Erster Befall unter 7 32bit, multiple Probleme

ethanhund · 23.12.2011, 09:51

Mahlzeit,

in der Vergangenheit konnte ich als stiller Mitleser schon mehrfach meine Probleme durch Threads im Trojaner-Board schon lösen. Im aktuellen Fall habe ich mich jedoch dazu entschlossen meinen Befall selbst zu Veröffentlichen.
Gestern Abend hat sich Firefox mitsamt Taskmanager verabschiedet, letzterer lässt sich seitdem nicht mehr öffnen, nach dem Affengriff wird er auch nicht mehr als Option angezeigt.
Boot tut gut, dachte ich mir also gesagt getan.
Damit begann die Odysee. Der Befall besteht aus folgenden Bestandteilen:
- CCC stürzt nach Windowsanmeldung ab
- "RAM memory reliability is extremly low"-Meldung
- Weitere Meldungen (Gedächtnisprotokoll): "Windows detected a hard disk problem" mit den Optionen "Scan and fix" und "Delay scan", "Failed to save all the components for the file...(system32)" (ca. 20-fache Meldung), "Files indexation process failed"
- Bei ungewolltem Scanstart öffnet sich ein Programm, welches auf "Choice Guard" verweist
- Desktop wurde resettet, Startmenü leer, Dateien in system32 zwar sichtbar, aber nicht startbar
- Auch nach der Anwendung der win7-32-sm-reset.exe bleiben Desktop und Startmenü verborgen
- Unter Systemstart hat sich "PD C0sEd" eingenistet, zu finden unter ProgramData/RFBHhGvgqyIOxPW.exe
- Abgesicherter Modus wird seit dem 3. Neustart nicht mehr angezeigt, nur noch Starthilfe, welche nicht funktioniert
- HDD arbeitet stetig, ich hoffe mal die Probleme nehmen nicht noch weiter zu

Windows Defender hat als Adware Win32/OpenCandy erkannt. Wie oben aufgeführt, bleibt auch nach Unhide der Desktophintergrund schwarz und im Startmenü ist lediglich "Accessories" und "Maintenance" erschienen (Startup ist leer). Allerdings sind zumindest die zahlreichen Meldungen nun verschwunden. Beim manuellen Startversuch der taskmgr.exe erscheint nun "Task-Manager wurde durch den Administrator deaktiviert" (vorher regte sich rein gar nichts).
Nachfolgend die OTL-Dateien.

Extras.txt:
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 23.12.2011 09:10:55 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ethanhund\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 73,83% Memory free
6,50 Gb Paging File | 5,56 Gb Available in Paging File | 85,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 260,37 Gb Free Space | 27,95% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: ethanhund | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00639918-023C-30DD-BB03-CE9DEA98A7D7}" = CCC Help Chinese Traditional
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CB2A228-2E05-888C-3C38-FD242D66A37E}" = Catalyst Control Center InstallProxy
"{10CDB54A-AC21-DF5D-D7C3-D5E3687E88D5}" = CCC Help Japanese
"{13D86932-8D64-5BF1-A852-38F6D22F6A2F}" = Catalyst Control Center Graphics Previews Common
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18EBEFCE-AF96-6EAF-A5AF-F8A5BAC23171}" = CCC Help Spanish
"{1954240A-76A3-673C-1FC1-8F779A1A3A35}" = Catalyst Control Center Graphics Previews Vista
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{19B94155-40AF-17AE-4551-1B0094652B5A}" = CCC Help Czech
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1DDC7779-8B48-35E2-B9F0-C904EB02031C}" = CCC Help Portuguese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22764EFF-300F-8F3D-564D-7A4C4662D120}" = CCC Help Polish
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2365558E-D15A-D3DA-67E5-4B67FAB71280}" = CCC Help English
"{25D1A13B-46CB-5730-3651-8C91BA8F1754}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 26
"{277F7DBD-76BB-49C8-AB60-3CD12F6F7BD0}" = QIP 2012 6904 Jeak-Edition
"{2894AAC3-9A08-FF3A-6737-41A6178D0A09}" = CCC Help Chinese Standard
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations
"{33B2A67D-96DD-3D8D-94B4-5918960F4E7E}" = CCC Help Thai
"{3536AD21-940C-D198-DD10-078011A5C13B}" = CCC Help Thai
"{3A1B1652-D70A-4D19-981E-BB15D0DBF253}" = Ghostbusters (TM): The Video Game
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A68AA19-5C83-4BC3-ABA4-161E940799DB}" = QIP Infium 9044 Jeak-Edition
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D15698E-4DD8-81CB-0A8E-4E21162D2FBE}" = ccc-utility
"{3E8ADCB3-4297-3A65-8E76-A88B09104AB9}" = AMD Catalyst Install Manager
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43430FA2-C625-49DA-8882-351000008300}" = Dead Rising 2: OTR
"{434D0FA0-AB8C-497F-B30A-7A1000018201}" = DiRT 3
"{434D0FA0-AB8C-497F-B30A-7A1000018202}" = DiRT 3
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{4614BE8A-0C7D-D86C-CBAD-61F9C7B3AA26}" = AMD Media Foundation Decoders
