Der angegebene Dienst ist kein installierter Dienst.

Guadeno · 23.02.2013, 23:01

Hey,

hab gerade ziemliche Probleme mit meinem Windows 7 64 Bit.
Wollte mal Directx neuinstallieren => Beim starten:

Dann hatte ich auch bemerkt, dass meine Firewall, die Windows Updates, etc. alle deaktiviert sind (Irgendein Virus, schätze ich mal). Hab schon mit Avira einen komplett Scan gemacht => Alles gefundene in Quarantäne.
Hab auch schon mit Malwarebytes' Anti-Malware durchscannen lassen und alles gefundene gelöscht. => Keine Besserung.
Hab schon einige Stunden gegoogelt und die verschiedensten Sachen ausprobiert.
Bisher hab ich meine Firewall wieder aktiviert bekommen, sonst aber noch nichts.
Was mich noch sehr stark wundert: Bei mir gibt es beispielsweise den Dienst Windows Update garnicht! Deshalb glaube ich, dass der/die Viren einige meiner Dienste gelöscht haben! Kann man diese irgendwie wiederherstellen?
(Ich hab jetzt keine Lust, mein Windows neuzuinstallieren ...)
Ich hoffe ich hab nichts vergessen und es gibt irgendeine einfach Lösung für das Ganze.

Gruß

Edit:
So, ich glaub ich habs jetzt doch geschafft

Musste 3 .dll's neuregistrieren..

Edit2:

-.-"

cosinus · 24.02.2013, 22:33

Hallo und

Zitat:

Hab schon mit Avira einen komplett Scan gemacht => Alles gefundene in Quarantäne.

Schön und wo sind die Logs dazu?

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner siehe http://www.trojaner-board.de/125889-...tml#post941520

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

Erstmal eine Kontrolle mit OTL bitte:

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Setze oben mittig den Haken bei Scanne alle Benutzer
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in CODE-Tags in den Thread.

Guadeno · 25.02.2013, 14:52

Log Files von Avira hab ich leider nicht...
Aber da alles gefundene sowieso weg ist, dürfte das ja kein Problem mehr sein.
Die Logs von OTL:

Code:

