| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spontan kurz angezeigte cmd.exe inkl. TextWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.11.2011, 15:45
| #1 |
 |  Spontan kurz angezeigte cmd.exe inkl. Text Hallo, ich habe seit längerer Zeit... das Problem, dass ab und an - in unregelmäßigen Abständen - schnell hintereinander zwei CMD-Fenster auftauchen. In dem das zu erst aufgeht, steht etwas Text, direkt danach blendet eine zweite CMD ein und beide verschwinden so schnell wieder, dass man nichts erkennen kann. Mit einem Desktop-Screenshot hab ich bisher nur das 2. Fenster, eine komplett leere cmd.exe festhalten können. Habe dann ein Videotool installiert und den Desktop aufgenommen. Obwohl ich definitiv! gesehen habe, dass zwei Fenster aufgingen hintereinander, ist in dem Desktop-Video nur ein einziges Fenster zu sehen. Nämlich das zweite das mit aufgeht, die leere cmd.exe. Ich kann dieses Auftauchen nicht mit irgendeiner Installation der letzten Tage in Verbindung bringen. Antivir meldet keinen Befall des Systems. Mit HijackThis habe ich nichts finden können, dass dafür verantwortlich gewesen wäre. Mich interessiert nun an erster Stelle was genau das ist und ob es schädlich ist oder nicht. Würde das, unabhängig von der Schädlichkeit, gern abstellen, auch wenn es nichts schlimmes sein sollte. Aber am wichtigsten wäre mir erstmal Klarheit, worum es sich handelt. Die Boardsuche liefert bzgl. Eingabeaufforderung sehr viele Threads die mit irgendeinem Bundestrojaner zutun haben und bisherige Recherche über Google hat mir keinen sinnvollen Hinweis zur Beseitigung/Klärung meines Problems gebracht. Hoffe ich habe da nichts übersehen. Wäre schön, wenn mir jemand helfen könnte.  OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.11.2011 16:21:45 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\asphyxiaphan\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,98 Gb Available Physical Memory | 74,51% Memory free 8,00 Gb Paging File | 6,94 Gb Available in Paging File | 86,79% Paging File free Paging file location(s): p:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 39,88 Gb Total Space | 1,58 Gb Free Space | 3,97% Space Free | Partition Type: NTFS Drive D: | 3,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive P: | 230,47 Gb Total Space | 3,05 Gb Free Space | 1,32% Space Free | Partition Type: NTFS Drive S: | 195,31 Gb Total Space | 2,57 Gb Free Space | 1,32% Space Free | Partition Type: NTFS Computer Name: ASPHYXIAPHAN-PC | User Name: asphyxiaphan | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.23 16:19:48 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\asphyxiaphan\Desktop\OTL.exe PRC - [2011.11.18 13:21:23 | 008,482,560 | ---- | M] () -- c:\program files (x86)\common files\akamai\installer_no_upload_silent.exe PRC - [2011.11.17 06:58:04 | 003,303,000 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\asphyxiaphan\AppData\Local\Akamai\netsession_win.exe PRC - [2011.10.19 16:56:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.19 16:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.19 16:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2010.08.24 16:49:50 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2010.03.16 01:09:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2008.11.18 12:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe ========== Modules (No Company Name) ========== MOD - [2011.11.23 16:16:22 | 001,428,992 | ---- | M] () -- C:\Windows\Installer\MSI2A91.tmp MOD - [2011.11.18 13:21:23 | 008,482,560 | ---- | M] () -- c:\program files (x86)\common files\akamai\installer_no_upload_silent.exe MOD - [2009.03.26 13:46:42 | 000,148,480 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL MOD - [2009.02.06 17:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.08.18 21:30:08 | 001,436,424 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64) SRV:64bit: - [2010.07.07 02:50:54 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2010.04.09 13:31:26 | 000,567,808 | ---- | M] (Sphinx Software) [Auto | Running] -- C:\Program Files\Windows7FirewallControl\Windows7FirewallService.exe -- (Windows7FirewallService) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.11.18 13:20:34 | 003,313,752 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_d768ebc.dll -- (Akamai) SRV - [2011.11.02 16:40:34 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.10.19 16:56:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.19 16:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.08.03 09:58:52 | 000,168,864 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\WireHelpSvc.exe -- (WireHelpSvc) SRV - [2010.08.24 16:49:50 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2010.08.15 13:12:21 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- P:\Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2010.03.16 01:09:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010.01.23 07:12:18 | 000,673,792 | ---- | M] () [Disabled | Stopped] -- P:\Inventor\Moldflow\bin\mitsijm.exe -- (mitsijm2011) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.11.18 12:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.10.27 09:02:32 | 000,147,472 | ---- | M] (<Turtle Entertainment>) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\ESLWireACD.sys -- (ESLWireAC) DRV:64bit: - [2011.10.19 16:56:15 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.10.19 16:56:15 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.10.19 16:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.01.21 12:50:42 | 000,116,096 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmaudio.sys -- (avmaudio) DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.12.01 20:06:31 | 000,125,512 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD) DRV:64bit: - [2010.08.13 09:00:07 | 000,033,344 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2010.08.04 17:00:02 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.07.28 23:25:10 | 000,029,720 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ivusb.sys -- (ivusb) DRV:64bit: - [2010.07.07 03:30:08 | 007,195,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2010.07.07 02:15:42 | 000,265,728 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.05.06 10:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.04.21 19:12:50 | 001,288,192 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17) DRV - [2010.12.01 20:06:31 | 000,125,512 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.02.07 19:27:46 | 000,014,104 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan) DRV - [2006.04.26 00:03:56 | 000,009,600 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\SysWow64\drivers\ISODisk.sys -- (ISODisk) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "foxsearch" FF - prefs.js..browser.search.order.1: "foxsearch" FF - prefs.js..browser.search.selectedEngine: "foxsearch" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.downhill-board.com" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900 FF - prefs.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF - prefs.js..network.proxy.type: 0 FF - user.js..browser.search.selectedEngine: "foxsearch" FF - user.js..browser.search.order.1: "foxsearch" FF - user.js..browser.search.defaultenginename: "foxsearch" FF - user.js..keyword.URL: "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: P:\Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: P:\Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@ptc.com/ProductViewLite: C:\Program Files (x86)\Common Files\PTC\np6_pvapplite9.dll (PTC) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2010.12.26 23:16:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2010.12.26 23:16:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.16 18:14:44 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.16 18:14:44 | 000,000,000 | ---D | M] [2008.04.17 01:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\asphyxiaphan\AppData\Roaming\mozilla\Extensions [2011.11.08 20:53:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\asphyxiaphan\AppData\Roaming\mozilla\Firefox\Profiles\pr1qqjlw.default\extensions [2011.03.09 18:20:46 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\asphyxiaphan\AppData\Roaming\mozilla\Firefox\Profiles\pr1qqjlw.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.08.04 15:48:15 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\asphyxiaphan\AppData\Roaming\mozilla\Firefox\Profiles\pr1qqjlw.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.11.08 20:52:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.09.25 09:21:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.21 13:27:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.12.26 23:16:47 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO [2010.12.26 23:16:47 | 000,000,000 | ---D | M] (DivX HiQ) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA [2010.09.21 13:27:40 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.03.19 09:23:30 | 000,686,592 | ---- | M] (Synatix GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2011.10.14 21:29:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.14 21:29:00 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.12.28 22:06:26 | 000,000,143 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\foxsearch.src [2011.10.14 21:29:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.14 21:29:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.14 21:29:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (QipLI Class) - {6B5863A0-C43F-4C0A-982B-CC0E9125783F} - C:\Users\asphyxiaphan\AppData\Roaming\Microsoft\Internet Explorer\qstatsrv.dll (TODO: <Company name>) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - P:\Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\asphyxiaphan\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - P:\Office\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found. O4:64bit: - HKLM..\Run: [Windows7FirewallControl] C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe (Sphinx Software) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BCSSync] P:\Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\asphyxiaphan\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) O4 - HKCU..