Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Pc gesperrt durch GVU 2.07

Pc gesperrt durch GVU 2.07


Log-Analyse und Auswertung: Pc gesperrt durch GVU 2.07

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 16.07.2012, 22:23   #1
Daweyh
 
Pc gesperrt durch GVU 2.07 - Standard

Pc gesperrt durch GVU 2.07


Hallo ich habe mir heute Mittag leider den Trojaner GVU 2.07 eingefangen und seitdem sperrt sich mein PC immer wieder. Die ersten Schritte habe ich bereits abgearbeitet und die Logfiles erstellt. Ich hoffe ihr könnt mir helfen.

Bei Malwarebytes Anti-Malware kamen beim ersten Scan 2 infizierte Objekte zum Vorschein welche erfolgreich entfernt wurden.

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.16.11

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
Stephen :: WINTENDO [Administrator]

Schutz: Deaktiviert

16.07.2012 22:56:43
mbam-log-2012-07-16 (22-56-43).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 225462
Laufzeit: 1 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Stephen\AppData\Local\Temp\fest0r_ot.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Stephen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Der zweite Scan ergab keine infizierten objekte mehr.

Anti-Malware:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.16.11

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
Stephen :: WINTENDO [Administrator]

Schutz: Deaktiviert

16.07.2012 23:01:40
mbam-log-2012-07-16 (23-01-40).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 225231
Laufzeit: 2 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Bei Otl kam folgendes zum vorschein:

Otl.txt:

Code:
ATTFilter
OTL logfile created on: 16.07.2012 23:17:26 - Run 3
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Stephen\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,99 Gb Total Physical Memory | 6,99 Gb Available Physical Memory | 87,47% Memory free
15,98 Gb Paging File | 15,07 Gb Available in Paging File | 94,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 62,40 Gb Total Space | 18,23 Gb Free Space | 29,21% Space Free | Partition Type: NTFS
Drive D: | 37,49 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 235,59 Gb Total Space | 36,46 Gb Free Space | 15,48% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 424,53 Gb Free Space | 45,57% Space Free | Partition Type: NTFS
 
Computer Name: WINTENDO | User Name: Stephen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Stephen\Desktop\OTL.exe (OldTimer Tools)
PRC - F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - F:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MBAMService) -- f:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirService) -- F:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- F:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (DAUpdaterSvc) -- f:\Spiele\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RTL8187B) -- C:\Windows\SysNative\drivers\wg111v3.sys (NETGEAR Inc.                           )
DRV:64bit: - (USBMULCD) -- C:\Windows\SysNative\drivers\CM10664.sys (C-Media Electronics Inc)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (tandpl) -- C:\Windows\SysWOW64\drivers\tandpl.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 C8 8F 56 B1 A7 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.eintracht.de/aktuell/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: cache@status.org:0.7.10
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.9.3
FF - prefs.js..extensions.enabledItems: {9fb7d178-155a-4318-9173-1a8eaaea7fe4}:2.1.10
FF - prefs.js..extensions.enabledItems: {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}:0.9.6
FF - prefs.js..extensions.enabledItems: {6e764c17-863a-450f-bdd0-6772bd5aaa18}:1.0.3
FF - prefs.js..extensions.enabledItems: {1f91cde0-c040-11da-a94d-0800200c9a66}:4.1
FF - prefs.js..extensions.enabledItems: unplug@compunach:2.047
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: F:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: F:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.06.28 20:14:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: f:\Programme\Mozilla Thunderbird\components [2012.07.11 19:23:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: f:\Programme\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.06.28 20:14:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: F:\Programme\Mozilla Thunderbird\components [2012.07.11 19:23:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: F:\Programme\Mozilla Thunderbird\plugins
 