ATTFilter

OTL logfile created on: 25.02.2013 14:40:08 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,17% Memory free
16,00 Gb Paging File | 13,90 Gb Available in Paging File | 86,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 296,41 Gb Free Space | 63,65% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 607,76 Gb Free Space | 65,24% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_168.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\TechPowerUp OSD Server\TPUOSDVideo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (rpcapd) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Neo_VPN) -- C:\Windows\SysNative\drivers\Neo_0023.sys (SoftEther Corporation)
DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.)
DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (AODDriver4.2) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (WCMVCAM) -- C:\Windows\SysNative\drivers\wcmvcam64.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AsrAppCharger) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (UnlockerDriver5) -- C:\Program Files\Unlocker\UnlockerDriver5.sys ()
DRV:64bit: - (RTL2832UBDA) -- C:\Windows\SysNative\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (RTL2832UUSB) -- C:\Windows\SysNative\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (RTL2832U_IRHID) -- C:\Windows\SysNative\drivers\RTL2832U_IRHID.sys (Realtek)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV - (RTL2832UUSB) -- C:\Windows\SysWOW64\drivers\RTL2832UUSB.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832UBDA) -- C:\Windows\SysWOW64\drivers\RTL2832UBDA.sys (REALTEK SEMICONDUCTOR Corp.)
DRV - (RTL2832U_IRHID) -- C:\Windows\SysWOW64\drivers\RTL2832U_IRHID.sys (Realtek)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9C C8 40 CD 15 34 CD 01  [binary data]
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109958&tt=220512_53ctrl&babsrc=SP_ss&mntrId=d29ea71a000000000000bc5ff41e50bd
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\SearchScopes\{D04F2B30-4034-4EC5-8963-2D93F494FA47}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYUODE&apn_uid=B73629B3-9CFB-41AB-B7F1-AF6E6763160B&apn_sauid=E98B1F9D-A8CB-477A-9B03-E751AF19D97F&
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7Bbb6bc1bb-f824-4702-90cd-35e2fb24f25d%7D:1.5.1.1
FF - prefs.js..extensions.enabledAddons: %7BEF522540-89F5-46b9-B6FE-1829E2B572C6%7D:6.1
FF - prefs.js..extensions.enabledAddons: %7BDDC359D1-844A-42a7-9AA1-88A850A938A8%7D:2.0.15
FF - prefs.js..extensions.enabledAddons: %7B64161300-e22b-11db-8314-0800200c9a66%7D:0.9.6.14
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.7
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.4.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..network.proxy.autoconfig_url: "https://secure.premiumize.me/dcf75e1b0d1f135d265122b7f09b2e6c/proxy.pac"
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_168.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_168.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.138.0: C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.2: C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Michael\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.06 14:33:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\jid1-VZC3jSUSB1KxYw@jetpack: C:\Users\Michael\AppData\Roaming\Vaginallesen\jid1-VZC3jSUSB1KxYw@jetpack\
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.06 14:33:20 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.17 11:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2013.02.23 16:35:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions
[2012.08.31 23:45:32 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
[2013.02.15 01:46:25 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7zicrbwu.default\extensions\ich@maltegoetz.de
[2012.05.17 11:19:56 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\personas@christopher.beard.xpi
[2013.02.23 16:35:21 | 000,348,178 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2013.02.12 17:25:14 | 000,281,921 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2013.02.14 21:11:12 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.01.26 22:55:48 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.11.05 13:08:44 | 000,045,219 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\7zicrbwu.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}.xpi
[2013.02.06 14:33:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.02.06 14:33:20 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\
CHR - Extension: No name found = C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2013.02.16 20:52:23 | 000,000,951 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.2.103    privaterserver.no-ip.org
O1 - Hosts: 192.168.2.103    hxxp://www.privaterserver.no-ip.org
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C459B77A-A33C-4EB7-88A6-A9BCEA2849E3}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-4149896342-1631694950-3810678737-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.25 14:39:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.02.23 22:18:06 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Malwarebytes
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.23 22:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.23 22:17:59 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.23 22:17:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.23 21:32:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ElevatedDiagnostics
[2013.02.22 18:47:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Bohemia Interactive Studio
[2013.02.20 16:38:16 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\AMD
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ATI
[2013.02.20 16:37:59 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.02.20 16:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.02.20 16:35:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2013.02.20 16:35:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.02.20 16:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.02.20 16:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.02.20 16:35:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.02.20 16:34:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2013.02.20 16:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.02.20 16:33:05 | 000,000,000 | ---D | C] -- C:\AMD
[2013.02.19 14:33:01 | 000,194,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys
[2013.02.19 14:33:01 | 000,031,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll
[2013.02.16 19:25:29 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Serien
[2013.02.16 16:05:58 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\EA Games
[2013.02.16 16:05:40 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\EA Games
[2013.02.16 13:47:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro
[2013.02.15 16:57:33 | 000,000,000 | ---D | C] -- C:\Users\Michael\.dvdcss
[2013.02.15 16:57:22 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\MPlayer
[2013.02.15 16:56:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDx 4.0
[2013.02.15 16:32:30 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\dvdcss
[2013.02.13 19:28:32 | 026,931,128 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2013.02.13 19:28:32 | 020,450,232 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2013.02.13 19:28:32 | 018,054,312 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2013.02.13 19:28:32 | 015,129,064 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2013.02.13 19:28:32 | 015,052,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2013.02.13 19:28:32 | 012,641,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2013.02.13 19:28:32 | 007,565,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll
[2013.02.13 19:28:32 | 006,263,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll
[2013.02.13 19:28:32 | 002,720,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2013.02.13 19:28:32 | 001,813,432 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll
[2013.02.13 19:28:32 | 001,504,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco64.dll
[2013.02.13 19:28:31 | 025,256,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2013.02.13 19:28:31 | 017,560,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2013.02.13 19:28:31 | 009,389,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2013.02.13 19:28:31 | 007,931,896 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2013.02.13 19:28:31 | 002,904,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2013.02.13 19:28:31 | 002,824,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2013.02.13 19:28:31 | 002,504,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2013.02.13 19:28:31 | 002,344,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,985,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2013.02.13 19:28:31 | 001,107,592 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2013.02.13 19:28:31 | 000,958,272 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2013.02.13 19:28:31 | 000,246,024 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2013.02.13 19:28:31 | 000,201,728 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2013.02.10 17:29:32 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\GUILD WARS
