| |
| |||||||
Log-Analyse und Auswertung: UPDATE SCHRITT 2! Fakeseiten, Umleitung Google, Potentielle Bedrohungen, MSE spacktWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
28.07.2012, 15:13
| #1 | ||
 |  UPDATE SCHRITT 2! Fakeseiten, Umleitung Google, Potentielle Bedrohungen, MSE spackt Hallo, Lang ists her, aber nach fast 2 Jahren habe ich mir endlich mal wieder was eingefangen.  Beschreibung der Probleme: - Google Link leiten mich auf Werbeseiten um (Freshweather) - Firewall hat sich automatisch deaktiviert und kann nicht mehr aktiviert werden - Im Internet kommt immer ein Pop-Up vom Adobeflashplayer zur aktualisierung (ist aktuell) - Microsoft Security Essentials steckt irgendwas in Quarantäne finden aber immer wieder neue Bedrohungen vom gleichen oder nähnlichen Typ ( serife.b, serife.p, serife.2 etc.) - MSE zwingt mich zum Neustart innerhalb einer Minute nach Start (Ich musste es innerhalb einer Minute deinstallieren zum weitermachen. Hab drei Versuche gebraucht) - Desktopsymbolanordnung wird bei Neustart resetet SCHRITT 1 defogger-Log: Zitat:
SCHRITT 2 OTL.txt: OTL Logfile: Code:
ATTFilter OTL logfile created on: 28.07.2012 16:54:16 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Jerekin\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 73,75% Memory free 7,71 Gb Paging File | 6,60 Gb Available in Paging File | 85,61% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 452,34 Gb Total Space | 127,71 Gb Free Space | 28,23% Space Free | Partition Type: NTFS Drive D: | 1,99 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: BAZOOKA | User Name: Jerekin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Jerekin\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\SysWOW64\PnkBstrB.exe () PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Synaptics\Scrybe\Service\ScrybeUpdater.exe (Synaptics, Inc.) PRC - C:\Program Files (x86)\Verbindungsassistent\WTGService.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY) ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (PnkBstrB) -- C:\Windows\SysWOW64\PnkBstrB.exe () SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (Netzmanager Service) -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (ScrybeUpdater) -- C:\Program Files (x86)\Synaptics\Scrybe\Service\ScrybeUpdater.exe (Synaptics, Inc.) SRV - (WTGService) -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe () SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Media Jukebox 14 Service) -- C:\Program Files (x86)\J River\Media Jukebox 14\JRService.exe (J. River, Inc.) SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ABBYY.Licensing.FineReader.Sprint.9.0) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY) ========== Driver Services (SafeList) ========== DRV:64bit: - (ekjzlipx) -- C:\Windows\SysNative\drivers\ekjzlipx.sys (Microsoft Corporation) DRV:64bit: - (tkpnvhly) -- C:\Windows\SysNative\drivers\tkpnvhly.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (LGSHidFilt) -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys (Logitech Inc.) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV:64bit: - (ew_hwusbdev) -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.) DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (PcaSp60) -- C:\Windows\SysNative\drivers\PcaSp60.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.) DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.) DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.) DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.) DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.) DRV:64bit: - (risdsnpe) -- C:\Windows\SysNative\drivers\risdsne64.sys (REDC) DRV:64bit: - (rimspci) -- C:\Windows\SysNative\drivers\rimssne64.sys (REDC) DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.) DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (hwdatacard) -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ew_hwusbdev) -- C:\Windows\SysWOW64\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (TelekomNM6) -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) DRV - (PcaSp60) -- C:\Windows\SysWOW64\drivers\PcaSp60.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=112036&tt=220512_53ctrl&babsrc=HP_ss&mntrId=eaba90150000000000007edd08bc7e56 IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112036&tt=220512_53ctrl&babsrc=SP_ss&mntrId=eaba90150000000000007edd08bc7e56 IE - HKCU\..\SearchScopes\{4BE7DB8D-D9C4-4075-BD54-64E0A4737253}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SVEE_enDE402 IE - HKCU\..