[2011.11.20 21:21:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Extensions
[2012.07.15 20:10:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions
[2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Forecastbar Enhanced) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
[2012.03.23 15:06:48 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2011.11.20 21:23:52 | 000,000,000 | ---D | M] (Media Converter) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}
[2012.03.29 20:19:51 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Cache Status) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\cache@status.org
[2011.11.20 21:23:51 | 000,000,000 | ---D | M] ("VideoDownloader") -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\videodowloader@videodownloader.net
[2007.09.04 22:40:48 | 000,005,310 | ---- | M] () -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\searchplugins\footiefox.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] F:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\Run: [spdetector3] F:\Spiele\Spyware Process Detector\spd322.exe TRAY File not found
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] f:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3FE1837E-A7A5-454D-AF63-834A229B0B55}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AC9CBB97-2633-4264-93F3-82DF373F475C}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{61170929-13a0-11e1-8fb8-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{61170929-13a0-11e1-8fb8-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{a3657d68-9a94-11e1-aa06-90e6ba1df6b9}\Shell - "" = AutoRun
O33 - MountPoints2\{a3657d68-9a94-11e1-aa06-90e6ba1df6b9}\Shell\AutoRun\command - "" = E:\launcher.exe
O33 - MountPoints2\{b5fba9fa-3db7-11e1-a19f-90e6ba1df6b9}\Shell - "" = AutoRun
O33 - MountPoints2\{b5fba9fa-3db7-11e1-a19f-90e6ba1df6b9}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.16 22:54:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\Malwarebytes
[2012.07.16 22:54:37 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.16 22:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.16 22:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.16 22:39:27 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Stephen\Desktop\OTL.exe
[2012.07.16 13:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2012.07.12 13:23:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jagged Alliance 2 Unfinished Business
[2012.07.12 13:20:32 | 000,305,664 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[2012.07.11 15:59:25 | 000,000,000 | ---D | C] -- C:\Windows\Robin Hood 1.0
[2012.07.11 14:38:54 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 14:38:54 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 14:38:49 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 14:38:44 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.07.11 14:38:44 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.07.11 14:38:38 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 14:38:38 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.10 22:41:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\LucasArts
[2012.07.10 22:41:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\LucasArts
[2012.07.10 19:38:12 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\SIX_Projects
[2012.07.10 13:09:45 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\ArmA 2 Other Profiles
[2012.07.10 13:02:38 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\six-zsync
[2012.07.10 13:02:38 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\six-updater
[2012.07.10 13:00:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects
[2012.07.10 12:59:41 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Downloaded Installations
[2012.07.10 12:57:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.07.10 12:46:12 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\ArmA 2 OA
[2012.07.10 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\ArmA 2
[2012.07.10 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\ArmA 2
[2012.07.10 12:34:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2012.07.08 14:44:55 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Activision
[2012.07.05 00:52:25 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2012.06.26 13:23:50 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Macromedia
[2012.06.26 11:42:59 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.06.25 18:40:19 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.25 18:40:19 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.25 18:40:18 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.25 18:40:11 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.25 18:40:11 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.25 18:40:11 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.25 18:40:00 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.25 18:40:00 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.16 23:05:13 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.16 23:05:13 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.16 23:05:13 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.16 23:00:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.16 23:00:42 | 2140,495,871 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.16 22:54:38 | 000,000,754 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.16 15:20:25 | 004,503,728 | ---- | M] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.16 13:50:35 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 13:50:35 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 13:33:39 | 000,000,926 | ---- | M] () -- C:\Users\Stephen\Desktop\HijackThis.lnk
