08.09 16:33:54 | 000,237,568 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\logonuser.exe -- (LogonUserService)
SRV - [2008.08.09 16:33:54 | 000,098,388 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\SmartyLog.exe -- (SmartyLogService)
SRV - [2008.08.09 16:33:54 | 000,064,952 | ---- | M] (TODO: <Company name>) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\SecureDriveInterface.exe -- (SecureDriveInterface)
SRV - [2008.08.09 16:33:54 | 000,036,280 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Programme\SmartCase Logon+\System\SecuFil.exe -- (SecuFil)
SRV - [2008.08.07 22:31:18 | 001,664,248 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Programme\Fingerprint Sensor\AtService.exe -- (ATService)
SRV - [2008.05.15 13:32:28 | 000,229,376 | ---- | M] (charismathics) [Auto | Stopped] -- C:\Windows\System32\cmTCSVista.exe -- (cmTCS Service)
SRV - [2008.05.01 09:40:44 | 003,032,360 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.06.09 00:23:50 | 000,208,896 | ---- | M] (UASSOFT.COM) [Auto | Running] -- C:\Programme\Trust\Trust R-Series Mouse\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2005.11.11 11:49:50 | 000,204,800 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService)
SRV - [2005.11.11 11:46:58 | 000,053,248 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lktsrv.exe -- (lkTimeSync)
SRV - [2005.11.11 11:46:56 | 000,045,056 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lkads.exe -- (lkClassAds)
SRV - [2005.11.02 14:56:48 | 000,913,408 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager)
SRV - [2005.11.01 00:58:54 | 000,005,728 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files\National Instruments\MAX\nimxs.exe -- (mxssvr)
SRV - [2005.10.10 15:08:32 | 000,049,152 | ---- | M] (National Instruments Corp.) [Auto | Running] -- C:\Windows\System32\nisvcloc.exe -- (niSvcLoc)
SRV - [2005.09.22 18:16:08 | 000,005,728 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\System32\nipalsm.exe -- (nipxirmu)
SRV - [2005.09.13 08:30:00 | 000,057,344 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\o2flash.exe -- (O2Flash)
SRV - [2005.08.25 14:43:14 | 000,688,190 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lkcitdl.exe -- (LkCitadelServer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.08.26 12:11:05 | 000,024,224 | ---- | M] (LUCAS-NÜLLE GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UNIUSB.sys -- (UniUsb)
DRV - [2010.05.04 16:30:14 | 000,012,532 | ---- | M] (Virtual Ink) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mimiousb.sys -- (mimio) Virtual Ink's mimio USB Adapter (mimiousb.sys)
DRV - [2009.10.21 22:43:40 | 000,223,432 | ---- | M] (TrueCrypt Foundation) [Kernel | Disabled | Running] -- I:\Portable_TrueCrypt_6.3\truecrypt.sys -- (truecrypt)
DRV - [2009.05.27 15:32:28 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.05.27 15:32:27 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2009.05.27 15:32:25 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2008.08.21 16:35:00 | 000,034,816 | ---- | M] (iC ComPas GmbH & Co KG ) [Kernel | System | Running] -- C:\Windows\System32\drivers\fcrimg4.sys -- (fcrimg4)
DRV - [2008.08.09 16:33:54 | 000,046,512 | ---- | M] (Siemens AG) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\smsw.sys -- (smsw)
DRV - [2008.06.30 06:52:26 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008.06.26 07:30:50 | 003,662,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008.06.17 14:16:22 | 000,476,672 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV - [2008.06.12 03:23:00 | 000,101,848 | ---- | M] (O2Micro) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ozscr.sys -- (O2SCBUS)
DRV - [2008.05.15 10:30:38 | 000,012,160 | ---- | M] (Fujitsu Siemens Computers) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FscGabi.sys -- (FscGabi)
DRV - [2008.05.12 21:20:46 | 000,011,392 | ---- | M] (Fujitsu Siemens Computers) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FscBapi.sys -- (FscBapi)
DRV - [2008.03.27 12:39:58 | 000,224,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1y6032.sys -- (e1yexpress) Intel(R)
DRV - [2008.03.27 05:21:34 | 000,030,888 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wisdpen.sys -- (WISDPen)
DRV - [2008.03.12 09:16:00 | 000,041,560 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2sd.sys -- (O2SDRDR)
DRV - [2008.03.02 20:34:00 | 000,018,944 | ---- | M] (Fujitsu Computer Systems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FjBtnDrv.sys -- (Fjbtndrv)
DRV - [2008.02.05 02:23:00 | 000,047,448 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
DRV - [2008.01.21 04:23:46 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2008.01.15 06:11:46 | 000,013,480 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2007.11.08 19:03:26 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007.10.31 12:23:00 | 000,124,960 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.09.29 14:30:52 | 000,065,024 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID)