[2013.02.09 22:45:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2013.02.09 22:45:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.02.09 22:42:26 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\ConvertXtoDVD
[2013.02.09 22:25:17 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:25:17 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Vso
[2013.02.09 22:25:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vso
[2013.02.09 22:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\VSO
[2013.02.07 14:40:07 | 001,304,032 | ---- | C] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 20:14:48 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\AnvSoft
[2013.02.06 20:08:46 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2013.02.06 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Media Player Classic
[2013.02.06 20:00:14 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mega Codec Pack
[2013.02.06 14:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.02.04 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\Michael\.shsh
[2013.02.04 18:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.04 18:31:18 | 000,033,240 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2013.02.04 18:31:09 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.02.04 18:31:08 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.02.04 18:29:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.02.04 18:29:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.02.03 15:33:26 | 000,000,000 | ---D | C] -- C:\ProgramData\TERA
[2013.02.03 15:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013.02.02 19:56:52 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\DDRace-b15-r6d74d52c-win32
[2013.01.29 14:40:15 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\NVIDIA
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.25 14:39:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2013.02.25 14:25:56 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.25 14:25:56 | 000,024,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.25 14:23:46 | 1093,119,007 | ---- | M] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar.part
[2013.02.25 14:23:46 | 000,000,000 | ---- | M] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar
[2013.02.25 14:21:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.25 14:18:55 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job
[2013.02.25 14:18:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.25 14:18:37 | 2146,885,631 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 01:55:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000UA.job
[2013.02.23 22:24:30 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2013.02.23 21:23:56 | 000,412,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.23 16:48:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.02.23 16:48:35 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.02.23 16:48:29 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.02.23 14:55:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4149896342-1631694950-3810678737-1000Core.job
[2013.02.20 16:37:05 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.02.16 20:52:23 | 000,000,951 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.15 22:41:26 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.02.15 22:41:26 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.02.15 15:14:59 | 001,613,822 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.15 15:14:59 | 000,698,958 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.15 15:14:59 | 000,652,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.15 15:14:59 | 000,148,756 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.15 15:14:59 | 000,121,614 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.09 22:43:18 | 000,099,384 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\inst.exe
[2013.02.09 22:43:18 | 000,082,816 | ---- | M] (VSO Software) -- C:\Users\Michael\AppData\Roaming\pcouffin.sys
[2013.02.09 22:43:18 | 000,007,859 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:43:18 | 000,001,167 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2013.02.07 14:40:31 | 001,304,032 | ---- | M] (techPowerUp (www.techpowerup.com)) -- C:\Users\Michael\Desktop\GPU-Z.0.6.7.exe
[2013.02.06 13:48:03 | 000,000,600 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2013.02.04 19:51:24 | 000,000,950 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.umbrella
[2013.02.04 18:31:23 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013.02.02 00:51:50 | 000,002,380 | ---- | M] () -- C:\Users\Michael\Desktop\Google Chrome.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.25 14:23:46 | 000,000,000 | ---- | C] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar
[2013.02.25 14:23:43 | 869,510,175 | ---- | C] () -- C:\Users\Michael\Desktop\Classic-WoW.org_1.12.1_Client.rar.part
[2013.02.23 21:23:45 | 000,412,992 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.20 16:37:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.02.15 16:24:38 | 356,806,655 | ---- | C] () -- C:\Users\Michael\Desktop\Inception.img
[2013.02.13 19:28:31 | 000,017,266 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2013.02.09 22:25:17 | 000,099,384 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\inst.exe
[2013.02.09 22:25:17 | 000,007,859 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.cat
[2013.02.09 22:25:17 | 000,001,167 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\pcouffin.inf
[2013.01.30 14:21:35 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job
[2012.12.26 19:01:03 | 000,073,832 | ---- | C] () -- C:\Windows\SysWow64\SuperFrameSplitter.dll
[2012.12.26 19:01:03 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\RTKDABMWare.dll
[2012.12.21 21:34:46 | 000,000,623 | ---- | C] () -- C:\Windows\SysWow64\W_DEBUG.DAT
[2012.12.21 21:32:49 | 000,000,094 | ---- | C] () -- C:\Windows\WET.INI
[2012.12.19 20:52:22 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.12.19 20:52:22 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.11.27 14:50:46 | 000,001,037 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\MPQEditor.ini
[2012.11.24 14:51:13 | 001,712,128 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2012.11.10 01:23:20 | 000,000,842 | ---- | C] () -- C:\Users\Michael\AppData\Local\recently-used.xbel
[2012.09.21 19:49:28 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012.08.22 22:27:14 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2012.08.21 15:05:53 | 000,473,600 | ---- | C] () -- C:\Windows\SysWow64\Harmony.dll
[2012.08.21 15:05:53 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\Unlha32.dll
[2012.08.21 15:05:53 | 000,087,040 | ---- | C] () -- C:\Windows\UnGins.exe
[2012.08.13 15:20:56 | 000,003,072 | ---- | C] () -- C:\Users\Michael\AppData\Local\file__0.localstorage
[2012.07.03 18:12:00 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2012.06.26 13:08:26 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2012.06.26 13:06:44 | 000,004,140 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2012.06.19 13:02:17 | 003,123,272 | R--- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.06.13 18:53:56 | 000,000,600 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\winscp.rnd
[2012.06.01 17:38:55 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.06.01 17:38:53 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.05.28 15:18:41 | 000,007,598 | ---- | C] () -- C:\Users\Michael\AppData\Local\Resmon.ResmonCfg
[2012.05.17 19:18:09 | 001,594,698 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.17 11:05:02 | 000,000,003 | ---- | C] () -- C:\Users\Michael\AppData\Local\user_data.ini
[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2011.11.17 07:41:18 | 000,002,048 | -HS- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\@
[2013.02.06 20:02:53 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\L
[2013.02.23 22:23:42 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U
[2013.02.23 21:23:59 | 000,000,804 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\L\00000004.@
[2013.02.06 20:01:01 | 000,002,048 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\00000004.@
[2013.02.22 15:58:43 | 000,001,024 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\00000008.@
[2013.02.23 22:23:42 | 000,001,632 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\000000cb.@
[2013.02.06 20:01:01 | 000,015,360 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000000.@
[2013.02.19 16:25:09 | 000,096,768 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000032.@
[2013.02.19 16:25:09 | 000,083,968 | ---- | M] () -- C:\Windows\Installer\{0c2369d5-7bf0-5f5e-2499-0a0bf805b7c4}\U\80000064.@
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[2013.02.23 21:23:50 | 000,004,608 | -HS- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2013.02.23 21:23:50 | 000,006,144 | -HS- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 03:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 25.02.2013 14:40:08 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Michael\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,17% Memory free
16,00 Gb Paging File | 13,90 Gb Available in Paging File | 86,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,66 Gb Total Space | 296,41 Gb Free Space | 63,65% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 607,76 Gb Free Space | 65,24% Space Free | Partition Type: NTFS
 
Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D047B51-3237-4D2B-AD45-B0CA7EBD3094}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | 
"{1EBEBA21-0A6C-49D0-B007-DE5D72727767}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | 
"{4A7DEE94-F889-486A-A15A-B2962B2502F4}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{972B283B-07B5-413C-9382-103C70F3C82F}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{B96E0666-831B-4BBA-BA51-D44E6BEB6DE4}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"{D0B92CB3-1ABD-4F9E-8F4F-0D32C73702A6}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{36BC93D8-3FE1-40E7-92F5-5A96815098AF}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"TCP Query User{D57EEFB4-0613-46C9-8F16-3EDAC781C490}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"UDP Query User{137AD99F-45B8-4758-B07A-AC6470EB570E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"UDP Query User{34189B4E-DB2A-48B9-8A0C-8496B763575B}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC3
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417010FF}" = Java 7 Update 10 (64-bit)
"{3145731D-C578-70ED-899F-7A670D2A6662}" = AMD Fuel
"{44610EE0-C908-D8F1-425D-914A5B745DEA}" = AMD Drag and Drop Transcoding
"{4975DE61-6BF6-B9BC-1FDE-C04C5EC78E4C}" = AMD Media Foundation Decoders
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E03A267-415E-5383-FA8F-3CE4145663B9}" = AMD Catalyst Install Manager
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{833F5E6D-6E01-11D1-978E-6DFBCEF72570}" = AMD Steady Video Plug-In 
"{89EE4A30-080F-2C95-6F78-C98D18FBD74D}" = AMD Accelerated Video Transcoding
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{9CF11D16-ECEB-90A5-A028-CA9E068D848B}" = ccc-utility64
"{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit)
"{AB085680-FE98-11E1-A232-F04DA23A5C58}" = MSVCRT Redists
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"ASRock App Charger_is1" = ASRock App Charger v1.0.5
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Recuva" = Recuva
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Unlocker" = Unlocker 1.9.1-x64
"VLC media player" = VLC media player 2.0.2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{017F8447-2A1D-0DDB-B5D7-CA2BFACE2886}" = CCC Help French
"{054E9A1C-3EA2-C657-E787-FD8DCF5C3D3B}" = CCC Help Czech
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}" = Guitar Hero III
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{1DE2BD51-0300-772D-5E18-F337D95D5687}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20E23A40-38E5-4DD6-B738-BC8097AE66B6}_is1" = FTL version 1.03.1
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{224E8FEB-5C1F-077F-6FC5-602AC1AE644D}" = CCC Help Danish
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{275E9C49-C72F-D754-DEB7-77F10A9C00D8}" = CCC Help Japanese
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{30049739-BE95-6591-B504-E6D7057D49CC}" = CCC Help Spanish
"{3F1EB155-F96E-EB7B-2EF2-7375490E0FA9}" = CCC Help English
"{45410935-B52C-468A-A836-0D1000018201}" = BulletStorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B023D7B-9E67-795D-FB31-B5E1F6DCA451}" = CCC Help Italian
"{4DE63AC8-5FF0-4D3C-B7F5-60AD9045E9E3}" = BF3 Colour Tweaker
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{55F6C486-8C75-2A72-DAFE-CE78A624C9F7}" = CCC Help Russian
"{5AF23993-7152-1620-E43F-1B4542FB4F84}" = CCC Help Thai
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63326924-3CAF-C858-3A8F-8598C87019D7}" = AMD VISION Engine Control Center
"{63822E89-11AA-F8EC-D433-F72A85799EC0}" = CCC Help Greek
"{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}" = Battlefield 3™
"{66361420-4905-AEB8-17AE-172FDD164A7E}" = CCC Help Polish
"{6D316D67-DA52-4659-9C98-F479963534D6}" = Audiosurf
"{6E19AEFD-7F83-4563-A7B5-F61CABF02400}" = DayZ Commander
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72E80496-C446-4389-B4F2-CC46DF704A7F}" = Terrafirma
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{769F2A4B-84A3-9486-ADD2-9E5AB4B4E1E3}" = Catalyst Control Center InstallProxy
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7FA1DAFD-AF55-E915-FD92-F269443A2ADF}" = Media Go Video Playback Engine 1.88.114.12060
"{835D562C-B72C-461D-A9C3-B8206B66E85A}" = RPG Maker VX Ace
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8773DD1C-5FB2-95B5-5A93-0EFEAC900A4D}" = CCC Help Norwegian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8CCBB0BF-9CC1-1A65-BB93-56012A460EE6}" = CCC Help Portuguese
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90140011-0062-0407-0000-0000000FF1CE}" = Microsoft Office Home and Business 2010 - Deutsch
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}" = Assassin's Creed III 1.01
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A0A3CE05-96CB-52E9-434E-074F3BB7807E}" = CCC Help Turkish
"{A2S166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{A9C64319-932F-D02B-B14C-FFFC3EC49E77}" = CCC Help Chinese Standard
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C09DB932-7619-7B56-30E3-C0454811D6D7}" = CCC Help Korean
"{C22A4697-BD77-ACB1-744F-1FD0A0BFF798}" = CCC Help Swedish
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D4B457B2-260F-C561-CA87-703BD3B724CA}" = Catalyst Control Center Graphics Previews Common
"{D6CDB506-297D-AE70-0EF6-DE5185F961BE}" = CCC Help Chinese Traditional
"{DBF1AE39-DA30-4B89-A7EB-3BDA675C5D9E}" = Media Go
"{DDBB7C89-1A09-441E-AA0F-6AA465755C17}" = REALTEK DTV USB DEVICE
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}" = Far Cry 3
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5F05232-96B6-4552-A480-785A60A94B21}" = System Requirements Lab CYRI
"{E913F678-7BAC-4C3D-A8ED-C19E13D3BAD0}" = DayZ Commander
"{ECFD508E-68A2-91B2-46DD-1D03D783D94B}" = Catalyst Control Center Localization All
"{EDE361D5-35A5-DA7D-3462-C3DABD24029B}" = CCC Help Hungarian
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F1E7DD6A-AE2D-D706-BEB3-937F76CA6AE9}" = CCC Help Finnish
"{F56F54DD-BCB2-1221-2CB7-E983A5CF9D15}" = CCC Help Dutch
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0630-0716-3135-7887" = JDownloader 2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"BitTorrent" = BitTorrent
"Borderlands 2_is1" = Borderlands 2
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESN Sonar-0.70.4" = ESN Sonar
"Fraps" = Fraps (remove only)
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 5.0.22.128
"ImgBurn" = ImgBurn
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NoIPDUC" = No-IP DUC
"Notepad++" = Notepad++
"Novo's Easy WoW Server 0.4.3" = Novo's Easy WoW Server 0.4.3
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"SkypePlayer" = Skype Audio Player (remove only)
"ST6UNST #1" = Visual Basic 6.0 Runtime&Steuerelemente
"StarCraft II" = StarCraft II
"Steam App 105600" = Terraria
"Steam App 113200" = The Binding of Isaac
"Steam App 12900" = Audiosurf
"Steam App 212370" = Arctic Combat
"Steam App 219540" = ARMA 2: Operation Arrowhead Beta
"Steam App 226700" = The War Z
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"TeamViewer 7" = TeamViewer 7
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"TechPowerUp OSD Server" = TechPowerUp OSD Server
"Universal Extractor_is1" = Universal Extractor 1.6.1
"Uplay" = Uplay
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.3
"WinPcapInst" = WinPcap 4.1.2
"World of Warcraft" = World of Warcraft
"World of Warcraft Public Test" = World of Warcraft Public Test
"XFast USB" = XFast USB
"zebNet Windows Keyfinder 2012 R24.0.0" = zebNet Windows Keyfinder 2012 R2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-4149896342-1631694950-3810678737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f58f3889281ea80b" = ContainerEx Decrypter
"Google Chrome" = Google Chrome
"Guild Wars" = GUILD WARS
"SOE-C:/Users/Michael/AppData/Local/Sony Online Entertainment/ApplicationUpdater" = applicationupdater
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.02.2013 09:43:03 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 20.02.2013 11:47:25 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 21.02.2013 09:27:48 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 22.02.2013 11:08:40 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 22.02.2013 11:51:26 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 23.02.2013 08:01:19 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 23.02.2013 16:34:12 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 23.02.2013 17:34:47 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 23.02.2013 18:23:14 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
Error - 25.02.2013 09:28:54 | Computer Name = Michael-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  Error:  Initialization failed 0x80070424 Type:
 88::UnexpectedError. 
 