"{49D87A8F-D04F-7749-DD32-BDBF9B24B232}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CC0A6BA-792E-5AE7-8993-C521798A8910}" = CCC Help Chinese Standard
"{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018301}" = Fable III
"{50EF1220-57F7-432E-9217-E5FAF61F93C9}" = Catalyst Control Center Localization All
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{555827C1-F292-3660-A9B2-963243286E18}" = Catalyst Control Center HydraVision Full
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56EF8482-50F6-019C-8D1D-ED8EE66E731D}" = CCC Help Polish
"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{63CEA2E4-4FE7-4F2C-B388-C1313D24157C}" = SPORE™ Galaktische Abenteuer
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist
"{660C748F-A503-B771-7BD6-2D7C5AA1DBB4}" = CCC Help Dutch
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{69FB248E-690D-434F-94A7-248D5F1ECD70}" = AMD OverDrive
"{69FD94CB-D8E8-E05F-B076-D8F8566A29D6}" = Catalyst Control Center InstallProxy
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A272B84-3E10-8AB8-1188-2246459457A6}" = ccc-core-static
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6E03FAB5-6253-58B8-B939-AA83F64C3278}" = CCC Help Swedish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71513F2C-F2BD-E07D-1320-093517D7EEC9}" = CCC Help Finnish
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7522ED5B-5670-5B76-A8C2-77B6F8E189FA}" = CCC Help French
"{75D5C946-C7D4-8653-1A81-6BE2DE960D4C}" = CCC Help Turkish
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{7A75AFE3-A0C3-951D-4804-54721360FF90}" = CCC Help Hungarian
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8EED73E3-E049-5A57-D1AB-5C9872AB504E}" = CCC Help Danish
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{915726DF-7891-444A-AA03-0DF1D64F561A}" = L.A. Noire
"{946BA0C5-DE16-4C0B-C436-796EF98EE4B7}" = Catalyst Control Center Graphics Full New
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B415AF9-72E7-2FF3-EB54-609E0B7ECFFF}" = CCC Help Italian
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C049499-055C-4a0c-A916-1D8CA1FF45EB}" = Sitecom 300N USB Wireless LAN Driver and Utility
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{9F218882-4CF1-F411-111A-B9B68770C0CE}" = CCC Help Czech
"{9F81DEEE-D63C-86D6-750A-23E0EC3F6A1E}" = AMD Drag and Drop Transcoding
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A1EF8DA8-E0CB-C805-4ACA-B7C028CF36F2}" = CCC Help Italian
"{A9F27D99-8478-C124-8978-09595FA9D805}" = CCC Help Portuguese
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAB0D88E-85D7-22CC-6935-0D2247152700}" = CCC Help French
"{AB0A4CB6-60DC-C3D6-2100-C16D89795529}" = CCC Help Korean
"{ABD7DBE3-E344-4BCA-B8AD-4360494DD1D9}" = LG MC USB U330 driver
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{B00220C8-AD02-4DA8-BEF4-E0552A4AC1E2}_is1" = Panopticum Lens Pro 3.5 For Vegas
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B6A24D2D-1ADB-4553-87FD-38F3FAADC18E}_is1" = The Book of Unwritten Tales 1.0.0.0
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BEEA9F9D-0F9D-1F7E-8BA5-C3888A93798C}" = CCC Help Swedish
"{C048F019-9EF3-7F49-0D36-10013A466F17}" = CCC Help Hungarian
"{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}" = SPORE™ Süß & Schrecklich Ergänzungs-Pack
"{C104E9E6-F21E-2762-FBF0-6FE820B2D739}" = CCC Help Korean
"{C270BC04-1540-4673-960F-A546B2C860CD}" = Commandos 3 - Destination Berlin
"{C41DF3CA-5F40-DB8C-D747-DC68BC2010D8}" = Catalyst Control Center
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5632631-95E3-4DAF-2EB1-487EBE04DE19}" = AMD VISION Engine Control Center
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C95E964C-FCF4-13DB-1445-4FA8062271F8}" = CCC Help Spanish
"{CAF243F5-1B4E-A8D7-2EF9-6398EF2C5032}" = AMD AVIVO Codecs
"{CBA7495B-744F-F056-648B-636ADE9E7015}" = ccc-utility
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CC8E8BD8-8F84-35FA-4DC4-D41D31DFA3E4}" = Catalyst Control Center Graphics Full Existing
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.9 Game
"{D3BBE95D-7E2F-1D0C-82CB-1AB333854E2C}" = CCC Help Norwegian
"{D5395E5F-4D45-4665-8F00-234FA33678AF}" = SlimDX Redistributable (March 2009)
"{D7A8C334-7974-54A4-6533-EB84D19D7133}" = CCC Help English
"{D7F681C7-C93C-7591-F4CB-8EC80138F326}" = Catalyst Control Center Graphics Light
"{D872D294-5E06-2C4B-B2F5-D3E19F097917}" = ccc-utility
"{D89F00EB-7868-A817-D618-AA446C0D56B3}" = CCC Help Chinese Traditional
"{D94BA408-F110-488B-A65E-3AE7945F79E6}_is1" = LG PC Suite III deinstallieren
"{D9AB20FE-5267-7A1A-2064-8F18969DF88D}" = CCC Help German
"{DA45F8EC-4226-EA6A-4DA9-F1148F801BDA}" = CCC Help Russian
"{DA7747E1-1F8D-BBC5-BE66-00B21BE5B81B}" = CCC Help Turkish
"{DADEC9BB-66FC-A3E4-8BC9-83E73BA1B5B2}" = CCC Help Greek