DRV - [2007.03.29 15:00:16 | 000,017,024 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KMWDFilter.SYS -- (KMWDFilter)
DRV - [2007.02.16 05:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2007.02.15 10:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVKHid.sys -- (WacomVKHid)
DRV - [2006.11.01 20:59:24 | 000,005,632 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02e3.sys -- (FUJ02E3)
DRV - [2006.11.01 20:20:28 | 000,005,888 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02b1.sys -- (FUJ02B1)
DRV - [2005.10.18 11:00:00 | 000,004,096 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2005.10.12 18:13:56 | 000,008,704 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViFWK.sys -- (NiViFWK)
DRV - [2005.10.12 18:07:32 | 000,038,400 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiUsbTmc.sys -- (NIUSBTMC)
DRV - [2005.10.12 18:04:28 | 000,010,752 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViPxiK.sys -- (NiViPxiK)
DRV - [2005.10.12 18:04:26 | 000,037,376 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViPciK.sys -- (NiViPciK)
DRV - [2005.10.06 17:22:48 | 000,038,912 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\niorbk.dll -- (niorbk)
DRV - [2005.09.28 22:14:02 | 000,141,824 | ---- | M] (National Instruments Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nidimk.dll -- (nidimk)
DRV - [2005.09.22 22:12:08 | 000,531,968 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipalk.sys -- (NIPALK)
DRV - [2005.09.21 12:30:46 | 000,055,296 | ---- | M] (National Instruments Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nipxirmk.dll -- (nipxirmk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.14 22:10:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.24 15:21:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.08.15 10:17:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011.04.30 21:56:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schumacher\AppData\Roaming\mozilla\Extensions
[2011.04.30 21:56:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schumacher\AppData\Roaming\mozilla\Firefox\Profiles\b0634jkp.default\extensions
[2011.04.29 20:35:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.01.13 19:13:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009.03.10 22:46:31 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009.03.29 20:30:43 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2011.01.13 19:13:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2005.10.12 16:04:02 | 000,020,480 | ---- | M] (National Instruments) -- C:\Programme\Mozilla Firefox\plugins\NPLV80Win32.dll
[2011.03.04 22:54:36 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.04 22:54:36 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.04 22:54:36 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.04 22:54:36 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.04 22:54:36 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (SingleSignOn Class) - {37B109B0-E817-4072-8429-EDC6A987FCE3} - C:\Programme\SmartCase Logon+\Password Manager\SmartCaseBho.dll ()
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Programme\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATSwpNav] C:\Program Files\Fingerprint Sensor\ATSwpNav.exe (AuthenTec, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [FjStrtAp] C:\Programme\Fujitsu\Utils\FjStrtAp.exe (Fujitsu Computer Systems Corp.)
O4 - HKLM..\Run: [IndicatorUtility] C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SclStart.exe] C:\Programme\SmartCase Logon+\System\SclStart.exe (iC ComPas GmbH & Co KG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching__ = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.06.18 23:12:18 | 000,000,088 | ---- | M] () - G:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{08a3f3d0-0f54-11df-92cf-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{08a3f3d0-0f54-11df-92cf-806e6f6e6963}\Shell\AutoRun\command - "" = G:\WD SmartWare.exe -- [2009.09.05 00:20:42 | 002,770,208 | ---- | M] (Western Digital)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {41B797EC-43A3-993D-BDAB-9885C8F10F2E} - Internet Explorer
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9DC813BB-0835-5D87-D2C6-FD0CC436DC8C} - Microsoft Windows Media Player 11.0
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {FD141BEA-0352-F89C-5C2A-59708D8978E3} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.01 18:41:28 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe
[2011.05.01 13:34:16 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Microsoft Help
[2011.05.01 12:31:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Malwarebytes
[2011.05.01 12:31:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.01 12:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.01 12:31:23 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.01 12:31:23 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.04.30 23:00:49 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Talkback
[2011.04.30 23:00:40 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird
[2011.04.30 23:00:40 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Thunderbird
[2011.04.30 22:43:18 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\VirtualStore
[2011.04.30 21:57:18 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Macromedia
[2011.04.30 21:56:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Mozilla
[2011.04.30 21:56:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Mozilla
[2011.04.30 21:54:26 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings
[2011.04.30 21:42:12 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Apple Computer
[2011.04.30 21:42:12 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Adobe
[2011.04.30 21:41:43 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Adobe
[2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Searches
[2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.04.30 21:41:29 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Identities
[2011.04.30 21:41:28 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Contacts
[2011.04.30 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\WTablet
[2011.04.30 21:41:22 | 000,000,000 | --SD | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Videos
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Saved Games
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Pictures
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Music
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Links
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Favorites
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Downloads
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Documents
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Desktop
[2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Vorlagen
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Verlauf
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Temporary Internet Files
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Startmenü
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\SendTo
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Recent
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Netzwerkumgebung
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Lokale Einstellungen
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Videos
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Musik
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Eigene Dateien
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Bilder
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Druckumgebung
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Cookies
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Anwendungsdaten
[2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Anwendungsdaten
[2011.04.30 21:41:22 | 000,000,000 | -H-D | C] -- C:\Users\Schumacher\AppData
[2011.04.30 21:41:22 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Temp
[2011.04.30 21:41:22 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Microsoft
[2011.04.13 22:55:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinFACT 8
[2011.04.13 22:55:19 | 000,000,000 | ---D | C] -- C:\Programme\Kahlert
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.01 18:44:59 | 000,000,414 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7FDEF06A-4FD4-4AFE-89EB-22B248A9C822}.job
[2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe
[2011.05.01 18:37:39 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\xhyfls.sys
[2011.05.01 18:35:23 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.01 18:35:23 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.01 15:33:59 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.01 15:33:59 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.01 15:33:59 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.01 15:33:59 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.01 13:23:16 | 000,001,024 | ---- | M] () -- C:\Users\Schumacher\.rnd
[2011.05.01 13:23:16 | 000,001,024 | ---- | M] () -- C:\.rnd
[2011.05.01 13:21:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.01 13:21:45 | 3156,074,496 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.01 13:21:44 | 311,110,518 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.05.01 13:19:28 | 000,003,538 | ---- | M] () -- C:\Users\Schumacher\AppData\Roaming\FjMenu1.XML
[2011.05.01 12:31:29 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.01 00:01:15 | 000,000,183 | ---- | M] () -- C:\Users\Schumacher\Desktop\GDS2 (Y) - Verknüpfung.lnk
[2011.04.30 23:44:31 | 000,000,704 | ---- | M] () -- C:\Users\Schumacher\Desktop\_mounten_link.lnk
[2011.04.30 23:44:31 | 000,000,650 | ---- | M] () -- C:\Users\Schumacher\Desktop\_trennen_link.lnk
[2011.04.30 22:40:14 | 000,000,466 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011.04.29 15:39:00 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.04.26 17:13:56 | 000,000,227 | ---- | M] () -- C:\Windows\FTRUN32.INI
[2011.04.12 16:59:05 | 001,536,505 | ---- | M] () -- C:\Users\Public\Documents\KA Mechas.pdf