[2012.07.12 13:23:50 | 000,000,604 | ---- | M] () -- C:\Users\Public\Desktop\Jagged Alliance 2 Unfinished Business.lnk
[2012.07.12 12:33:46 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 23:57:07 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Stephen\Desktop\OTL.exe
[2012.07.10 19:08:40 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk
[2012.07.10 19:08:40 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk
[2012.07.10 18:50:12 | 000,001,468 | ---- | M] () -- C:\Users\Stephen\Desktop\Day Z.lnk
[2012.07.10 00:38:16 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\ARMA 2.url
[2012.07.10 00:38:16 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\ARMA 2 Operation Arrowhead.url
[2012.07.08 11:49:20 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops - Multiplayer.url
[2012.07.07 17:48:33 | 002,037,347 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-696708.png
[2012.07.07 17:43:26 | 000,085,397 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-141766.jpg
[2012.07.07 17:43:12 | 001,495,389 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-44535.jpg
[2012.07.07 17:11:51 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops.url
[2012.07.07 14:57:09 | 000,156,950 | ---- | M] () -- C:\Users\Stephen\Desktop\2012_07_07 - Informationen Landeslager 2012.pdf
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.03 13:34:29 | 000,200,489 | ---- | M] () -- C:\Users\Stephen\Desktop\Foto.jpg
[2012.07.03 13:34:29 | 000,002,130 | ---- | M] () -- C:\Users\Stephen\.recently-used.xbel
[2012.06.27 13:59:59 | 002,155,392 | ---- | M] () -- C:\Users\Stephen\Desktop\2010_10 - Kirchentag 2010 - Thomas Weyh - 082.jpg
[2012.06.26 11:42:59 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.06.26 11:42:59 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.16 22:54:38 | 000,000,754 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.16 13:33:39 | 000,000,926 | ---- | C] () -- C:\Users\Stephen\Desktop\HijackThis.lnk
[2012.07.16 13:19:14 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad
[2012.07.12 13:23:50 | 000,000,604 | ---- | C] () -- C:\Users\Public\Desktop\Jagged Alliance 2 Unfinished Business.lnk
[2012.07.10 18:50:12 | 000,001,468 | ---- | C] () -- C:\Users\Stephen\Desktop\Day Z.lnk
[2012.07.10 13:00:18 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk
[2012.07.10 13:00:18 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk
[2012.07.10 00:38:16 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\ARMA 2.url
[2012.07.10 00:38:16 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\ARMA 2 Operation Arrowhead.url
[2012.07.08 11:49:20 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops - Multiplayer.url
[2012.07.07 17:48:32 | 002,037,347 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-696708.png
[2012.07.07 17:43:25 | 000,085,397 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-141766.jpg
[2012.07.07 17:43:10 | 001,495,389 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-44535.jpg
[2012.07.07 17:11:51 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops.url
[2012.07.07 14:57:09 | 000,156,950 | ---- | C] () -- C:\Users\Stephen\Desktop\2012_07_07 - Informationen Landeslager 2012.pdf
[2012.07.03 13:34:29 | 000,200,489 | ---- | C] () -- C:\Users\Stephen\Desktop\Foto.jpg
[2012.07.03 13:34:29 | 000,002,130 | ---- | C] () -- C:\Users\Stephen\.recently-used.xbel
[2012.06.27 13:59:57 | 002,155,392 | ---- | C] () -- C:\Users\Stephen\Desktop\2010_10 - Kirchentag 2010 - Thomas Weyh - 082.jpg
[2012.06.14 21:42:33 | 000,007,552 | ---- | C] () -- C:\Windows\SysWow64\drivers\enodpl.sys
[2012.06.14 21:42:33 | 000,004,736 | ---- | C] () -- C:\Windows\SysWow64\drivers\tandpl.sys
[2012.04.27 13:09:59 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI
[2012.04.27 13:09:59 | 000,000,151 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2012.04.27 13:09:59 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\brlmw03a.ini
[2012.04.27 13:09:59 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2012.04.27 13:09:54 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.04.27 13:09:34 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\bd2030.dat
[2012.04.27 13:09:19 | 000,000,324 | ---- | C] () -- C:\Windows\Brownie.ini
[2012.03.27 18:44:45 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll
[2012.03.27 18:44:45 | 000,000,606 | ---- | C] () -- C:\Windows\Cm106.ini.cfl
[2012.03.27 18:44:38 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg
[2012.03.27 18:44:38 | 000,001,111 | ---- | C] () -- C:\Windows\Cm106.ini.imi
[2012.03.27 18:44:38 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini
[2011.12.12 15:09:02 | 000,007,605 | ---- | C] () -- C:\Users\Stephen\AppData\Local\Resmon.ResmonCfg
[2011.11.21 21:29:11 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.11.21 21:29:09 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== LOP Check ==========
 