"{DC0F655C-E322-1AEF-263E-4E1BEC409BDC}" = AMD Fuel
"{DC785DB7-D389-48C3-B146-96FE99BF4E2B}" = Vegas Pro 9.0
"{DD0FDF02-6AA4-8C7D-AAB0-4C8C7207C0C1}" = CCC Help Japanese
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX
"{E0D5CB1C-7D35-709E-7F58-6CF6FFC3D6B7}" = Catalyst Control Center Graphics Previews Common
"{E1640DA5-89B4-4F52-B15D-5DA3D14F29D4}" = LG USB Modem Drivers
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E839DC72-1FF9-968E-AEC4-084D8C6C7661}" = Catalyst Control Center Core Implementation
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = Impulse
"{EB20F561-2AF5-0368-E353-AF093FBBADC2}" = CCC Help Norwegian
"{ECDE16E7-E3FC-F094-F14D-0326D03B9D96}" = Catalyst Control Center InstallProxy
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EFABE688-3FA7-EB97-9E6F-4B74B51EF164}" = CCC Help Russian
"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1A7536D-5037-E775-CB9C-7712CB7BAE21}" = CCC Help English
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F33E2414-B742-0589-5E9D-FCC24996EFE2}" = CCC Help Dutch
"{F38AF6F6-059C-C683-826F-00539526D86D}" = CCC Help Danish
"{F420C456-2EAC-89C9-4A5B-EC85393FBDC9}" = CCC Help Greek
"{F48A622B-DC1D-79A5-380D-29C6493B6987}" = Catalyst Control Center Graphics Previews Common
"{F59A3B93-6C1C-4C3E-BCC4-4897490E2963}" = LG Bluetooth Drivers
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA02ACAC-9E14-4878-A257-92A22A647C2C}" = LG USB Modem Drivers
"{FCD58710-F023-E26C-6373-79C72FED0B90}" = Catalyst Control Center Localization All
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFCA5FC5-6069-0115-E2C1-785A0CA5D4C3}" = AMD Fuel
"33B31D6D-7EFB-45A3-AC50-4DAF98042443_is1" = The Book Of Unwritten Tales: Die Vieh Chroniken Version 1.2
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_3dcb365ab9e01871fb8c6f27b0ea079" = Adobe After Effects CS4
"Battlelog Web Plugins" = Battlelog Web Plugins
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Cities XL 2012" = Cities XL 2012
"D00BE5C1A47F2FE0C07F4CA85ABDD5DD95E57E0E" = Windows-Treiberpaket - Realtek Semiconductor Corp. (RTL8192su) Net  (05/12/2010 1086.19.0512.2010)
"DAEMON Tools Pro" = DAEMON Tools Pro
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DTProTS_is1" = DTProTS 2.01
"Dungeon Siege III_is1" = Dungeon Siege III
"DX2 texture pack" = DX2 texture pack
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESN Sonar-0.70.0" = ESN Sonar
"ESN Sonar-0.70.4" = ESN Sonar
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FL Studio 9" = FL Studio 9
"Fraps" = Fraps (remove only)
"GFWL_{43430FA2-C625-49DA-8882-351000008300}" = Dead Rising 2: OTR
"GFWL_{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"Hardcore" = Hardcore
"Haunted_is1" = Haunted
"HDD Health_is1" = HDD Health v3.3 Beta
"IL Download Manager" = IL Download Manager
"Impulse" = Impulse
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.2.0
"LogMeIn Hamachi" = LogMeIn Hamachi
"Magic Bullet Editors 2.0 Vegas" = Magic Bullet Editors 2.0 Vegas
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"NewBlue 3D Explosions for Vegas" = NewBlue 3D Explosions for Vegas
"NewBlue 3D Transformations for Vegas" = NewBlue 3D Transformations for Vegas
"NewBlue Art Blends 2.0 for Vegas" = NewBlue Art Blends 2.0 for Vegas
"NewBlue Art Effects 2.0 for Vegas" = NewBlue Art Effects 2.0 for Vegas
"NewBlue Film Effects for Vegas" = NewBlue Film Effects for Vegas
"NewBlue Motion Blends 2.0 for Vegas" = NewBlue Motion Blends 2.0 for Vegas
"NewBlue Motion Effects 2.0 for Vegas" = NewBlue Motion Effects 2.0 for Vegas
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"OpenAL" = OpenAL
"Origin" = Origin
"PluginPac" = DebugMode PluginPac (remove only)
"PoiZone" = PoiZone
"Project64 1.7.0.55" = Project64 1.7.0.55
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"QIP 2012 6904 Jeak-Edition 4.0.6904" = QIP 2012 6904 Jeak-Edition
"RADVideo" = RAD Video Tools
"Rockstar Games Social Club" = Rockstar Games Social Club
"RPG Maker VX 1.02" = RPG Maker VX 1.02
"RPG Maker VX RTP =XWareM2 Group=_is1" = RPG Maker VX RTP
"Saints Row The Third_is1" = Saints Row The Third
"Sawer" = Sawer
"Sins of a Solar Empire" = Sins of a Solar Empire
"Sins of a Solar Empire - Diplomacy" = Sins of a Solar Empire - Diplomacy
"Sins of a Solar Empire - Entrenchment" = Sins of a Solar Empire - Entrenchment
"SpeedFan" = SpeedFan (remove only)
"SpiceMASTER 2.5 PRO for Vegas" = SpiceMASTER 2.5 PRO for Vegas
"Steam App 12210" = Grand Theft Auto IV
"Steam App 12220" = Grand Theft Auto: Episodes from Liberty City
"Steam App 240" = Counter-Strike: Source
"Steam App 260" = Counter-Strike: Source Beta
"Toxic Biohazard" = Toxic Biohazard