[ System Events ]
Error - 13.11.2012 09:01:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:01:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
Error - 13.11.2012 09:27:55 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1058
 
Error - 13.11.2012 09:30:09 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:30:09 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
Error - 13.11.2012 09:38:03 | Computer Name = Michael-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 13.11.2012 09:41:13 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1058
 
Error - 13.11.2012 09:43:20 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:   %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 13.11.2012 09:43:20 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1069
 
Error - 14.11.2012 09:16:06 | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WebcamMax, WDM Video Capture" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1058
 
 
< End of report >

cosinus · 25.02.2013, 15:11

Zitat:

Log Files von Avira hab ich leider nicht...

Wieso bitte hast du die nicht?
Würdest du bitte mal nachsehen?

Guadeno · 25.02.2013, 16:08

Die gefundenen Dateien sind alles Dateien aus dem Temp Ordner (Siehe meinen etwas älteren ersten Thread hier), mit ziemlich willkürlichen Namen.

Ich glaube aber nicht, dass es an denen liegt, da ich die schon "immer" hab Oo
Naja, stören mich aber nicht.

Problem ist halt, dass ich keine Windows Updates mehr laden kann und verschiedene Dienste gelöscht wurden.

cosinus · 25.02.2013, 16:20

Warum postest du die Ereignisse von Avira nicht so wie es in der Anleitung steht?!

Guadeno · 25.02.2013, 17:37

Wozu?
Da steht einfach nur: Malware gefunden.
Und mehr nicht! Wo sollen diese Informationen bitte helfen?

cosinus · 26.02.2013, 00:14

Es geht darum, dass die Logs grundsätzlich in einem vernünftigen Textformat gepostet werden!
Wir verfassen nicht umsonst die Anleitungen so ud nicht deswegen weil sonst jeder meint er kann alles posten wir er gerade lustig ist!

Also poste bitte die Logs so wie es als Format gewünscht wird, du willst Hilfe und nicht wir!

Guadeno · 26.02.2013, 18:54

Code:

ATTFilter

Exportierte Ereignisse:

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\T0QKVCFLMq.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7818a99a.qua' 
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\XMAHn0J3bp.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1e1fe7bc.qua' 
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\Mb53p9moB8.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3db88556.qua' 
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\cXTFDWTM0r.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4280b73d.qua' 
      verschoben!

23.02.2013 17:18 [System Scanner] Malware gefunden
      Die Datei 'C:\Users\Michael\AppData\Local\Temp\yq9Jiq137Z.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.MSIL.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c58bd70.qua' 
      verschoben!

Zufrieden?
Da steht das selbe drin wie auf den obigen Screenshots...

cosinus · 26.02.2013, 23:42

Ja, so ist es besser. Und das Exportieren hat gleich nochmal zwei Vorteile: ich kann es wenn nötig copy&pasten und wie du siehst zeigt es zwei mehr Zecken an

Und nein sowas hat man nicht immer, nur weil etwas in TEMP liegt ist das nicht automatisch legitim, sowas hat man auch nicht immer sondern derartige in TEMP nur wenn man seinen Rechner versaut hat

Bitte nun Logs mit GMER (<<< klick für Anleitung) und MBAR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur MBAR aus.

Anleitung MBAR:

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Guadeno · 28.02.2013, 16:32

GMER:

Code:

ATTFilter

GMER 2.1.19115 - hxxp://www.gmer.net
Rootkit scan 2013-02-28 15:49:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500418AS rev.CC38 465,76GB
Running: gmer_2.1.19115.exe; Driver: C:\Users\Michael\AppData\Local\Temp\uwliifow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                        00000000749e1465 2 bytes [9E, 74]
.text   C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                       00000000749e14bb 2 bytes [9E, 74]
.text   ...                                                                                                                                                                                                                                   * 2
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                                                                                               00000000729f1a22 2 bytes [9F, 72]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                                                                                               00000000729f1ad0 2 bytes [9F, 72]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                                                                                               00000000729f1b08 2 bytes [9F, 72]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                                                                                               00000000729f1bba 2 bytes [9F, 72]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                                                                                               00000000729f1bda 2 bytes [9F, 72]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                        00000000749e1465 2 bytes [9E, 74]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                       00000000749e14bb 2 bytes [9E, 74]
.text   ...                                                                                                                                                                                                                                   * 2
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[1840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                  00000000749e1465 2 bytes [9E, 74]
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[1840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                 00000000749e14bb 2 bytes [9E, 74]
.text   ...                                                                                                                                                                                                                                   * 2
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe!?SparseBitMask@DataSourceDescription@FlexUI@@2HB + 960  000000002df25984 4 bytes [34, F4, 56, 56]
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                     00000000749e1465 2 bytes [9E, 74]
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                    00000000749e14bb 2 bytes [9E, 74]
.text   ...                                                                                                                                                                                                                                   * 2
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                000000007719f9c0 5 bytes JMP 000000016d555f49
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                                                          000000007719f9d8 5 bytes JMP 000000016d556411
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                                              000000007719fa08 5 bytes JMP 000000016d55016d
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                                    000000007719fa20 5 bytes JMP 000000016d54fbca
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                                             000000007719fa70 5 bytes JMP 000000016d54fa44
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                                        000000007719fa88 2 bytes JMP 000000016d54fb52
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey + 3                                                                                    000000007719fa8b 2 bytes [3B, F6]
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                                            000000007719fb20 5 bytes JMP 000000016d550424
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                   000000007719fc18 5 bytes JMP 000000016d554369
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                                         000000007719fd2c 5 bytes JMP 000000016d54f9cc
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                             000000007719fd44 5 bytes JMP 000000016d554959
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                                   000000007719fd78 5 bytes JMP 000000016d5539de
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                      000000007719fe24 5 bytes JMP 000000016d555fc4
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                                  000000007719fe3c 5 bytes JMP 000000016d554adb
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                           00000000771a0094 5 bytes JMP 000000016d554791
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                          00000000771a01a4 5 bytes JMP 000000016d54fc42
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                                           00000000771a09c4 5 bytes JMP 000000016d554584
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                                            00000000771a09dc 5 bytes JMP 000000016d54cc5b
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                       00000000771a0a24 5 bytes JMP 000000016d54cd29
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                                             00000000771a0b60 5 bytes JMP 000000016d54ccc2
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                                      00000000771a0f50 5 bytes JMP 000000016d54fcba
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                                             00000000771a0f68 5 bytes JMP 000000016d54ff45
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                                            00000000771a0ff8 5 bytes JMP 000000016d5501fd
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                                              00000000771a131c 5 bytes JMP 000000016d554b6b
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                                00000000771a145c 5 bytes JMP 000000016d54fec9
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                                  00000000771a1508 5 bytes JMP 000000016d556389
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                                            00000000771a16f8 1 byte JMP 000000016d54d138
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey + 2                                                                                        00000000771a16fa 3 bytes {JMP 0xfffffffff63aba40}
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                                    00000000771a1a38 5 bytes JMP 000000016d54facc
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                                    00000000771a1b7c 5 bytes JMP 000000016d55616c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                                      0000000075c0103d 5 bytes JMP 000000016d5293a9
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                      0000000075c01072 5 bytes JMP 000000016d5294e7
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                                0000000075c2c9b5 5 bytes JMP 000000016d52971d
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryW                                                                                    0000000075c800c3 5 bytes JMP 000000016d529efe
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryA                                                                                    0000000075c8016b 5 bytes JMP 000000016d52a231
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                             0000000075c82c91 5 bytes JMP 000000016d529aa0
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AllocConsole                                                                                        0000000075ca6b3e 3 bytes JMP 000000016d557431
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AllocConsole + 4                                                                                    0000000075ca6b42 1 byte [F7]
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AttachConsole                                                                                       0000000075ca6c02 3 bytes JMP 000000016d557443
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\kernel32.dll!AttachConsole + 4                                                                                   0000000075ca6c06 1 byte [F7]
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                    0000000076592aa4 5 bytes JMP 000000016d52a43c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                       0000000075d18a29 5 bytes JMP 000000016d557419
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                                       0000000075d1d22e 5 bytes JMP 000000016d557401
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\GDI32.dll!AddFontResourceW                                                                                       00000000767dd2b2 5 bytes JMP 000000016d537617