[2012.05.10 21:14:57 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\DAEMON Tools Lite
[2011.11.20 20:29:53 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Firefly Studios
[2012.07.03 13:34:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\gtk-2.0
[2012.07.12 19:55:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Mumble
[2012.02.07 13:54:20 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\OpenOffice.org
[2011.11.20 20:37:42 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Origin
[2012.07.10 19:38:28 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\six-updater
[2012.07.10 13:02:38 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\six-zsync
[2011.11.20 21:21:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Thunderbird
[2011.12.18 21:30:37 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\TS3Client
[2012.07.15 19:18:19 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
Extras.txt:

Code:
ATTFilter
OTL Extras logfile created on: 16.07.2012 23:17:26 - Run 3
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Stephen\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,99 Gb Total Physical Memory | 6,99 Gb Available Physical Memory | 87,47% Memory free
15,98 Gb Paging File | 15,07 Gb Available in Paging File | 94,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 62,40 Gb Total Space | 18,23 Gb Free Space | 29,21% Space Free | Partition Type: NTFS
Drive D: | 37,49 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 235,59 Gb Total Space | 36,46 Gb Free Space | 15,48% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 424,53 Gb Free Space | 45,57% Space Free | Partition Type: NTFS
 
Computer Name: WINTENDO | User Name: Stephen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027451E6-F052-4CF7-AE1D-62942660B277}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{08B9A03A-1388-46E7-9DE1-6AA033B6EF9B}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe | 
"{0DBA2BD6-55C7-4678-BF4D-DA67FE1142BB}" = protocol=17 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe | 
"{0F87BEAB-B66C-4277-B96F-747D69611FFF}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{0F90104C-0F88-4C26-8530-BCEDF74684D6}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{180B684A-93B7-442D-9382-F28E4E47FEFF}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"{22350A5F-E0BB-4BCC-AC76-477162271E39}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{228C8C18-3155-4162-A381-1FFCC34AA5D3}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2\arma2.exe | 
"{25810D1F-1075-42F0-A9C9-7A0F6CC6E443}" = protocol=17 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe | 
"{25E7FBFD-9ABF-4250-94C9-BB3908640B48}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{29CD95B5-6BB2-4E81-918E-3EA37F96C644}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{3042F64E-64A0-48AB-A291-AE9CCA7BA143}" = protocol=17 | dir=in | app=f:\spiele\dragon age\daoriginslauncher.exe | 
"{318E62F2-6D65-4110-85BE-37135720CB4C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{3F6C98C1-26E9-47B1-9FFD-7EE12EE9C745}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe | 
"{413C26BA-6D22-4462-87B8-D205F28F79A6}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{46A6D998-C39B-46C4-A0AA-9074C36AEE1E}" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\daupdatersvc.service.exe | 
"{4C327D12-65C8-4C7A-85F7-9864AC4699C3}" = protocol=6 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe | 
"{4D8097AC-5156-4DEA-ABD4-EFF8F059CA83}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"{500A768E-9F96-44F6-A477-45C1CC4680E4}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{54999449-5A06-4396-9659-84CA1DC26509}" = protocol=17 | dir=in | app=f:\spiele\steam\steam.exe | 
"{5566C16B-73CF-479C-A8DA-F3F3DFCF4D87}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{55D2AF4F-9908-41CF-A3B9-07674CE360DA}" = protocol=17 | dir=in | app=f:\spiele\origin\dragon age ii\dragonage2launcher.exe | 
"{56EEBE52-0182-46E4-BCA6-94AD8E2F85D7}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{57D3909E-A1B4-48E1-9A22-03778CDC5529}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2\arma2.exe | 
"{5A6BF72B-27ED-4508-879A-5307F3CC869C}" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\daupdatersvc.service.exe | 
"{61134A4D-E671-46AF-A4EB-ED04B45959CA}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{65627542-091A-43E6-91DE-CEC7A9BF02BE}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"{65E5D860-CE44-46E6-A1FC-7CD5A918D0B9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{6B64A522-484A-4D98-B22D-840D523E4323}" = protocol=6 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe | 
"{7673F7CD-42B9-4AA4-B2D6-45D31199C842}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{79937271-37D7-4851-9937-6A57B382C262}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{7DF03487-A2DB-4F52-9ABE-31F86720D922}" = protocol=17 | dir=in | app=f:\spiele\origin\origin.exe | 
"{88597EEB-1759-4B99-98E7-7C2A1AD9DA90}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{8A9D947E-81A0-4336-AD9E-9A5411573621}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{8B89D069-54AE-40EE-89B0-78EC2FE5CD7C}" = protocol=6 | dir=in | app=f:\spiele\dragon age\daoriginslauncher.exe | 
"{8BC8EAD1-D757-4CD0-AFC9-02BE71166F56}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"{93079DDA-091F-40B4-B7BA-D6E587699C3C}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"{95888643-2D5B-4189-9A97-34DFBBF0D15B}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{9CB4A215-83CA-48E9-8223-8583A907A33B}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{9ED901BC-692C-4EBC-A4E5-CE1DEDA0878D}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{A53E61AD-78B9-4D86-BA22-EA6BABC1D72E}" = protocol=6 | dir=in | app=f:\spiele\origin\dragon age ii\dragonage2launcher.exe | 
"{A78E400E-D480-4C00-847F-652FEDBA3F5F}" = dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe | 