"Tunngle beta_is1" = Tunngle beta
"Two Worlds II" = Two Worlds II
"Venetica_is1" = Venetica
"Verbindungsassistent" = Verbindungsassistent
"VLC media player" = VLC media player 1.1.11
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"YTdetect" = Yahoo! Detect
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"InstallShield_{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist
"jlGui 3.1" = jlGui 3.1
"QIP 2005" = QIP 2005 8095
"QIP 2010" = QIP 2010 10.10.22.4290
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.12.2011 09:10:55 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ethanhund\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 73,83% Memory free
6,50 Gb Paging File | 5,56 Gb Available in Paging File | 85,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 260,37 Gb Free Space | 27,95% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: ethanhund | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
PRC - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) -- C:\Programme\Tunngle\TnglCtrl.exe
PRC - [2011.10.07 04:28:52 | 000,397,312 | -H-- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () -- C:\Programme\Verbindungsassistent\WTGService.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) -- C:\Programme\Common Files\Nuance\dgnsvc.exe
PRC - [2010.06.08 16:41:22 | 001,118,208 | -H-- | M] (Sitecom Corp.) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe
PRC - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe
PRC - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () -- C:\Programme\DTProTS\DTProTS.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.10.05 01:20:35 | 011,819,520 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\33b601c8e2cf4993e68d763389246197\System.Web.ni.dll
MOD - [2011.10.05 01:20:26 | 000,771,584 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e3e3b399b69c569ab1ed3b0ace2c8c20\System.Runtime.Remoting.ni.dll
MOD - [2011.10.05 01:20:07 | 012,433,408 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0d43c5e77ee7b8466700b16d7e7d4bb7\System.Windows.Forms.ni.dll
MOD - [2011.10.05 01:20:03 | 001,587,200 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\9e87dd8fe5d0f925d80a6a6eaf74fdb9\System.Drawing.ni.dll
MOD - [2011.10.05 01:19:47 | 007,963,648 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\3da7c6c1a0f26ae91883fd8b03ec192d\System.ni.dll
MOD - [2011.10.05 01:19:42 | 011,490,304 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll
MOD - [2010.11.13 00:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 02:59:41 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.08.16 16:06:02 | 000,141,312 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.07.14 09:47:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () [Auto | Running] -- C:\Programme\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2011.04.16 20:52:50 | 000,403,240 | -H-- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Programme\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010.04.23 04:39:00 | 000,136,616 | -H-- | M] () [Auto | Stopped] -- C:\Programme\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) [Auto | Running] -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU)
SRV - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2010.01.06 19:49:12 | 000,655,624 | -H-- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () [Auto | Running] -- C:\Programme\DTProTS\DTProTS.exe -- (DTProTS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.10.07 06:20:28 | 008,598,528 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011.10.07 03:45:38 | 000,257,024 | -H-- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011.08.24 00:51:40 | 000,281,760 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.08.24 00:51:37 | 000,025,888 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.06.24 05:25:26 | 000,039,424 | -H-- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.01)
DRV - [2011.06.06 23:06:54 | 000,211,984 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011.02.17 01:36:33 | 000,431,672 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.11.20 13:30:15 | 000,175,360 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)
DRV - [2010.11.20 10:14:45 | 000,017,920 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.05.12 17:29:32 | 000,600,096 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.04.23 04:33:12 | 000,036,864 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Programme\AMD\OverDrive\i386\AODDriver2.sys -- (AODDriver2)