\SearchScopes\{C87DB030-A17D-4986-9EC2-EDAEF6BA23E3}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363 IE - HKCU\..\SearchScopes\{DE156200-A1F6-4885-936D-E7CEBEC4AD9A}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=112036&tt=220512_53ctrl&babsrc=HP_ss&mntrId=eaba90150000000000007edd08bc7e56" FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=112036&tt=220512_53ctrl&babsrc=KW_ss&mntrId=eaba90150000000000007edd08bc7e56&q=" FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL File not found FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 00:40:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 00:40:26 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.18 15:46:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jerekin\AppData\Roaming\mozilla\Extensions [2012.06.06 14:22:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jerekin\AppData\Roaming\mozilla\Firefox\Profiles\c3grmaxn.default\extensions [2012.07.26 15:38:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jerekin\AppData\Roaming\mozilla\Firefox\Profiles\d3b1f67k.default\extensions [2012.07.26 15:40:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.07.16 17:56:38 | 000,186,203 | ---- | M] () (No name found) -- C:\USERS\JEREKIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D3B1F67K.DEFAULT\EXTENSIONS\ARTUR.DUBOVOY@GMAIL.COM.XPI [2012.07.19 00:40:26 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.13 14:10:48 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.05.30 18:18:10 | 000,002,356 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012.02.13 14:10:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.02.13 14:10:48 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.02.13 14:10:48 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.13 14:10:48 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.13 14:10:48 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.12.28 15:04:17 | 000,000,698 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8:64bit: - Extra context menu item: Download All by ASUS Download - C:\Program Files (x86)\ASUS\RT-N56U Wireless Router Utilities\ASDownloadAll.htm () O8:64bit: - Extra context menu item: Download using ASUS Download - C:\Program Files (x86)\ASUS\RT-N56U Wireless Router Utilities\ASDownload.htm () O8 - Extra context menu item: Download All by ASUS Download - C:\Program Files (x86)\ASUS\RT-N56U Wireless Router Utilities\ASDownloadAll.htm () O8 - Extra context menu item: Download using ASUS Download - C:\Program Files (x86)\ASUS\RT-N56U Wireless Router Utilities\ASDownload.htm () O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\system32\wshbth.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\system32\wshbth.dll File not found O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.4.1) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.4.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC863AAA-54E2-4F05-A57B-5B003D0368DB}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3FA99C0-6D20-46D3-A571-87208C430CB4}: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.08.25 17:29:30 | 000,000,105 | R--- | M] () - D:\Autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.28 16:53:50 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Jerekin\Desktop\OTL.exe [2012.07.28 15:50:53 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\IcoFX [2012.07.28 15:50:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IcoFX 1.6 [2012.07.28 15:50:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IcoFX 1.6 [2012.07.28 15:42:53 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\Desktop\Murgrfh [2012.07.28 15:40:45 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\Desktop\music [2012.07.28 15:37:13 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA% [2012.07.28 15:32:49 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Larva Mortus [2012.07.28 15:32:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Larva Mortus [2012.07.28 15:32:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Larva Mortus [2012.07.28 00:08:42 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\mp3DirectCut [2012.07.28 00:01:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\mp3DirectCut [2012.07.27 07:47:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter [2012.07.27 07:47:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free M4a to MP3 Converter [2012.07.19 00:39:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.07.15 16:18:04 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Local\Logitech [2012.07.15 16:16:43 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd [2012.07.15 16:16:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech [2012.07.15 16:16:23 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech Gaming Software [2012.07.15 16:15:39 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\Logitech [2012.07.15 16:15:39 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\Logishrd [2012.07.14 16:05:35 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\Documents\Neuer Ordner (3) [2012.07.11 15:35:29 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\Desktop\GAYS [2012.07.11 14:28:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2012.07.10 23:18:17 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\Mp3tag [2012.07.10 23:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag [2012.07.10 23:18:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mp3tag [2012.06.30 11:26:55 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2012.06.29 22:39:30 | 000,000,000 | ---D | C] -- C:\ProgramData\VirtualizedApplications [2012.06.29 22:29:37 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\Synaptics [2012.06.29 22:28:02 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics [2012.06.29 22:27:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Scrybe [2012.06.29 22:27:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Synaptics [2012.06.29 22:27:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Synaptics [2012.06.29 22:27:22 | 001,424,944 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys [2012.06.29 22:27:22 | 000,225,576 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll [2012.06.29 22:27:22 | 000,148,264 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo9.dll [2012.06.29 22:27:22 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll [2012.06.29 22:27:21 | 000,411,432 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll [2012.06.29 22:27:21 | 000,274,728 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll [2012.06.29 22:27:21 | 000,218,408 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll [2012.06.29 22:27:21 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll [2012.06.29 22:25:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.06.29 22:08:45 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\AppData\Roaming\QuickStoresToolbar [2012.06.29 21:53:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmoK DelayDel [2012.06.29 21:53:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AmoK [2012.06.29 14:31:54 | 000,000,000 | ---D | C] -- C:\Users\Jerekin\Documents\Games [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.28 16:53:51 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Jerekin\Desktop\OTL.exe [2012.07.28 16:47:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.28 16:40:14 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.28 16:40:14 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.28 16:37:21 | 018,950,118 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.28 16:37:21 | 006,284,494 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.28 16:37:21 | 006,089,628 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.28 16:37:21 | 005,489,670 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.28 16:37:20 | 000,006,504 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.28 16:35:06 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.07.28 16:32:58 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.28 16:32:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.28 16:32:40 | 3106,480,128 | -HS- | M] () -- C:\hiberfil.sys [2012.07.28 16:18:28 | 000,000,020 | ---- | M] () -- C:\Users\Jerekin\defogger_reenable [2012.07.28 16:13:44 | 000,050,477 | ---- | M] () -- C:\Users\Jerekin\Desktop\Defogger.exe [2012.07.28 16:03:33 | 000,006,702 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.07.28 16:01:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.28 15:50:43 | 000,000,930 | ---- | M] () -- C:\Users\Jerekin\Desktop\IcoFX.lnk [2012.07.28 15:32:50 | 000,001,049 | ---- | M] () -- C:\Users\Jerekin\Desktop\Larva Mortus.lnk [2012.07.28 15:31:19 | 000,000,436 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics [2012.07.28 00:01:34 | 000,001,054 | ---- | M] () -- C:\Users\Jerekin\Desktop\mp3DirectCut.lnk [2012.07.27 07:47:43 | 000,001,052 | ---- | M] () -- C:\Users\Jerekin\Desktop\Free M4a to MP3 Converter.lnk [2012.07.19 01:39:40 | 001,452,444 | ---- | M] () -- C:\Users\Jerekin\Documents\posters1.pdf [2012.07.19 01:39:19 | 001,390,575 | ---- | M] () -- C:\Users\Jerekin\Documents\posters2.pdf [2012.07.11 21:22:34 | 