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\GDI32.dll!AddFontResourceA                                                                                       00000000767dd7bb 5 bytes JMP 000000016d5375fb
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesW                                                                              00000000762c1e3a 7 bytes JMP 000000016d53a3b9
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExW                                                                               00000000762cb466 7 bytes JMP 000000016d53b2da
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameW                                                                                  00000000762e78ff 7 bytes JMP 000000016d53aa60
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameW                                                                              00000000762e79bb 7 bytes JMP 000000016d53ac11
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExA                                                                               00000000762ea3e2 7 bytes JMP 000000016d53b3a0
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                                0000000076302538 5 bytes JMP 000000016d52985f
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameA                                                                                  0000000076321b94 7 bytes JMP 000000016d53ab18
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameA                                                                              0000000076321c31 7 bytes JMP 000000016d53acc9
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusA                                                                                 0000000076322021 7 bytes JMP 000000016d53b21c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesA                                                                              0000000076322104 7 bytes JMP 000000016d53a470
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusW                                                                                 0000000076322221 5 bytes JMP 000000016d53b15e
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlService                                                                                       0000000075f24d5c 7 bytes JMP 000000016d53a1fe
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CloseServiceHandle                                                                                   0000000075f24dc3 7 bytes JMP 000000016d53a527
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatus                                                                                   0000000075f24e4b 7 bytes JMP 000000016d53a28a
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatusEx                                                                                 0000000075f24eaf 7 bytes JMP 000000016d53a31d
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!StartServiceW                                                                                        0000000075f24f35 7 bytes JMP 000000016d53a079
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!StartServiceA                                                                                        0000000075f2508d 7 bytes JMP 000000016d53a10f
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceObjectSecurity                                                                           0000000075f250f4 7 bytes JMP 000000016d53b02c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                                             0000000075f25181 7 bytes JMP 000000016d53b0c8
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                                                 0000000075f25254 7 bytes JMP 000000016d53a728
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                                                 0000000075f253d5 7 bytes JMP 000000016d53a643
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                                                0000000075f254c2 7 bytes JMP 000000016d53a9ca
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                                                0000000075f255e2 7 bytes JMP 000000016d53a934
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                                       0000000075f2567c 7 bytes JMP 000000016d539e5b
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                                       0000000075f2589f 7 bytes JMP 000000016d539d85
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                                        0000000075f25a22 7 bytes JMP 000000016d53a5b5
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigA                                                                                  0000000075f25a83 7 bytes JMP 000000016d53ae5b
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW                                                                                  0000000075f25b29 7 bytes JMP 000000016d53adc2
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA                                                                                    0000000075f25ca0 7 bytes JMP 000000016d539535
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!ControlServiceExW                                                                                    0000000075f25d8c 7 bytes JMP 000000016d5394bc
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerW                                                                                       0000000075f263ad 7 bytes JMP 000000016d539a83
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerA                                                                                       0000000075f264f0 7 bytes JMP 000000016d539b0f
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2A                                                                                 0000000075f26633 7 bytes JMP 000000016d53af90
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2W                                                                                 0000000075f2680c 7 bytes JMP 000000016d53aef4
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenServiceW                                                                                         0000000075f2714b 7 bytes JMP 000000016d539bf8
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\SysWOW64\sechost.dll!OpenServiceA                                                                                         0000000075f27245 7 bytes JMP 000000016d539c84
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRegisterPSClsid                                                                                      00000000759ec56e 5 bytes JMP 000000016d5411c4
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                               00000000759eea09 7 bytes JMP 000000016d541795
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleRun                                                                                                 00000000759f07de 5 bytes JMP 000000016d541650
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                                  00000000759f21e1 5 bytes JMP 000000016d5422c5
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                                        00000000759feba1 6 bytes JMP 000000016d54156f
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                                          00000000759fefd7 5 bytes JMP 000000016d5414ff
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetPSClsid                                                                                           0000000075a026b9 5 bytes JMP 000000016d54133c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                                       0000000075a154ad 5 bytes JMP 000000016d542853
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                                         0000000075a209ad 5 bytes JMP 000000016d5413af
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                                         0000000075a286d3 5 bytes JMP 000000016d541431
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                       0000000075a29d0b 5 bytes JMP 000000016d543b21
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                                     0000000075a29d4e 5 bytes JMP 000000016d541c5c
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                                              0000000075a4bb09 7 bytes JMP 000000016d5416c0
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                                    0000000075a6eacf 5 bytes JMP 000000016d540c21
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                                  0000000075aa340b 5 bytes JMP 000000016d542d13
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                                    0000000075aecfd9 5 bytes JMP 000000016d5415da
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject                                                                                000000007620279e 5 bytes JMP 000000016d540eb4
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!RevokeActiveObject                                                                                  0000000076203294 5 bytes JMP 000000016d540fd5
.text   C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1892] C:\Windows\syswow64\oleaut32.dll!GetActiveObject                                                                                     0000000076218f40 5 bytes JMP 000000016d541048