DRV - [2010.03.09 11:21:26 | 000,107,024 | -H-- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010.02.24 11:22:10 | 000,185,472 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2010.02.18 08:18:22 | 000,037,944 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2010.02.03 14:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.09.26 18:05:22 | 000,004,992 | -H-- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\enport.sys -- (enport)
DRV - [2009.09.16 07:02:40 | 000,027,136 | -H-- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.06.11 18:39:16 | 000,012,928 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.06.11 18:39:14 | 000,012,032 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.06.11 18:39:14 | 000,010,496 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.05.12 14:53:04 | 000,016,896 | -H-- | M] (Danish Wireless Design A/S) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlashUsb.sys -- (FlashUSB)
DRV - [2008.11.19 16:09:10 | 000,024,832 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 16:09:08 | 000,019,968 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 16:09:08 | 000,013,056 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.07.24 10:03:56 | 000,101,760 | -H-- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.06.29 13:47:34 | 000,034,304 | -H-- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006.09.24 14:28:46 | 000,005,248 | -H-- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [1996.04.03 20:33:26 | 000,005,248 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.yahoo.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?btnG=Google+Search&q="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files\OnLive\Plugin\npolgdet.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 13:39:48 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.20 12:09:43 | 000,000,000 | -H-D | M]
 
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.18 22:52:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Firefox\Profiles\8u9rtd2e.default\extensions
[2009.10.03 20:45:30 | 000,001,720 | -H-- | M] () -- C:\Users\ethanhund\AppData\Roaming\Mozilla\Firefox\Profiles\8u9rtd2e.default\searchplugins\youtube-videosuche.xml
[2011.11.09 13:39:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
() (No name found) -- C:\USERS\ETHANHUND\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8U9RTD2E.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.09 13:39:48 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.03 20:51:01 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.03 20:51:01 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.03 20:51:01 | 000,001,153 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.03 20:51:01 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.03 20:51:01 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.03 20:51:01 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2000.01.01 00:00:00 | 000,000,794 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 secure.disc-soft.com 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\ethanhund\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{508DA2EB-470E-488A-8334-53195C972FB4}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58FD8014-B197-4FFC-898C-49CEF9574F16}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C473E33D-D975-42FC-AD51-7FBBBE88B282}: DhcpNameServer = 7.254.254.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.07.10 19:00:38 | 000,063,372 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 13:46:33 | 000,003,232 | ---- | M] () - C:\AutoRun_Log(0000).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,978 | ---- | M] () - C:\AutoRun_Log(0001).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,973 | ---- | M] () - C:\AutoRun_Log(0002).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:10:34 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0003).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:11:02 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0004).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,961 | ---- | M] () - C:\AutoRun_Log(0005).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:21:58 | 000,003,074 | ---- | M] () - C:\AutoRun_Log(0006).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:04:55 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0007).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:35:20 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0008).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 23:07:50 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0009).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.15 00:58:05 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0010).txt -- [ NTFS ]