000,592,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.10 23:18:08 | 000,000,978 | ---- | M] () -- C:\Users\Public\Desktop\Mp3tag.lnk [2012.07.09 18:20:58 | 008,914,489 | ---- | M] () -- C:\Users\Jerekin\Documents\watanabe.pdf [2012.07.08 15:34:38 | 000,607,829 | ---- | M] () -- C:\Users\Jerekin\Documents\INFINITYTableLayout.pdf [2012.07.03 13:08:06 | 000,001,544 | ---- | M] () -- C:\Users\Jerekin\Desktop\CoDWaW - Verknüpfung.lnk [2012.07.03 12:55:06 | 000,007,606 | ---- | M] () -- C:\Users\Jerekin\AppData\Local\resmon.resmoncfg [2012.06.29 22:28:09 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.06.29 15:59:53 | 000,001,434 | ---- | M] () -- C:\Users\Jerekin\Desktop\Frozen Throne.lnk [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.28 16:36:03 | 000,092,160 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\80000032.@ [2012.07.28 16:36:03 | 000,080,896 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\80000064.@ [2012.07.28 16:35:57 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\80000000.@ [2012.07.28 16:35:51 | 000,002,048 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\00000004.@ [2012.07.28 16:35:51 | 000,001,632 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\000000cb.@ [2012.07.28 16:18:27 | 000,000,020 | ---- | C] () -- C:\Users\Jerekin\defogger_reenable [2012.07.28 16:13:42 | 000,050,477 | ---- | C] () -- C:\Users\Jerekin\Desktop\Defogger.exe [2012.07.28 15:50:43 | 000,000,930 | ---- | C] () -- C:\Users\Jerekin\Desktop\IcoFX.lnk [2012.07.28 15:45:02 | 000,005,058 | ---- | C] () -- C:\Users\Jerekin\Desktop\cursor2 - Kopie.cur.png [2012.07.28 15:45:02 | 000,004,632 | ---- | C] () -- C:\Users\Jerekin\Desktop\cursor3 - Kopie.png [2012.07.28 15:41:50 | 000,005,058 | ---- | C] () -- C:\Users\Jerekin\Desktop\cursor2.png [2012.07.28 15:41:50 | 000,004,632 | ---- | C] () -- C:\Users\Jerekin\Desktop\cursor3.png [2012.07.28 15:41:50 | 000,002,094 | ---- | C] () -- C:\Users\Jerekin\Desktop\cursor1.png [2012.07.28 15:32:50 | 000,001,049 | ---- | C] () -- C:\Users\Jerekin\Desktop\Larva Mortus.lnk [2012.07.28 15:32:02 | 000,232,960 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\U\00000008.@ [2012.07.28 15:31:52 | 000,000,804 | ---- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\L\00000004.@ [2012.07.28 00:01:34 | 000,001,054 | ---- | C] () -- C:\Users\Jerekin\Desktop\mp3DirectCut.lnk [2012.07.27 07:47:43 | 000,001,052 | ---- | C] () -- C:\Users\Jerekin\Desktop\Free M4a to MP3 Converter.lnk [2012.07.19 01:39:19 | 001,390,575 | ---- | C] () -- C:\Users\Jerekin\Documents\posters2.pdf [2012.07.19 01:38:57 | 001,452,444 | ---- | C] () -- C:\Users\Jerekin\Documents\posters1.pdf [2012.07.10 23:18:08 | 000,000,978 | ---- | C] () -- C:\Users\Public\Desktop\Mp3tag.lnk [2012.07.09 18:20:58 | 008,914,489 | ---- | C] () -- C:\Users\Jerekin\Documents\watanabe.pdf [2012.07.08 15:34:38 | 000,607,829 | ---- | C] () -- C:\Users\Jerekin\Documents\INFINITYTableLayout.pdf [2012.07.03 13:08:06 | 000,001,544 | ---- | C] () -- C:\Users\Jerekin\Desktop\CoDWaW - Verknüpfung.lnk [2012.06.29 22:28:09 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf [2012.06.29 22:27:22 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll [2012.06.25 13:08:38 | 000,010,297 | ---- | C] () -- C:\Users\Jerekin\.recently-used.xbel [2012.06.20 20:48:27 | 000,024,855 | ---- | C] () -- C:\Users\Jerekin\Unbenansdgntsdfzh.jpg [2012.05.30 18:22:16 | 000,004,608 | ---- | C] () -- C:\Users\Jerekin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.01.11 22:06:12 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{dc2793eb-e5e5-291b-e5a8-911830229125}\@ [2012.01.11 22:06:12 | 000,002,048 | -HS- | C] () -- C:\Users\Jerekin\AppData\Local\{dc2793eb-e5e5-291b-e5a8-911830229125}\@ [2011.12.08 17:09:05 | 000,000,000 | ---- | C] () -- C:\Users\Jerekin\AppData\Local\{80DD44A3-7ECB-4B77-A210-69659CC6029D} [2011.11.25 17:22:58 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini [2011.11.25 11:27:00 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.11.21 10:09:27 | 000,000,076 | ---- | C] () -- C:\Windows\SysWow64\dtirc.dll [2011.09.16 13:31:22 | 000,001,098 | ---- | C] () -- C:\Users\Jerekin\Dokumente - Verknüpfung.lnk [2011.07.21 15:30:45 | 000,269,568 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2011.04.11 17:26:58 | 000,000,095 | ---- | C] () -- C:\Users\Jerekin\AppData\Local\fusioncache.dat [2011.04.11 00:27:30 | 000,215,104 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.04.11 00:27:14 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.04.11 00:27:14 