\Run: [AVMUSBFernanschluss] C:\Users\asphyxiaphan\AppData\Local\Apps\2.0\3KK11X70.T2Y\NNM6B94G.0CG\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin) O4 - HKCU..\Run: [NVIDIA nTune] "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear File not found O4 - HKCU..\Run: [RGSC] S:\GTA\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - P:\Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - P:\Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - P:\Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - P:\Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3E37390B-0F70-43A5-B1F8-002CDDF3DA5A}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - P:\Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{96ccc3c5-9fe1-11df-9b97-001e90f0f5f8}\Shell - "" = AutoRun O33 - MountPoints2\{96ccc3c5-9fe1-11df-9b97-001e90f0f5f8}\Shell\AutoRun\command - "" = J:\SETUP.EXE O33 - MountPoints2\{96ccc3c5-9fe1-11df-9b97-001e90f0f5f8}\Shell\configure\command - "" = J:\SETUP.EXE O33 - MountPoints2\{96ccc3c5-9fe1-11df-9b97-001e90f0f5f8}\Shell\install\command - "" = J:\SETUP.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {09A0078B-852C-40AF-9EE1-E7EE09B37ECB} - Internet Explorer ActiveX:64bit: {1392845D-8D0C-6F2F-E1CA-C57B2B7979B2} - Internet Explorer ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {332E613D-C2ED-C6E9-108B-EA2BC9F57C4C} - Internet Explorer ActiveX:64bit: {34D1FC8B-FC5A-51EB-D0C3-A7669B877A7B} - Internet Explorer ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5129D5C5-12A2-9636-2DF2-2891A247FD9D} - Internet Explorer ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {0CC3E04C-9983-F8B8-D801-C9403CA5994A} - Internet Explorer ActiveX: {1F5F2B76-3192-4856-3339-C2A1D8365C65} - Microsoft Windows Media Player 12.0 ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) MsConfig:64bit - StartUpFolder: C:^Users^asphyxiaphan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE - () MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: AnyDVD - hkey= - key= - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) MsConfig:64bit - StartUpReg: DivX Download Manager - hkey= - key= - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC) MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MsConfig:64bit - StartUpReg: Infium - hkey= - key= - C:\Program Files (x86)\QIP 2010\qip.exe (QIP) MsConfig:64bit - StartUpReg: NVIDIA nTune - hkey= - key= - File not found MsConfig:64bit - StartUpReg: QIP Internet Guardian - hkey= - key= - C:\Users\asphyxiaphan\AppData\Roaming\QipGuard\QipGuard.exe () MsConfig:64bit - StartUpReg: RGSC - hkey= - key= - File not found MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) MsConfig:64bit - State: "services" - Reg Error: Key error. MsConfig:64bit - State: "startup" - Reg Error: Key error. CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.23 16:19:47 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\asphyxiaphan\Desktop\OTL.exe [2011.11.23 16:16:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2011.11.22 23:56:15 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\AppData\Local\DVDVideoSoft_Ltd [2011.11.22 18:13:06 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\AppData\Roaming\DVDVideoSoft [2011.11.22 18:13:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2011.11.22 18:12:59 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\Documents\DVDVideoSoft [2011.11.22 18:12:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft [2011.11.22 18:12:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2011.11.22 18:12:19 | 013,261,568 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Users\asphyxiaphan\Desktop\FreeScreenVideoRecorder.exe [2011.11.22 14:06:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint [2011.11.22 14:06:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2011.11.22 14:05:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services [2011.11.22 14:04:40 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2011.11.22 14:04:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2011.11.22 14:04:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework [2011.11.22 14:04:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2011.11.22 14:03:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2011.11.22 14:02:35 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office [2011.11.22 14:02:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services [2011.11.22 14:01:59 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\AppData\Local\Microsoft Help [2011.11.22 14:01:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.11.16 23:26:09 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\Desktop\backups [2011.11.16 23:17:40 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\asphyxiaphan\Desktop\HiJackThis204.exe [2011.11.10 11:00:25 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\AppData\Roaming\Avira [2011.11.10 10:55:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.11.10 10:55:01 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.11.10 