[2011.04.12 16:56:25 | 000,004,096 | -H-- | M] () -- C:\Users\Public\Documents\._sc00063f0b.pdf
[2011.04.08 20:28:31 | 000,090,024 | ---- | M] () -- C:\bar.emf
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.01 18:37:39 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\xhyfls.sys
[2011.05.01 13:23:16 | 000,001,024 | ---- | C] () -- C:\.rnd
[2011.05.01 12:31:29 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.01 00:01:15 | 000,000,183 | ---- | C] () -- C:\Users\Schumacher\Desktop\GDS2 (Y) - Verknüpfung.lnk
[2011.04.30 23:44:31 | 000,000,704 | ---- | C] () -- C:\Users\Schumacher\Desktop\_mounten_link.lnk
[2011.04.30 23:44:31 | 000,000,650 | ---- | C] () -- C:\Users\Schumacher\Desktop\_trennen_link.lnk
[2011.04.30 22:40:22 | 000,003,538 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\FjMenu1.XML
[2011.04.30 22:40:14 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.04.30 21:52:12 | 3156,074,496 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.30 21:41:46 | 000,001,024 | ---- | C] () -- C:\Users\Schumacher\.rnd
[2011.04.30 21:41:38 | 000,000,949 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.04.30 21:41:37 | 000,000,944 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.04.30 21:41:27 | 000,000,915 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011.04.12 16:56:25 | 001,536,505 | ---- | C] () -- C:\Users\Public\Documents\KA Mechas.pdf
[2011.04.12 16:56:25 | 000,004,096 | -H-- | C] () -- C:\Users\Public\Documents\._sc00063f0b.pdf
[2011.04.08 20:06:36 | 000,548,731 | ---- | C] () -- C:\Users\Public\Documents\Laufzettel.pdf
[2011.03.24 23:10:55 | 000,000,227 | ---- | C] () -- C:\Windows\FTRUN32.INI
[2011.01.28 10:18:01 | 000,000,059 | ---- | C] () -- C:\Windows\Mehrgewinnrechner.INI
[2010.11.04 22:59:28 | 000,087,612 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010.09.27 07:47:02 | 000,000,036 | ---- | C] () -- C:\Windows\bi_group.ini
[2010.08.15 16:36:18 | 000,164,166 | ---- | C] () -- C:\Windows\hpoins19.dat
[2010.08.15 16:35:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2010.05.22 09:08:09 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI
[2010.05.22 08:25:22 | 000,002,543 | ---- | C] () -- C:\Windows\basecad.ini
[2010.05.04 16:30:49 | 000,102,400 | ---- | C] () -- C:\Windows\System32\mimio_printer_resource.dll
[2010.05.03 14:34:50 | 000,000,032 | ---- | C] () -- C:\Windows\DVD_Start.INI
[2010.02.14 16:15:12 | 000,000,041 | ---- | C] () -- C:\Windows\zinsrechner.INI
[2010.02.14 16:14:28 | 000,000,070 | ---- | C] () -- C:\Windows\Skontorechner.INI
[2009.03.11 21:47:40 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.03.11 17:46:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.03.10 08:39:18 | 000,618,430 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.03.10 08:39:18 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.03.10 08:39:18 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.03.10 08:39:18 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.03.10 01:24:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.03.10 00:12:39 | 000,000,205 | ---- | C] () -- C:\Windows\hbcikrnl.ini
[2009.03.10 00:04:58 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009.03.10 00:04:49 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1518.dll
[2009.03.10 00:04:49 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2009.03.10 00:04:48 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2009.03.10 00:04:48 | 000,495,376 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2009.03.10 00:04:48 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin
[2008.08.09 16:33:54 | 000,258,048 | ---- | C] () -- C:\Windows\System32\SCINF.dll
[2008.08.09 16:33:54 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SCTPM.dll
[2008.01.21 04:25:51 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2008.01.21 04:24:41 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 14:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:43 | 002,203,184 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 12:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2005.10.18 11:00:00 | 000,004,096 | ---- | C] () -- C:\Windows\System32\drivers\cvintdrv.sys
[2005.09.28 17:26:34 | 000,000,244 | ---- | C] () -- C:\Windows\System32\nirpc.ini
[2005.09.22 22:11:56 | 000,003,584 | ---- | C] () -- C:\Windows\System32\nipalpg.dll
[2004.07.26 11:00:00 | 000,102,400 | ---- | C] () -- C:\Windows\System32\cviUSI.dll
[2004.07.15 15:35:14 | 000,143,360 | ---- | C] () -- C:\Windows\System32\CleanupUtility.exe
[1999.11.15 12:58:52 | 000,028,672 | ---- | C] () -- C:\Windows\NIRegApp.exe
[1998.10.02 13:02:46 | 000,060,416 | ---- | C] () -- C:\Windows\System32\Opcenum.exe
[1998.03.11 22:15:52 | 000,025,600 | ---- | C] () -- C:\Windows\System32\CBNDLL.DLL
[1998.03.11 22:00:30 | 000,015,408 | ---- | C] () -- C:\Windows\System32\CB560WIN.DLL
[1997.01.29 17:53:26 | 000,240,640 | ---- | C] () -- C:\Windows\System32\NMOCOD.DLL
[1997.01.15 13:33:46 | 000,009,216 | ---- | C] () -- C:\Windows\System32\CBNVDD.DLL
 