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.01.02 01:00:19 | 000,006,702 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.01.01 00:32:31 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI [2010.12.29 14:55:22 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.12.29 14:55:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.12.29 14:55:22 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe [2010.12.29 14:55:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.12.29 14:55:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.12.08 23:54:29 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI [2010.11.06 11:18:22 | 000,059,719 | ---- | C] () -- C:\Windows\War3Unin.dat [2010.10.23 15:59:37 | 000,007,606 | ---- | C] () -- C:\Users\Jerekin\AppData\Local\resmon.resmoncfg [2010.10.08 08:55:10 | 000,002,023 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2011.08.18 22:07:22 | 000,000,000 | -HSD | M] -- C:\Users\Jerekin\AppData\Roaming\.# [2011.12.31 23:21:26 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\.minecraft [2011.07.31 14:51:59 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Auslogics [2012.05.30 18:18:05 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Babylon [2011.01.01 00:35:44 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\BITS [2011.03.31 16:33:03 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Clonk Rage [2011.05.03 23:41:37 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2012.05.08 13:54:26 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\DAEMON Tools Pro [2011.11.25 17:47:34 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\DVDVideoSoft [2011.11.25 17:23:04 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\EAC [2012.02.11 15:33:34 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Epson [2012.04.22 10:46:04 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\FDRLab [2011.01.01 00:42:15 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\FlashGet [2011.01.01 00:32:21 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\FlashGetBHO [2011.11.13 19:37:18 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\FreeAudioPack [2011.11.25 17:33:57 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\FreeFLVConverter [2012.06.20 21:02:44 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\gtk-2.0 [2012.07.28 15:53:02 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\IcoFX [2012.07.12 22:29:18 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\ICQ [2011.11.21 10:09:08 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\J River [2010.10.21 11:14:49 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\L4dOgerLauncher [2010.11.25 18:30:40 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Leadertech [2011.04.17 18:15:05 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\LolClient [2012.05.24 14:32:21 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\LolClient2 [2011.02.09 17:18:29 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien [2011.01.31 17:25:39 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Mount&Blade Warband [2011.07.08 18:03:29 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Mount&Blade With Fire and Sword [2012.07.28 00:08:43 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\mp3DirectCut [2012.07.28 00:19:52 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Mp3tag [2011.06.10 23:07:40 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\No Company Name [2011.11.13 19:49:53 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\OpenCandy [2011.02.28 14:02:46 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\OpenOffice.org [2012.06.29 22:08:46 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\QuickStoresToolbar [2011.08.19 19:33:53 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\runic games [2011.11.03 15:50:53 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Schnellstart-DVD [2010.10.24 17:39:27 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Silver Style Entertainment [2012.07.27 04:18:20 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\SoftGrid Client [2010.10.28 18:05:26 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Soldat [2012.06.29 22:29:37 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Synaptics [2012.05.30 18:51:54 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Systweak [2011.04.21 10:31:07 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\TeamViewer [2011.05.05 22:50:53 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\temp [2011.07.10 15:38:26 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\TP [2012.07.28 15:56:20 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\TS3Client [2011.10.08 17:20:21 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Ubisoft [2011.10.08 12:29:44 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\Verbindungsassistent [2011.11.25 11:56:48 | 000,000,000 | ---D | M] -- C:\Users\Jerekin\AppData\Roaming\XMedia Recode [2012.07.19 18:19:40 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Extra.txt: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 28.07.2012 16:54:16 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Jerekin\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,86 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 73,75% Memory free
7,71 Gb Paging File | 6,60 Gb Available in Paging File | 85,61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452,34 Gb Total Space | 127,71 Gb Free Space | 28,23% Space Free | Partition Type: NTFS
Drive D: | 1,99 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: BAZOOKA | User Name: Jerekin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{259FD439-13B0-0136-D0A0-FA89BB05831D}" = ccc-utility64
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{5BC83141-83DD-07BE-C940-04B385540F04}" = ATI Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"EPSON SX130 Series" = EPSON SX130 Series Printer Uninstall
"Logitech Gaming Software" = Logitech Gaming Software 8.30
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00B03993-F5A1-47B1-9C54-EC8FBDDDE17E}" = VAIO Care
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07441A52-E208-478A-92B7-5C337CA8C131}" = Remote Play mit PlayStation®3
"{07B7598E-1FB8-1A95-7A30-F534A55726B4}" = CCC Help Czech
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{147DFAD8-34C3-4DE1-9FCA-ACEFDE9EF810}" = Synaptics Gesture Suite featuring SYNAPTICS | Scrybe
"{159E5135-4BEA-52B7-8CDC-823F1ED6D8A5}" = CCC Help Spanish
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{21295604-BBCA-4A3E-B1D1-1B8A746C4A52}" = COMPUTERBILD App-Center
"{265F0D95-A883-7162-0458-B78085B6B693}" = Catalyst Control Center Graphics Light
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2F9D63BE-A891-4E39-AFB3-7402D486800C}" = VAIO Hardware Diagnostics
"{32A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7
"{35111E7A-03B9-25EC-F434-A1CD976907FC}" = CCC Help Chinese Traditional
"{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{427E8AD0-A4B1-D225-836E-CCB6068B490A}" = CCC Help French
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{44D25B45-5C0E-2187-6739-E2FA0E8AFE1D}" = CCC Help Portuguese
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E6DF745-C99E-909F-BCF0-B7C24A51E56E}" = CCC Help Japanese
"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight
"{528CA916-2209-4779-990A-11D749A49C4A}_is1" = Dead Island PreOrder Edition
"{5736590B-36C7-4881-5EBE-F9B390F00774}" = Catalyst Control Center Core Implementation
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A92468F-3ED8-4F96-A9E1-4F176C80EC29}" = VAIO Quick Web Access
"{61F569A3-1647-B6F4-08C8-40A011831827}" = CCC Help English
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65B138AE-F636-4D4C-BA5D-A06E21E47C53}" = Remote-Tastatur mit PlayStation 3
"{6A3F204B-323C-7E32-F890-A7308768728D}" = CCC Help Russian
"{7002773F-2A53-E9F2-E161-DB3DDA0F05BE}" = CCC Help Hungarian
"{70991E0A-1108-437E-BA7D-085702C670C0}" =
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{734B6C6C-4740-476F-BB0C-F7AF469EDBB2}" = Remote Play with PlayStation 3
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{76DECE17-BCF5-9640-2854-3CA049834A40}" = CCC Help Chinese Standard
"{7A63F0C4-6B2B-694C-ED72-D0670612BC29}" = CCC Help Swedish
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{803E4FA5-A940-4420-B89D-A8BC2E160247}" =
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" =
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" =
"{88001121-87E2-2104-F9F5-ECC15DFCA1E0}" = Catalyst Control Center Graphics Full Existing
"{89D02D94-ACBF-4AD8-B8B7-3B5114535F71}" = The Fall - Last Days of Gaia
"{8A17C27D-0325-400C-8AA9-DAA6B16CBD74}" = Epson Event Manager
"{8EB34C0B-AF54-F265-844C-3E6FA9AE2FCD}" = CCC Help German
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9C73041C-AB71-995D-EEC7-B4E940F93F36}" = CCC Help Finnish
"{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}" = Epson Easy Photo Print 2
"{A20548C1-4B08-C41D-A3A8-FE8C933C2A00}" = Catalyst Control Center InstallProxy
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" =