10:55:01 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.11.10 10:55:01 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.11.10 10:54:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.11.10 10:54:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2011.11.10 09:36:36 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\AppData\Local\Akamai [2011.11.05 23:38:11 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\Desktop\Prophecy - Don't Fuckin' Mess With Texas - 2011 [2011.11.01 21:00:58 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\Desktop\KINGDOM COME - FREE EP [2011.10.24 17:21:26 | 000,000,000 | ---D | C] -- C:\Users\asphyxiaphan\Desktop\Mortal Sin - Psychology Of Death - 2011 [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\asphyxiaphan\AppData\Local\*.tmp files -> C:\Users\asphyxiaphan\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.23 16:23:07 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.23 16:23:07 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.23 16:21:53 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.23 16:21:53 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.23 16:21:53 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.23 16:21:53 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.23 16:21:53 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.23 16:19:48 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\asphyxiaphan\Desktop\OTL.exe [2011.11.23 16:15:37 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.23 16:15:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.23 16:15:14 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys [2011.11.23 16:13:47 | 000,000,020 | ---- | M] () -- C:\Users\asphyxiaphan\defogger_reenable [2011.11.23 16:12:33 | 000,050,477 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\Defogger.exe [2011.11.23 15:40:30 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.22 18:19:34 | 013,261,568 | ---- | M] (DVDVideoSoft Ltd. ) -- C:\Users\asphyxiaphan\Desktop\FreeScreenVideoRecorder.exe [2011.11.22 18:13:02 | 000,001,371 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\Free Screen Video Recorder.lnk [2011.11.22 18:13:02 | 000,001,243 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\DVDVideoSoft Free Studio.lnk [2011.11.22 17:19:44 | 000,539,560 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.16 23:17:41 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\asphyxiaphan\Desktop\HiJackThis204.exe [2011.11.07 21:01:26 | 084,419,032 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\avira_free_antivirus_de.exe [2011.11.04 16:53:54 | 000,647,073 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\roadgapchen.jpg [2011.11.01 11:34:23 | 000,092,308 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\descendant.jpg [2011.10.27 19:57:32 | 000,009,504 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\parkbesuche2011.ods [2011.10.27 09:02:32 | 000,147,472 | ---- | M] (<Turtle Entertainment>) -- C:\Windows\SysNative\drivers\ESLWireACD.sys [2011.10.25 18:06:02 | 000,342,698 | ---- | M] () -- C:\Users\asphyxiaphan\Desktop\grashopper.jpg [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\asphyxiaphan\AppData\Local\*.tmp files -> C:\Users\asphyxiaphan\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.23 16:13:46 | 000,000,020 | ---- | C] () -- C:\Users\asphyxiaphan\defogger_reenable [2011.11.23 16:12:33 | 000,050,477 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\Defogger.exe [2011.11.22 18:13:02 | 000,001,371 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\Free Screen Video Recorder.lnk [2011.11.22 18:13:02 | 000,001,243 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\DVDVideoSoft Free Studio.lnk [2011.11.07 20:58:23 | 084,419,032 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\avira_free_antivirus_de.exe [2011.11.04 16:53:51 | 000,647,073 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\roadgapchen.jpg [2011.11.01 11:34:23 | 000,092,308 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\descendant.jpg [2011.10.25 18:05:57 | 000,342,698 | ---- | C] () -- C:\Users\asphyxiaphan\Desktop\grashopper.jpg [2011.10.08 15:21:32 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{807A9328-FC1A-4064-ACDD-3BB9AACBE606} [2011.09.09 21:13:40 | 000,168,864 | ---- | C] () -- C:\Program Files\Common Files\WireHelpSvc.exe [2011.08.24 20:00:50 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{4E1C9F3F-2F08-4FBC-B9C4-7E3F1385F1BC} [2011.08.12 14:44:38 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{14A25BFF-71A1-4980-A5EF-EBB01D3FBC21} [2011.08.08 13:44:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.08.08 13:41:46 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.08 13:35:57 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{B39C1273-88A7-475A-A937-C4BF5CA1F2E0} [2011.08.08 13:34:06 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{A8A69CAD-729D-40C1-916F-75A50A82FDE4} [2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.07.14 21:53:52 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{FE1F4599-18FD-4ACC-A012-E5B309D3739E} [2011.07.13 