========== LOP Check ==========
 
[2011.04.30 21:54:26 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings
[2011.04.30 23:00:41 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird
[2011.05.01 13:19:39 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.05.01 18:44:59 | 000,000,414 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{7FDEF06A-4FD4-4AFE-89EB-22B248A9C822}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.30 21:57:18 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Adobe
[2011.04.30 21:42:12 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Apple Computer
[2011.04.30 21:41:29 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Identities
[2011.04.30 21:57:18 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Macromedia
[2011.05.01 12:31:38 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Malwarebytes
[2011.05.01 13:34:16 | 000,000,000 | --SD | M] -- C:\Users\Schumacher\AppData\Roaming\Microsoft
[2011.04.30 23:00:42 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Mozilla
[2011.04.30 21:54:26 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings
[2011.04.30 23:00:49 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Talkback
[2011.04.30 23:00:41 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird
[2011.05.01 13:22:28 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\WTablet
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=0DEE2B628D4C6E23285BB91EFFDABFDE -- C:\Windows\System32\drivers\ahcix86s.sys
[2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=0DEE2B628D4C6E23285BB91EFFDABFDE -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_71554ba4\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys
[2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.04.23 13:28:54 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\fsc.tmp\1022821\IaStor.sys
[2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys
[2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.21 04:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 04:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Windows\System32\drivers\nvstor32.sys
[2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_04bc6797\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 04:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.21 04:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.01.21 04:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 04:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2003.03.18 20:05:58 | 000,106,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\atl71.dll
[2008.01.21 04:24:18 | 000,798,208 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dbghelp.dll
 
<          >

< End of report >
--- --- ---

Vielen Dank

cosinus 02.05.2011 09:33
Zitat:
e:\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully.
y:\Arbeit\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully.
Was hat sowas in der Semesterarbeit zu suchen?

Schumacher 02.05.2011 11:20
Keine Ahnung. Ich hab jetzt nochmals einen Voll-Scan durchlaufen lassen und anscheinend ist das Problem mit dem Virus behoben. Wahrscheinlich wäre es aber besser den Laptop nochmals neu aufzusetzen oder?

Oder soll ich lieber die ganze Platte formatieren?

Gruß und Danke

cosinus 02.05.2011 12:51
Wieso weißt du das nicht? Ist das nicht deine Arbeit? :rofl:


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:50 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131