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.23 09:10:12 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.23 08:50:57 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011.12.22 22:14:59 | 000,218,688 | -H-- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:07:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jeak.de
[2011.12.15 00:43:02 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011.12.15 00:43:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\RELOADED
[2011.12.07 03:16:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock Games
[2011.11.29 17:41:31 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\WB Games
[2011.11.28 18:37:42 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\Assassin's Creed Revelations
[2011.11.28 18:29:45 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\NFSTR
[2009.09.17 13:52:18 | 059,158,448 | -H-- | C] (Macrovision Corporation) -- C:\Users\ethanhund\AppData\Roaming\file1.exe
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:08:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.23 09:08:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.23 09:03:35 | 000,000,388 | -H-- | M] () -- C:\Windows\tasks\QIPdater 2012.job
[2011.12.23 09:03:33 | 000,000,344 | -H-- | M] () -- C:\Windows\tasks\qipdater.exe.job
[2011.12.23 09:03:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.23 09:03:17 | 2616,057,856 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.23 09:01:29 | 000,322,393 | ---- | M] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.23 08:53:24 | 000,700,130 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.23 08:53:24 | 000,654,842 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.23 08:53:24 | 000,148,926 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.23 08:53:24 | 000,121,714 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.23 08:52:33 | 000,001,136 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000UA.job
[2011.12.23 08:52:08 | 000,000,424 | -H-- | M] () -- C:\ProgramData\8KAso99F2EWrrQ
[2011.12.23 08:50:57 | 000,000,664 | -H-- | M] () -- C:\Users\ethanhund\Desktop\System Fix.lnk
[2011.12.23 08:49:56 | 000,375,808 | -H-- | M] () -- C:\ProgramData\8KAso99F2EWrrQ.exe
[2011.12.22 22:19:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\Access.dat
[2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:00:47 | 000,470,016 | -H-- | M] () -- C:\ProgramData\RFBHhGvgqyIOxPW.exe
[2011.12.22 20:52:00 | 000,001,084 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000Core.job
[2011.12.22 05:51:27 | 000,140,072 | -H-- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.12.22 05:51:18 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2011.12.22 05:11:56 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2011.12.12 02:05:38 | 000,337,452 | -H-- | M] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.23 09:01:59 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.12.23 09:01:59 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2011.12.23 09:01:59 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011.12.23 09:01:59 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2011.12.23 09:01:59 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2011.12.23 09:01:58 | 000,001,417 | ---- | C] () -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.23 09:01:29 | 000,322,393 | ---- | C] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.23 08:50:57 | 000,000,664 | -H-- | C] () -- C:\Users\ethanhund\Desktop\System Fix.lnk
[2011.12.23 08:50:52 | 000,000,424 | -H-- | C] () -- C:\ProgramData\8KAso99F2EWrrQ
[2011.12.23 08:49:56 | 000,375,808 | -H-- | C] () -- C:\ProgramData\8KAso99F2EWrrQ.exe
[2011.12.22 22:01:40 | 000,470,016 | -H-- | C] () -- C:\ProgramData\RFBHhGvgqyIOxPW.exe
[2011.12.12 02:05:32 | 000,337,452 | -H-- | C] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[2011.11.13 23:40:31 | 000,451,072 | -H-- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2011.10.14 12:53:07 | 000,053,248 | -H-- | C] () -- C:\Windows\System32\CommonDL.dll
[2011.10.14 12:53:07 | 000,002,413 | -H-- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2011.10.04 23:00:01 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.09.22 15:33:23 | 000,000,043 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_local.cfg
[2011.09.22 15:04:46 | 000,011,099 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_live.bin
[2011.09.14 10:47:40 | 000,053,760 | -H-- | C] () -- C:\Windows\System32\OVDecode.dll
[2011.09.08 17:51:22 | 000,037,376 | -H-- | C] () -- C:\Windows\System32\atitmpxx.dll
[2011.08.24 00:51:40 | 000,281,760 | -H-- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.08.24 00:51:37 | 000,025,888 | -H-- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.08.17 20:48:44 | 000,237,701 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.07.24 02:06:29 | 000,000,082 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\X-Plane Installer.prf