20:56:04 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{E6CA7840-DED3-437D-A469-2269D8CEB4B9} [2011.07.03 11:19:01 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{D5B33BC7-045B-4C3A-9825-B7A4F32BB7B3} [2011.07.03 11:17:51 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{FB0BFA75-BC98-412A-A1D9-7190B9FB9A1F} [2011.07.01 23:11:00 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{1A7989B0-E95C-4A68-84EF-B2B3777A3671} [2011.06.24 10:21:20 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{F6E899B0-8664-449D-91BB-AB8EB0FA8B70} [2011.06.21 16:37:41 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{814EB674-BEE0-4C3C-8955-AAB775A48F98} [2011.06.12 17:28:59 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{D1F556A9-16BD-4289-9042-C7F1FA8C09DB} [2011.05.25 17:26:44 | 000,000,000 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\{7715F9FB-4F73-4747-B9D8-D3529970615C} [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.03.30 17:40:13 | 000,009,600 | ---- | C] () -- C:\Windows\SysWow64\drivers\ISODisk.sys [2011.01.21 12:57:36 | 000,000,467 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.01.21 12:57:36 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2011.01.15 20:31:12 | 000,007,605 | ---- | C] () -- C:\Users\asphyxiaphan\AppData\Local\Resmon.ResmonCfg [2010.12.28 22:18:46 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.12.19 15:31:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.08.24 16:49:49 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2010.08.15 13:11:29 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2010.08.15 13:11:29 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2010.08.15 12:59:42 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini [2010.08.13 08:38:46 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2010.08.13 08:38:46 | 000,215,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.08.13 08:38:46 | 000,075,064 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010.08.04 17:25:36 | 000,000,273 | ---- | C] () -- C:\Windows\game.ini [2010.08.04 16:19:01 | 000,003,118 | ---- | C] () -- C:\Windows\SysWow64\AudioDrv.ini [2010.08.04 16:15:55 | 000,003,348 | R--- | C] () -- C:\Windows\SysWow64\ludap17.ini [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.01.12 12:40:10 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\Autodesk [2010.08.04 17:20:00 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\DAEMON Tools Lite [2011.11.22 18:13:07 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\DVDVideoSoft [2011.11.08 20:53:22 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\Gutscheinmieze [2011.09.15 15:00:54 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\HLSW [2011.11.23 13:28:45 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\ICQ [2010.12.26 23:16:49 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\Local [2010.12.27 21:37:51 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\MB-Ruler [2010.09.25 09:30:36 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\OpenOffice.org [2011.05.12 09:39:44 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\PTC [2008.04.17 00:07:36 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\QIP [2008.04.17 00:07:24 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\QipGuard [2011.09.08 15:03:29 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\TS3Client [2010.08.05 09:27:59 | 000,000,000 | ---D | M] -- C:\Users\asphyxiaphan\AppData\Roaming\Ubisoft [2011.11.06 15:34:38 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2008.04.16 23:41:56 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2010.10.23 17:29:49 | 000,000,000 | ---D | M] -- C:\BlueByte [2011.11.23 16:16:19 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2008.04.16 23:41:12 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.09.13 15:31:13 | 000,000,000 | ---D | M] -- C:\DOSBox-0.74 [2011.09.13 15:24:20 | 000,000,000 | ---D | M] -- C:\DOSPROG [2011.09.13 15:27:04 | 000,000,000 | ---D | M] -- C:\KEEN4 [2010.08.18 21:24:35 | 000,000,000 | ---D | M] -- C:\MITSI 2011 Temporary Files [2011.08.12 15:32:25 | 000,000,000 | ---D | M] -- C:\NVIDIA [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.11.22 14:02:35 | 000,000,000 | R--D | M] -- C:\Program Files [2011.11.22 18:12:59 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.11.22 14:01:54 | 000,000,000 | -H-D | M] -- C:\ProgramData [2008.04.16 23:41:12 | 000,000,000 | -HSD | M] -- C:\Programme [2008.04.16 23:41:12 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.11.23 16:23:10 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2008.04.16 23:41:49 | 000,000,000 | R--D | M] -- C:\Users [2011.11.22 14:04:40 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > < End of report > Geändert von meatkn1fe (23.11.2011 um 16:32 Uhr) |
|
24.11.2011, 11:52
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Spontan kurz angezeigte cmd.exe inkl. Text Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ |
|
24.11.2011, 15:20
| #3 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Erstmal Danke.