"{A8D53A4E-77A1-E23E-A396-6D9C86A2F273}" = Catalyst Control Center Graphics Full New
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{BB5FCB34-F3DE-4FA1-A92F-F66563D280B0}" = ASUS RT-N56U Wireless Router Utilities
"{BFF37C6E-D735-4487-390C-271E030AA62C}" = CCC Help Italian
"{C2E171F6-9B58-4CE1-7B8B-B69FA04EBAB8}" = Catalyst Control Center Graphics Previews Vista
"{C459D829-0FF0-C210-B2BF-83DB63FC1D61}" = CCC Help Korean
"{C5529BC1-C2BF-44E8-B62A-01913D70081C}" = Catalyst Control Center - Branding
"{C703222F-B0CD-4FFA-949C-03366B350028}" = JH NameGen Speech Module
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" =
"{C83B7CBB-C736-BF46-9832-7A9D07E9D94C}" = CCC Help Polish
"{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}" = Stronghold
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D2D23D08-D10E-43D6-883C-78E0B2AC9CC6}" = VU5x86
"{D49989B0-7BC2-F7F1-8017-3257F617347A}" = Catalyst Control Center Graphics Previews Common
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{D6DEC295-88A0-5CFA-0B29-C8FDF091FFD3}" = CCC Help Dutch
"{DF693121-40C0-3020-D655-612E51616423}" = CCC Help Danish
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E948B551-08DB-4163-8995-8C43B03D1B19}" = maxdome Download Manager 4.1.300.78
"{EBDDC3CC-343A-C0DD-79BA-8A12D0A2CA10}" = CCC Help Turkish
"{ECCA8FE7-767A-4C8A-9DAA-BAB60F877C41}" = Sins of a Solar Empire
"{ECF0D151-BCA0-8E6D-62DB-5D44DB4A3836}" = CCC Help Thai
"{F1B95046-E9DA-CFEC-42A8-C8224646AA32}" = ccc-core-static
"{F30FE437-0E45-D409-F629-5D86960A6591}" = CCC Help Norwegian
"{F5CC9A13-6C57-4948-75A8-3A2C92A3183B}" = Catalyst Control Center Localization All
"{F67C14C0-D73E-C55B-E132-B1904A1A709C}" = CCC Help Greek
"{F7E8DD1D-9BFD-38BB-86A5-BEF313B00C51}" = Catalyst Control Center InstallProxy
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F9000000-0018-0000-0000-074957833700}" = ABBYY FineReader 9.0 Sprint
"{FB77DB0C-6951-47B6-9D80-A0FDBEE0334C}" =
"1ClickDownload" = 1ClickDownloader
"7-Zip" = 7-Zip 9.20
"ABBYY FineReader 9.0 Sprint" = ABBYY FineReader 9.0 Sprint
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Dungeon Lords_is1" = Dungeon Lord (v1.4)
"EPSON Scanner" = EPSON Scan
"Free Audio Converter_is1" = Free Audio Converter version 5.0.1.1123
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"IcoFX_is1" = IcoFX 1.6.4
"JH NameGen Gold_is1" = JH NameGen Gold 1.1.3
"Larva Mortus" = Larva Mortus 1.02
"Media Jukebox 14" = Media Jukebox 14
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.51
"nbi-nb-base-7.0.1.0.0" = NetBeans IDE 7.0.1
"Netzmanager" = Netzmanager
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OpenAL" = OpenAL
"PunkBusterSvc" = PunkBuster Services
"QuickStores-Toolbar_is1" = QuickStores-Toolbar 1.1.0
"Sins of a Solar Empire" = Sins of a Solar Empire
"splashtop" = VAIO Quick Web Access
"Steam App 440" = Team Fortress 2
"Steam App 99900" = Spiral Knights
"VAIO Help and Support" =
"Verbindungsassistent" = Verbindungsassistent
"VLC media player" = VLC media player 2.0.0
"Warcraft III" = Warcraft III
"WinGimp-2.0_is1" = GIMP 2.6.11
"YTdetect" = Yahoo! Detect
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 28.07.2012 10:12:04 | Computer Name = Bazooka | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x736ec9f1 ID des fehlerhaften
Prozesses: 0xeb0 Startzeit der fehlerhaften Anwendung: 0x01cd6ccaf557107f Pfad der
fehlerhaften Anwendung: C:\Windows\SysWOW64\svchost.exe Pfad des fehlerhaften Moduls:
unknown Berichtskennung: 3495e3ed-d8be-11e1-814f-c0cb38d969ee
Error - 28.07.2012 10:13:08 | Computer Name = Bazooka | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x736ec9f1 ID des fehlerhaften
Prozesses: 0xca8 Startzeit der fehlerhaften Anwendung: 0x01cd6ccb1ccaff29 Pfad der
fehlerhaften Anwendung: C:\Windows\SysWOW64\svchost.exe Pfad des fehlerhaften Moduls:
unknown Berichtskennung: 5a778a0a-d8be-11e1-814f-c0cb38d969ee
Error - 28.07.2012 10:14:08 | Computer Name = Bazooka | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x736ec9f1 ID des fehlerhaften
Prozesses: 0xf18 Startzeit der fehlerhaften Anwendung: 0x01cd6ccb40a3c1c5 Pfad der
fehlerhaften Anwendung: C:\Windows\SysWOW64\svchost.exe Pfad des fehlerhaften Moduls:
unknown Berichtskennung: 7e53decb-d8be-11e1-814f-c0cb38d969ee
Error - 28.07.2012 10:34:36 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 28.07.2012 10:34:37 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 28.07.2012 10:34:37 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "Network Inspection System" (Network Inspection System). Der Fehlercode
ist das erste DWORD im Datenbereich.