[2011.07.11 16:17:35 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2011.04.09 17:55:28 | 000,179,261 | -H-- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.03.17 18:51:44 | 000,003,929 | -H-- | C] () -- C:\Windows\System32\atipblag.dat
[2011.02.28 13:11:17 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.02.28 13:09:51 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.01.22 18:29:49 | 000,020,480 | -H-- | C] () -- C:\Windows\System32\H@tKeysH@@k.DLL
[2010.10.31 10:31:39 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.12 20:14:31 | 000,012,800 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.10 01:36:48 | 000,036,734 | -H-- | C] () -- C:\Windows\System32\OggDSuninst.exe
[2010.09.17 23:24:08 | 000,001,395 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\SAS7_000.DAT
[2010.08.19 12:49:54 | 001,970,176 | -H-- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.08.02 14:31:53 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2010.07.21 01:35:51 | 000,165,376 | -H-- | C] () -- C:\Windows\System32\unrar.dll
[2010.07.21 01:35:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.07.21 01:35:50 | 000,790,528 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.07.21 01:35:50 | 000,134,144 | -H-- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.07.21 01:35:50 | 000,108,032 | -H-- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.06.25 16:55:46 | 000,017,408 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\WebpageIcons.db
[2010.06.16 22:40:07 | 000,000,853 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_sta
[2010.06.16 22:39:10 | 000,000,849 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_prof
[2010.06.12 19:30:42 | 000,036,892 | -H-- | C] () -- C:\Windows\System32\BASSMOD.dll
[2010.06.12 19:30:11 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.06.12 19:30:11 | 000,000,001 | ---- | C] () -- C:\Windows\audi20.dat
[2010.05.26 20:01:44 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.05.21 23:39:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.03 16:27:30 | 000,000,170 | ---- | C] () -- C:\Windows\game.ini
[2010.03.17 22:00:27 | 002,434,856 | -H-- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2009.11.09 14:21:02 | 000,066,560 | -H-- | C] () -- C:\Windows\System32\ntrights.exe
[2009.10.17 20:06:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\Access.dat
[2009.10.09 15:12:59 | 000,138,056 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\PnkBstrK.sys
[2009.10.09 15:12:29 | 003,360,624 | -H-- | C] () -- C:\Windows\System32\pbsvc.exe
[2009.10.05 14:09:42 | 001,658,973 | -H-- | C] () -- C:\Windows\System32\libmmd.dll
[2009.10.05 14:09:42 | 000,122,880 | -H-- | C] () -- C:\Windows\System32\PtSSE2.dll
[2009.10.05 14:09:42 | 000,019,968 | -H-- | C] () -- C:\Windows\System32\Cpuinf32.dll
[2009.09.26 18:05:22 | 000,008,192 | -H-- | C] () -- C:\Windows\System32\gsimrxnp.dll
[2009.09.26 18:05:22 | 000,004,992 | -H-- | C] () -- C:\Windows\System32\drivers\enport.sys
[2009.09.19 02:48:22 | 000,140,072 | -H-- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.09.19 02:47:12 | 000,280,904 | -H-- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009.09.19 02:45:01 | 000,075,136 | -H-- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.09.13 00:49:25 | 000,007,604 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\Resmon.ResmonCfg
[2009.07.14 09:47:43 | 000,700,130 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,148,926 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 002,340,040 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,654,842 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,121,714 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.10.06 19:42:57 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\OggDS.dll
[2002.10.05 00:04:25 | 000,921,600 | -H-- | C] () -- C:\Windows\System32\vorbisenc.dll
[2002.10.05 00:04:24 | 000,188,416 | -H-- | C] () -- C:\Windows\System32\vorbis.dll
[2002.10.05 00:04:17 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\ogg.dll
[1996.04.03 20:33:26 | 000,005,248 | -H-- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.11.24 03:20:26 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\.minecraft
[2010.05.03 16:36:16 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Activision
[2011.05.27 13:11:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Amazon
[2011.10.26 01:47:35 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Audacity
[2010.09.17 22:01:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Avid
[2010.05.07 21:29:22 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Bioshock2