__________________Malewarebytes läuft noch - soll ich das Log auch posten, wenn keine Infizierung festgestellt wurde? Den anderen Scan führe ich danach aus. |
|
24.11.2011, 15:54
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. Text Ja Logs immer posten
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
24.11.2011, 16:12
| #5 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Malwarebytes Log: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8231 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 24.11.2011 16:11:02 mbam-log-2011-11-24 (16-11-02).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|P:\|S:\|) Durchsuchte Objekte: 444249 Laufzeit: 1 Stunde(n), 47 Minute(n), 11 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: p:\zensiert\SAVE\laufwerk d\mirc612.exe (Backdoor.Bot) -> Quarantined and deleted successfully. p:\zensiert\laufwerk d\vt_214.exe (Trojan.Dropper) -> Quarantined and deleted successfully. s:\zensiert\E\mirc612.exe (Backdoor.Bot) -> Quarantined and deleted successfully. s:\zensiert\E\vt_214.exe (Trojan.Dropper) -> Quarantined and deleted successfully. Das Problem tritt aktuell immernoch auf. Mittlerweile scheinen teilweise sogar DREI cmd-Fenster aufzugehen. Eines davon, ein leeres, bleibt sogar ab und an so lang stehen, das ich es noch verschieben o.ä. kann, bevor es von selbst schließt. Ist dieser Onlinescan ungefährlich? Kann mich mit der Idee nicht so anfreunden, den Rechner am Netz zu haben und dabei die Antivirensoftware auszuschalten. Oder passiert da nix? Geändert von meatkn1fe (24.11.2011 um 16:32 Uhr) |
|
24.11.2011, 16:37
| #6 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. TextZitat:
Zitat:
__________________ --> Spontan kurz angezeigte cmd.exe inkl. Text |
|
24.11.2011, 17:06
| #7 | |
| | Spontan kurz angezeigte cmd.exe inkl. TextZitat:
War eine nachfolgende Ordnerstruktur in privaten Daten, die nicht ins Netz gehört. Was mich allerdings wundert ist, dass bei Programmen wie Ventrilo und IRC, die ich vor laaanger Zeit genutzt hab nun solche Meldungen auftauchen. Bezüglich des Scans meinte ich auch nicht den Scan ansich, sondern die Zeit in die der Rechner online ist, ohne Virenschutz. Seis drum, den Onlinescan werd ich nachher ausführen und danach das Log posten. |
|
24.11.2011, 17:17
| #8 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. TextZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.11.2011, 19:57
| #9 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Habe Antivir deaktiviert und die Firewall von Windows ebenso - trotzdem scannt das Ding überhaupt nichts, ist sofort fertig und sagt "0 objects scanned". Woran liegt das? |
|
24.11.2011, 20:20
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. Text Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.11.2011, 20:39
| #11 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Hab ich gemacht, bin des Lesens ja mächtig.  |
|
24.11.2011, 20:43
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. Text Dann probier einen anderen Browser. Nur ist diese per Rechtsklick als Admin Geschichte der häufigste Fallstrick
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.11.2011, 16:58
| #13 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Hallo, der ESET Scanner läuft nicht. Habe den Internetexplorer genutzt (als Administrator) und trotzdem scannt er nichts. Der Scanvorgang wird gestartet, aber er durchsucht keine einzige Datei und zeigt mir daher auch immer direkt "0 Threats found" an. Firewall ist aus, Antivir ist deaktiviert. |
|
28.11.2011, 18:28
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Spontan kurz angezeigte cmd.exe inkl. Text Und das gleiche ist mit dem FF der Fall? Ganz sicher den Browser vorher BEENDET, dann per Rechtsklick als Admin ausgeführt?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.11.2011, 20:52
| #15 |
| | Spontan kurz angezeigte cmd.exe inkl. Text Ja. Mehrfach mit beiden Browsern ausprobiert. Immer mit Rechtsklick und als Admin gestartet. Er fängt den Scan an, ist aber direkt fertig. Er läd die Signaturen runter, danach startet der Scan ganz kurz und dann sagt er von 0 durchsuchten Objekten hat er 0 Sachen gefunden... IE, FF, Admin, alles ausgeschaltet... |
|
| Themen zu Spontan kurz angezeigte cmd.exe inkl. Text |
| adblock, angezeigte, befall, boardsuche, bundes, bundestrojaner, c:\windows\system32\rundll32.exe, cmd-fenster, cmd.exe, direkt, document, dvdvideosoft ltd., eingabeaufforderung, erkennen, google, google earth, hijack, hijackthis, hinweis, installation, installiert, komplett, liefert, meldet, nichts, of death, plug-in, problem, required, schnell, studio, tan, threads, unregelmäßige, verbindung, video, visual studio, webcheck |
Linear-Darstellung