"{AC4D4C88-0E49-47AD-B63D-C67BBE30323D}" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\daorigins.exe | 
"{B105D390-6F9C-45BA-9C32-3ED3B350506E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B9CF66FB-57ED-4805-A27F-80D16DB837EA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{BAACAD87-96E5-4EA7-BDEC-F38088AB115A}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{BF193458-FA7F-4B72-8669-DEAB4335B4D4}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{C3E20DA0-BABC-4571-819D-01C00D56616B}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe | 
"{C6224BFD-D71C-438B-A0DE-C54316D8A53A}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{C8C0C5B5-C8DC-42E2-9DFA-D592F38C9ADA}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{D149632F-329D-4B9A-8A00-ACEC3604D5F0}" = protocol=6 | dir=in | app=f:\spiele\origin\origin.exe | 
"{D2D7E517-D0A0-41F8-A2B6-217BDE980140}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{DEFFADF6-1A32-44CA-AF0A-24C4B130812C}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{E3D5B7C5-1DBD-4604-AA93-BE1297A5ABC8}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe | 
"{E8854269-3EE0-4044-9987-9533A4CAA5F0}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{EAFFC1AB-CBBA-434D-9311-9E3ACE5D058C}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{EC4892EF-0E6D-4993-A5A9-3ABCB07868B4}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe | 
"{ED0D1FBB-7C9F-455F-BC14-C1AB7241BF29}" = protocol=17 | dir=in | app=f:\spiele\origin\dragon age ii\bin_ship\dragonage2.exe | 
"{F06334BF-B1A1-45AB-BB94-C734E339DF02}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe | 
"{F0D8DE4A-5A91-46B4-9F65-C7859694AEC4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{F11B9749-A66F-4E03-85E0-CB3DC76D1AD9}" = protocol=6 | dir=in | app=f:\spiele\steam\steam.exe | 
"{FA3D2268-1152-431D-9C3F-B41C8BD51AA5}" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\daorigins.exe | 
"{FA7D0EAF-7035-45BB-9E1C-C5F62BEB7227}" = protocol=6 | dir=in | app=f:\spiele\origin\dragon age ii\bin_ship\dragonage2.exe | 
"{FCF3FBE7-C082-4715-B4BF-5D227E309A3B}" = dir=in | app=f:\programme\itunes\itunes.exe | 
"{FD6DA577-2806-4DBB-AA83-D094D4214434}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{FF7A2437-7EDF-4771-BF4B-AD23F741E48D}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe | 
"TCP Query User{141A0693-D5B9-467B-B215-421D3F18223F}F:\spiele\six projects\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=f:\spiele\six projects\six updater\tools\bin\rsync.exe | 
"TCP Query User{34AF3E86-DD39-4590-94C6-ECA5F540B5D3}F:\spiele\dragon age\bin_ship\eacoreserver.exe" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\eacoreserver.exe | 
"TCP Query User{84650A9F-BE15-48FE-893D-16F060C33D87}F:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"TCP Query User{ACE2BBFC-902A-49BB-A722-676C5978FC89}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{AE09CC18-B536-4AFF-B8DD-A69816EB5E03}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{0833EF93-02D2-4490-B801-8276AC536338}F:\spiele\six projects\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=f:\spiele\six projects\six updater\tools\bin\rsync.exe | 
"UDP Query User{53A01890-77D4-4C13-A84F-042ED4A33EB9}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{56A9D6E6-8E13-481A-AADA-46875F8F9CAF}F:\spiele\dragon age\bin_ship\eacoreserver.exe" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\eacoreserver.exe | 
"UDP Query User{681097DF-D70A-455C-9CB7-47A4FCBA87BD}F:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"UDP Query User{C55314AF-F50C-4469-B3C7-7A794D86151D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"C-Media CM106 Like Sound Driver" = MEDUSA NX USB 5.1 Gaming Headset
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D565319-8B91-41CB-961C-0DDC86101AC5}" = Dragon Age II
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{BAF227A2-E214-49E3-9137-94A300EA85BA}" = iPhone-Konfigurationsprogramm
"{C3E9887A-23BA-4777-8080-191A5AFCAB74}" = Mumble 1.2.3
"{D08A5DFE-F0C2-74FC-DD56-A3B371E9344D}" = EA Shared Game Component: Activation
"{D1D632A2-E249-466D-A094-B1B934D37645}_is1" = Stronghold Kingdoms
"{D4F9AFB7-40AB-494F-AEEB-67EF8DC8A609}" = Brother HL-2035
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Assassins Creed: Revelations Rip_is1" = Assassins Creed Revelations
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for A2" = BattlEye Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"com.ea.Activation.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Shared Game Component: Activation
"DAEMON Tools Lite" = DAEMON Tools Lite
"EA Installer.283229647" = EA Installer
"ESN Sonar-0.70.4" = ESN Sonar
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"Fraps" = Fraps (remove only)
"FUSSBALL MANAGER 12" = FUSSBALL MANAGER 12
"HijackThis" = HijackThis 2.0.2
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"Jagged Alliance 2: Unfinished Business" = Jagged Alliance 2: Unfinished Business
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 8980" = Borderlands
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 1.1.11
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 13.0.1 (x86 de)" = Mozilla Thunderbird 13.0.1 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.07.2012 07:17:30 | Computer Name = Wintendo | Source = Application Error | ID = 1000
Description = Faulting application name: arma2oa.exe, version: 1.60.94.444, time
 stamp: 0x4ff2ff98  Faulting module name: arma2oa.exe, version: 1.60.94.444, time 
stamp: 0x4ff2ff98  Exception code: 0xc0000005  Fault offset: 0x002a1b23  Faulting process
 id: 0x1b5c  Faulting application start time: 0x01cd5e8c0c74728c  Faulting application
 path: F:\Spiele\Steam\steamapps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Faulting
 module path: F:\Spiele\Steam\steamapps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Report
 Id: d5fb3eaa-ca80-11e1-8bfe-90e6ba1df6b9
 