[2009.12.19 00:08:31 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\COWON
[2010.06.06 22:57:01 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Crayon Physics Deluxe
[2009.09.13 17:40:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DAEMON Tools Lite
[2011.02.17 01:28:06 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DAEMON Tools Pro
[2011.07.06 12:15:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Day 1 Studios
[2011.08.25 15:48:13 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DYA_NVURBDAHNPILDSNTI
[2010.06.03 13:53:38 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Hardcore
[2011.12.22 22:06:02 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\jeak.de
[2010.06.03 13:55:08 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Juce VST Host
[2011.08.21 01:17:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Kalypso Media
[2011.10.14 13:20:47 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\LG Electronics
[2011.05.19 13:11:29 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Lionhead Studios
[2009.11.26 21:32:33 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\MAXON
[2010.06.12 19:09:13 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\mkvtoolnix
[2010.07.31 00:41:16 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Need for Speed World
[2011.07.20 00:09:43 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\New Technology Studio
[2010.09.17 23:00:27 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Nuance
[2010.05.29 22:47:18 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Octoshape
[2011.07.16 18:07:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\OnLive App
[2011.10.22 14:11:30 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Origin
[2010.09.17 22:00:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PACE Anti-Piracy
[2010.06.21 23:35:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PQube
[2010.06.03 15:25:12 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Propellerhead Software
[2011.02.17 03:00:15 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\ProtectDISC
[2009.12.31 14:14:36 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Publish Providers
[2011.03.17 12:15:58 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PunkBuster
[2010.10.26 08:43:02 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\QIP
[2010.08.27 15:20:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Quest3D
[2009.12.02 19:22:24 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\QuickScan
[2010.08.27 15:20:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Roaming
[2009.12.31 15:10:09 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Sony
[2010.10.11 02:04:36 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\SpieleEntwicklungsKombinat
[2009.09.24 14:31:24 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\SPORE
[2010.01.09 10:23:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Stardock
[2010.05.21 23:39:25 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Thunderbird
[2011.10.25 02:49:54 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\TS3Client
[2011.11.14 17:54:34 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Tunngle
[2011.11.28 17:50:50 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Ubisoft
[2011.06.25 12:21:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Verbindungsassistent
[2011.10.14 20:14:26 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\{D94BA408-F110-488B-A65E-3AE7945F79E6}
[2011.12.23 09:03:35 | 000,000,388 | -H-- | M] () -- C:\Windows\Tasks\QIPdater 2012.job
[2011.12.23 09:03:33 | 000,000,344 | -H-- | M] () -- C:\Windows\Tasks\qipdater.exe.job
[2009.07.14 05:53:46 | 000,026,080 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 971 bytes -> C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1V4WG4H6PT4KGM8HTV4K6N636VFSVF7JB4VPJGF
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0FF263E8
@Alternate Data Stream - 1092 bytes -> C:\ProgramData\Microsoft:UAsVNu1uw2nqZLcJkAcFB
@Alternate Data Stream - 1029 bytes -> C:\ProgramData\Microsoft:lC2B3dLetnnc2juaDhYJr7C

< End of report >

--- --- ---

Für eure Bemühungen bedanke ich mich im Voraus.

P.S.:
Zur Herkunft der Schadsoftware kann ich leider keine Angaben machen, Browser hat sich unmittelbar vor seiner Verabschiedung lediglich auf unverfänglichen Seiten befunden, daher halte ich eine zeitgetriggerte Infektion für wahrscheinlicher.

Erster Befall unter 7 32bit, multiple Probleme

Log-Analyse und Auswertung: Erster Befall unter 7 32bit, multiple Probleme

Erster Befall unter 7 32bit, multiple Probleme

Ähnliche Themen: Erster Befall unter 7 32bit, multiple Probleme