---- Devices - GMER 2.1 ----

Device  \Driver\ALSysIO \Device\ALSysIO                                                                                                                                                                                                       fffff88007647170

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3452:3976]                                                                                                                                                                        000007fefb912a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3452:3936]                                                                                                                                                                        000007feeb9ad618

---- EOF - GMER 2.1 ----

Mbar hatte 10 Funde, war ca 10-15 Minuten im Herunterfahren... Bildschirm, dann kam ein Blue Screen Oo
Nach einem Neustart dann halt die Frage von Windows ob Abgesichter oder normaler Modus, hab den PC mal normal gestartet und ja, das wars bisher.
Beim zweiten Mbar Scan wurde nichts mehr gefunden.
Die fehlenden Dienste sind immer noch nicht da, bei den Windowsupdates kommt immer noch der selbe Fehler und das Wartungscenter lässt sich immer noch nicht aktivieren.

Tut mir Leid, hab vergessen die Log Datei von Mbar zu posten..
Hab den Ordner schon gelöscht und konnte ihn mit Recuva auch nicht mehr finden :/

cosinus · 01.03.2013, 09:40

Zitat:

Hab den Ordner schon gelöscht und konnte ihn mit Recuva auch nicht mehr finden :/

Was soll das?

Wo steht, dass du den Ordner löschen sollst?!
Wie soll ich jetzt analysieren welche Infektionen dieser Rechner hatte??

Guadeno · 01.03.2013, 14:50

Ich hatte vergessen den Log rauszunehmen!
Und sonst werde ich das Programm ja nie wieder benutzen, deshalb hab ich es gelöscht!

cosinus · 01.03.2013, 16:01

Woher willst du das wissen?

Ich hab dich gebeten nur das zu machen was in den Anleitungen steht. So ohne das Log wird keiner mehr wissen können welche Infektionen da beseitigt wurden

Guadeno · 01.03.2013, 16:15

Meine eigentlichen Fragen waren ja:
Wie bekomm ich den Update Fehler weg?
Wie stelle ich wieder die gelöschten Dienste her?

25.02.2013, 16:20	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Der angegebene Dienst ist kein installierter Dienst. Warum postest du die Ereignisse von Avira nicht so wie es in der Anleitung steht?! __________________ --> Der angegebene Dienst ist kein installierter Dienst.

01.03.2013, 16:01	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Der angegebene Dienst ist kein installierter Dienst. Woher willst du das wissen? Ich hab dich gebeten nur das zu machen was in den Anleitungen steht. So ohne das Log wird keiner mehr wissen können welche Infektionen da beseitigt wurden __________________ Logfiles bitte immer in CODE-Tags posten

Der angegebene Dienst ist kein installierter Dienst.

Plagegeister aller Art und deren Bekämpfung: Der angegebene Dienst ist kein installierter Dienst.