Error - 10.07.2012 12:32:16 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.07.2012 01:31:43 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.07.2012 06:35:15 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.07.2012 05:23:28 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 15.07.2012 13:19:57 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.07.2012 05:49:51 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.07.2012 07:44:27 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.07.2012 16:39:14 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
Error - 16.07.2012 17:02:22 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 16.07.2012 16:38:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 16:38:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 16:38:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 16:39:24 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 17:00:25 | Computer Name = Wintendo | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .
 
Error - 16.07.2012 17:01:02 | Computer Name = Wintendo | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avipbb  avkmgr  discache  spldr  Wanarpv6
 
Error - 16.07.2012 17:01:08 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 17:01:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 17:01:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
Error - 16.07.2012 17:01:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description = 
 
 
< End of report >
Danke schon mal im vorhinein für eure Mühen.

Gruß Daweyh
Geändert von Daweyh (16.07.2012 um 22:41 Uhr)

Alt 18.07.2012, 19:55   #2
markusg
/// Malware-holic
 
Pc gesperrt durch GVU 2.07 - Standard

Pc gesperrt durch GVU 2.07


hi
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________

__________________
Alt 19.07.2012, 02:14   #3
Daweyh
 
Pc gesperrt durch GVU 2.07 - Standard

Pc gesperrt durch GVU 2.07


Hey ich habe Combofix nun durchlaufen lassen.
Er hat sich beschwert das Antivir noch laufen würde obwohl Antivir und auch alle anderen Anti viren, Malware etc prozesse gestoppt waren.

Falls es wichtig ist ich arbeite im Moment nur im abgesicherten Modus.

Hier die Logdatei:

Code:
ATTFilter
ComboFix 12-07-18.04 - Stephen 19.07.2012   3:03.1.8 - x64 NETWORK
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1033.18.8183.7268 [GMT 2:00]
ausgeführt von:: c:\users\Stephen\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\usgwmt
c:\windows\usgwmt\BReWErS.dll
G:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-19 bis 2012-07-19  ))))))))))))))))))))))))))))))
.
.
2012-07-17 18:49 . 2004-10-15 16:32	14568	----a-w-	c:\windows\SysWow64\drivers\wg6n.sys
2012-07-17 18:49 . 2004-10-15 16:32	14568	----a-w-	c:\windows\SysWow64\drivers\wg5n.sys
2012-07-17 18:49 . 2004-10-15 16:32	14568	----a-w-	c:\windows\SysWow64\drivers\wg4n.sys
2012-07-17 18:49 . 2004-10-15 16:32	14568	----a-w-	c:\windows\SysWow64\drivers\wg3n.sys
2012-07-17 18:49 . 2004-10-15 16:18	21075	----a-w-	c:\windows\SysWow64\drivers\wpsdrvnt.sys
2012-07-17 18:49 . 2004-10-15 16:17	60496	----a-w-	c:\windows\SysWow64\drivers\Teefer.sys
2012-07-17 18:49 . 2004-10-15 16:32	83096	----a-w-	c:\windows\SysWow64\SSSensor.dll
2012-07-17 18:38 . 2012-06-29 10:04	9133488	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD4B000C-83F1-41FC-AB44-383FA9FE40B6}\mpengine.dll
2012-07-16 22:00 . 2012-07-16 22:00	--------	d-----w-	c:\users\Dokumente und Einstellungen
2012-07-16 20:54 . 2012-07-16 20:54	--------	d-----w-	c:\users\Stephen\AppData\Roaming\Malwarebytes
2012-07-16 20:54 . 2012-07-16 20:54	--------	d-----w-	c:\programdata\Malwarebytes
2012-07-16 20:54 . 2012-07-03 11:46	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-07-11 19:24 . 2012-06-12 03:08	3148800	----a-w-	c:\windows\system32\win32k.sys
2012-07-11 13:59 . 2012-07-11 13:59	--------	d-----w-	c:\windows\Robin Hood 1.0
2012-07-10 20:41 . 2012-07-10 20:41	--------	d-----w-	c:\users\Stephen\AppData\Local\LucasArts
2012-07-10 17:38 . 2012-07-10 17:38	--------	d-----w-	c:\users\Stephen\AppData\Local\SIX_Projects
2012-07-10 11:02 . 2012-07-10 17:38	--------	d-----w-	c:\users\Stephen\AppData\Roaming\six-updater
2012-07-10 11:02 . 2012-07-10 11:02	--------	d-----w-	c:\users\Stephen\AppData\Roaming\six-zsync
2012-07-10 10:59 . 2012-07-10 17:07	--------	d-----w-	c:\users\Stephen\AppData\Local\Downloaded Installations
2012-07-10 10:57 . 2012-07-10 10:57	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2012-07-10 10:46 . 2012-07-12 14:47	--------	d-----w-	c:\users\Stephen\AppData\Local\ArmA 2 OA
2012-07-10 10:34 . 2012-07-10 10:35	--------	d-----w-	c:\users\Stephen\AppData\Local\ArmA 2
2012-07-08 12:44 . 2012-07-08 12:44	--------	d-----w-	c:\users\Stephen\AppData\Local\Activision
2012-07-04 22:52 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2012-06-26 11:23 . 2012-06-26 11:23	--------	d-----w-	c:\users\Stephen\AppData\Local\Macromedia
2012-06-26 09:42 . 2012-07-18 10:37	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-25 16:40 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-25 16:40 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-25 16:40 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-25 16:40 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-25 16:40 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-25 16:40 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-25 16:40 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-25 16:40 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-25 16:40 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-18 10:37 . 2011-11-20 18:24	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 19:15 . 2011-12-17 16:05	59701280	----a-w-	c:\windows\system32\MRT.exe
2012-05-31 10:25 . 2010-11-21 03:27	279656	------w-	c:\windows\system32\MpSigStub.exe
2012-05-15 04:01 . 2012-06-14 17:06	1188864	----a-w-	c:\windows\system32\wininet.dll
2012-05-15 03:59 . 2012-06-14 17:06	64512	----a-w-	c:\windows\system32\jsproxy.dll
2012-05-15 03:03 . 2012-06-14 17:06	981504	----a-w-	c:\windows\SysWow64\wininet.dll
2012-05-10 11:36 . 2011-12-28 11:36	560184	----a-w-	c:\windows\system32\drivers\sptd.sys
2012-05-08 11:20 . 2011-11-20 18:14	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-05-08 11:20 . 2011-11-20 18:14	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-05-04 11:06 . 2012-06-14 17:05	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 17:05	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 17:05	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-04-28 05:32 . 2012-06-14 17:05	1112064	----a-w-	c:\windows\system32\rdpcorets.dll
2012-04-28 03:55 . 2012-06-14 17:05	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 17:06	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 17:06	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 17:06	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-04-20 05:42 . 2012-06-14 17:06	1494016	----a-w-	c:\windows\system32\urlmon.dll
2012-04-20 05:42 . 2012-06-14 17:06	134144	----a-w-	c:\windows\system32\url.dll
2012-04-20 05:42 . 2012-06-14 17:06	9059840	----a-w-	c:\windows\system32\mshtml.dll
2012-04-20 05:42 . 2012-06-14 17:06	735744	----a-w-	c:\windows\system32\msfeeds.dll
2012-04-20 05:42 . 2012-06-14 17:06	97792	----a-w-	c:\windows\system32\mshtmled.dll
2012-04-20 05:42 . 2012-06-14 17:06	12297216	----a-w-	c:\windows\system32\ieframe.dll
2012-04-20 05:42 . 2012-06-14 17:06	247808	----a-w-	c:\windows\system32\ieui.dll
2012-04-20 05:42 . 2012-06-14 17:06	2454528	----a-w-	c:\windows\system32\iertutil.dll
2012-04-20 03:45 . 2012-06-14 17:06	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2012-04-20 03:16 . 2012-06-14 17:06	1638912	----a-w-	c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="f:\programme\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="f:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="f:\programme\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"Malwarebytes' Anti-Malware"="f:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"SmcService"="f:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111v3 Setup-Assistent.lnk - f:\programme\Netgear\WG111v3.exe [2009-11-6 2080768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-19 27760]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
R2 AntiVirSchedulerService;Avira Planer;f:\programme\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;f:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 250056]
R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;f:\spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-21 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-21 88960]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-21 34816]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [2009-10-01 1307648]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2009-11-18 446976]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 10:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.hiergehtslos.de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.eintracht.de/aktuell/
FF - prefs.js: keyword.URL - hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-spdetector3 - f:\spiele\Spyware Process Detector\spd322.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-BattlEye for A2 - f:\spiele\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
AddRemove-BattlEye for OA - f:\spiele\steam\steamapps\common\arma 2 operation arrowheadExpansion\BattlEye\UnInstallBE.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsdatant]
"ImagePath"=""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-07-19  03:10:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-19 01:10
.
Vor Suchlauf: 18.636.705.792 bytes free
Nach Suchlauf: 20.782.657.536 bytes free
.
- - End Of File - - 04D688955143A9DEE208FBB191BC775F
Gruß Daweyh
__________________
Alt 20.07.2012, 19:56   #4
markusg
/// Malware-holic
 