Error - 28.07.2012 10:37:17 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 28.07.2012 10:37:17 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 28.07.2012 10:37:17 | Computer Name = Bazooka | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 28.07.2012 10:43:06 | Computer Name = Bazooka | Source = CVHSVC | ID = 100
Description = Nur zur Information. Error: Initialization failed 0x80070424 Type:
88::UnexpectedError.
[ Media Center Events ]
Error - 08.02.2011 13:44:09 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 18:44:09 - Fehler beim Herstellen der Internetverbindung. 18:44:09
- Serververbindung konnte nicht hergestellt werden..
Error - 08.02.2011 13:44:18 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 18:44:14 - Fehler beim Herstellen der Internetverbindung. 18:44:14
- Serververbindung konnte nicht hergestellt werden..
Error - 09.02.2011 13:05:12 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 18:05:08 - Fehler beim Herstellen der Internetverbindung. 18:05:08
- Serververbindung konnte nicht hergestellt werden..
Error - 26.01.2012 03:37:31 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 08:37:30 - Fehler beim Herstellen der Internetverbindung. 08:37:31
- Serververbindung konnte nicht hergestellt werden..
Error - 26.01.2012 03:38:01 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 08:38:00 - Fehler beim Herstellen der Internetverbindung. 08:38:00
- Serververbindung konnte nicht hergestellt werden..
Error - 26.01.2012 04:38:48 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 09:38:48 - Fehler beim Herstellen der Internetverbindung. 09:38:48
- Serververbindung konnte nicht hergestellt werden..
Error - 26.01.2012 04:39:17 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 09:39:17 - Fehler beim Herstellen der Internetverbindung. 09:39:17
- Serververbindung konnte nicht hergestellt werden..
Error - 26.01.2012 05:41:03 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 10:41:03 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
zugrunde liegende Verbindung wurde geschlossen: Für den geschützten SSL/TLS-Kanal
konnte keine Vertrauensstellung hergestellt werden..)
Error - 06.04.2012 09:01:39 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 15:01:39 - Fehler beim Herstellen der Internetverbindung. 15:01:39
- Serververbindung konnte nicht hergestellt werden..
Error - 14.07.2012 10:35:54 | Computer Name = Bazooka | Source = MCUpdate | ID = 0
Description = 16:35:54 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
zugrunde liegende Verbindung wurde geschlossen: Für den geschützten SSL/TLS-Kanal
konnte keine Vertrauensstellung hergestellt werden..)
[ System Events ]
Error - 28.07.2012 10:30:01 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060
Error - 28.07.2012 10:30:02 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 28.07.2012 10:30:03 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 28.07.2012 10:30:08 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 28.07.2012 10:32:43 | Computer Name = Bazooka | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?28.?07.?2012 um 16:30:42 unerwartet heruntergefahren.
Error - 28.07.2012 10:32:51 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060
Error - 28.07.2012 10:32:55 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 28.07.2012 10:32:55 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 28.07.2012 10:32:56 | Computer Name = Bazooka | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 28.07.2012 10:35:40 | Computer Name = Bazooka | Source = BTHUSB | ID = 327697
Description = Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen
und wird nicht verwendet. Der Treiber wurde entladen.
< End of report >
Schritt 3 Ich besitze ein 64bit System Achja infizierung ist heute aufgetreten. Ganz dumme Gecschichte. Hmm noch niemand geantwortet Nochmal Bisschen geforscht und es scheinen mehrere Leute schon das gleiche Problem gehabt zu haben. bei mir lief es genau so ab: Zitat:
Geändert von Maiandros (28.07.2012 um 16:09 Uhr) |
| Themen zu UPDATE SCHRITT 2! Fakeseiten, Umleitung Google, Potentielle Bedrohungen, MSE spackt |
| 0x8007042, 0x80070424, 1clickdownload, 7-zip, aktivierbar, applaus, folge, folgen, google earth, jahre, launch, microsoft office starter 2010, nicht mehr, nodrives, plug-in, probleme, search the web, searchscopes, sich automatisch, stehe, systemreparatur, umleitung |
Baum-Darstellung