Pc gesperrt durch GVU 2.07 - Standard

Pc gesperrt durch GVU 2.07


der normalemodus sollte gehen, testen bitte.
falls ja:
lade den CCleaner standard:
CCleaner Download - CCleaner 3.20.1750
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Pc gesperrt durch GVU 2.07
autorun, avira, bho, black, bonjour, call of duty, converter, ctfmon.lnk, defender, error, failed, firefox, flash player, format, heuristiks/extra, heuristiks/shuriken, hijack, install.exe, jdownloader, langs, launch, mozilla, netgear, nvidia update, object, plug-in, realtek, registry, rundll, scan, searchscopes, security, software, spyware, teamspeak, thomas, trojaner, trojaner gvu, udp, usb 2.0


« TR/Ransom.294912 (Antivir) / Trojan-Ransom.Win32.Gimemo.vyp (Kaspersky) | Trojaner deaktivieren Sicherheitscenter, Windows-Update und Virenscanner »


Ähnliche Themen: Pc gesperrt durch GVU 2.07


  1. Computer gesperrt durch GVU
    Plagegeister aller Art und deren Bekämpfung - 04.07.2015 (12)
  2. PC durch Bundespolizei gesperrt
    Log-Analyse und Auswertung - 20.11.2013 (1)
  3. Computer gesperrt durch die GVU
    Log-Analyse und Auswertung - 29.05.2013 (8)
  4. Rechner gesperrt durch BKA Trojaner
    Log-Analyse und Auswertung - 12.02.2013 (5)
  5. computer gesperrt durch bundespolizei
    Plagegeister aller Art und deren Bekämpfung - 29.01.2013 (2)
  6. Laptop mit Windows xp gesperrt durch Bundespolizei, Entsperrung nur durch Geld
    Log-Analyse und Auswertung - 25.01.2013 (34)
  7. Mein Pc ist durch GVU gesperrt worden
    Plagegeister aller Art und deren Bekämpfung - 02.01.2013 (3)
  8. Mein Pc ist durch GVU gesperrt
    Antiviren-, Firewall- und andere Schutzprogramme - 30.12.2012 (2)
  9. PC angeblich gesperrt durch Bundespolizei
    Plagegeister aller Art und deren Bekämpfung - 07.10.2012 (6)
  10. Computer gesperrt durch Bundespolizei
    Plagegeister aller Art und deren Bekämpfung - 04.10.2012 (35)
  11. Computer gesperrt durch die "Bundespolizei", entsperrung durch Geld
    Plagegeister aller Art und deren Bekämpfung - 27.09.2012 (22)
  12. Gesperrt durch automatische Informationskontrolle
    Log-Analyse und Auswertung - 24.09.2012 (11)
  13. Computer gesperrt durch Bundespolizei
    Log-Analyse und Auswertung - 06.09.2012 (8)
  14. Windows gesperrt durch Trojaner
    Log-Analyse und Auswertung - 31.03.2012 (33)
  15. Windows gesperrt durch Trojaner
    Log-Analyse und Auswertung - 26.03.2012 (7)
  16. Laptop gesperrt durch Virus gesperrt. Zahlung von 50 Euro etc.
    Plagegeister aller Art und deren Bekämpfung - 17.12.2011 (7)
  17. Ports durch virus gesperrt?
    Mülltonne - 13.12.2008 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Pc gesperrt durch GVU 2.07 - Hallo ich habe mir heute Mittag leider den Trojaner GVU 2.07 eingefangen und seitdem sperrt sich mein PC immer wieder. Die ersten Schritte habe ich bereits abgearbeitet und die Logfiles - Pc gesperrt durch GVU 2.07...
Archiv
Du betrachtest: Pc gesperrt durch GVU 2.07 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131