| |
| |||||||
Log-Analyse und Auswertung: GVU Trojaner (abgesicherter modus nicht möglich)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
31.03.2013, 02:05
| #16 |
 |  GVU Trojaner (abgesicherter modus nicht möglich) TL logfile created on: 3/30/2013 9:32:25 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): c:\pagefile.sys 4096 4096 [binary data] %SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files Drive C: | 100.00 Mb Total Space | 75.52 Mb Free Space | 75.53% Space Free | Partition Type: NTFS Drive D: | 14.44 Gb Total Space | 14.44 Gb Free Space | 100.00% Space Free | Partition Type: FAT32 Drive E: | 465.66 Gb Total Space | 62.41 Gb Free Space | 13.40% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled] -- -- (KMService) SRV - [2013/01/29 09:29:00 | 000,188,760 | ---- | M] () [Auto] -- E:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater) SRV - [2013/01/08 07:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto] -- E:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012/11/13 09:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe -- (SDWSCService) SRV - [2012/11/13 09:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe -- (SDUpdateService) SRV - [2012/11/13 09:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe -- (SDScannerService) SRV - [2012/10/02 11:20:26 | 001,008,496 | ---- | M] () [Auto] -- E:\Windows\System32\dmwu.exe -- (IBUpdaterService) SRV - [2012/09/20 08:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2012/09/14 10:24:40 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012/09/14 10:24:16 | 000,393,080 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012/09/12 11:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012/09/12 11:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2012/08/29 17:57:12 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/06/28 18:33:50 | 001,564,368 | ---- | M] () [Auto] -- E:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru) SRV - [2012/02/14 23:12:48 | 000,163,328 | ---- | M] (AMD) [Auto] -- E:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012/02/14 17:15:30 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV - [2009/08/06 01:51:20 | 000,065,536 | R--- | M] () [Auto] -- E:\Windows\System32\XSrvSetup.exe -- (JMB36X) SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (VGPU) DRV - File not found [Kernel | On_Demand] -- -- (gdrv) DRV - [2013/03/30 13:04:25 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys -- (MpKsl9a732883) DRV - [2013/03/30 11:10:08 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys -- (MpKsl07894b93) DRV - [2013/03/30 00:05:01 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys -- (MpKsl3d312dd0) DRV - [2013/03/29 23:53:14 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys -- (MpKsle2a982e2) DRV - [2013/03/29 23:38:06 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys -- (MpKsld861874d) DRV - [2012/11/27 16:25:33 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System] -- E:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2012/09/14 10:24:24 | 000,063,864 | ---- | M] (BlueStack Systems) [Kernel | Auto] -- E:\Program Files\BlueStacks\HD-Hypervisor-x86.sys -- (BstHdDrv) DRV - [2012/08/30 16:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2012/02/14 22:12:48 | 000,264,704 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2012/02/01 09:18:10 | 000,046,720 | ---- | M] (Advanced Micro Devices) [Kernel | Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.1) DRV - [2011/03/18 12:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot] -- E:\Windows\System32\speedfan.sys -- (speedfan) DRV - [2011/02/08 06:03:54 | 001,882,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2010/11/20 17:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010/11/20 17:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 17:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vmbus.sys -- (vmbus) DRV - [2010/11/20 17:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - [2010/11/20 17:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV - [2010/11/20 17:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010/11/20 17:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- E:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010/11/20 17:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010/11/20 17:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010/11/20 17:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\terminpt.sys -- (terminpt) DRV - [2010/11/20 17:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010/11/20 17:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010/02/18 04:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- E:\Windows\System32\drivers\amdiox86.sys -- (amdiox86) DRV - [2009/12/02 03:01:06 | 000,168,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService) DRV - [2009/11/20 07:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc) DRV - [2009/11/20 07:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub) DRV - [2009/10/29 04:14:32 | 000,099,440 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- E:\Windows\System32\drivers\jraid.sys -- (JRAID) DRV - [2007/01/25 20:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2007/01/25 20:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- E:\Windows\System32\drivers\avmeject.sys -- (avmeject) DRV - [1996/04/03 15:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot] -- E:\Windows\System32\giveio.sys -- (giveio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 5E 1C 2C 75 F2 CD 01 [binary data] IE - HKU\Administrator_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4C AF 4B 45 37 01 CD 01 [binary data] IE - HKU\Robert_ON_E\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\Robert_ON_E\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) IE - HKU\Robert_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb128?a=6PQRxFiXXD&i=26" FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb128/?loc=IB_DS&a=6PQRxFiXXD&&i=26&search=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\System32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: E:\Windows\System32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: E:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: E:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/29 22:20:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/03/13 13:00:09 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Extensions [2012/12/02 20:55:46 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions [2012/07/25 09:56:32 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012/12/02 20:55:46 | 000,000,000 | ---D | M] (incredibar.com) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\ffxtlbr@incredibar.com [2012/12/02 20:51:04 | 000,000,000 | ---D | M] (Yontoo) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\plugin@yontoo.com [2012/08/23 09:27:37 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-1.xml [2012/07/25 14:20:43 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-2.xml [2012/07/24 08:48:30 | 000,000,168 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.gif [2012/07/24 08:48:30 | 000,000,618 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.src [2012/07/13 05:03:49 | 000,001,056 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.xml [2012/12/02 20:53:12 | 000,002,203 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\MyStart Search.xml [2012/08/29 22:20:54 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files\Mozilla Firefox\extensions File not found (No name found) -- [2012/08/24 22:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- E:\Program Files\mozilla firefox\components\browsercomps.dll [2012/08/24 22:49:52 | 000,001,392 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/08/24 22:49:52 | 000,001,153 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012/08/24 22:49:52 | 000,006,805 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012/08/24 22:49:52 | 000,001,178 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012/08/24 22:49:52 | 000,001,105 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - E:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh) O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension32.dll () O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - E:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - File not found O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - File not found O3 - HKLM\..\Toolbar: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - File not found O3 - HKU\Robert_ON_E\..\Toolbar\WebBrowser: (FileConverter 1.3 Toolbar) - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) O4 - HKLM..\Run: [AVMWlanClient] E:\Program Files\avmwlanstick\FRITZWLANMini.exe (AVM Berlin) O4 - HKLM..\Run: [BCSSync] E:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [BlueStacks Agent] E:\Program Files\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.) O4 - HKLM..\Run: [JMB36X IDE Setup] E:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [MSC] File not found O4 - HKLM..\Run: [NUSB3MON] E:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [SDTray] E:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O4 - HKLM..\Run: [StartCCC] E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\Administrator_ON_E..\Run: [pkgndjozfpgpfzz] File not found O4 - HKU\Robert_ON_E..\Run: [DAEMON Tools Lite] E:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six () F3 - HKU\Administrator_ON_E WinNT: Run - (C:\Users\ADMINI~1\DOCUME~1\DAEMON~1\DAEMON~1.EXE) - File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\Administrator_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O8 - Extra context menu item: An OneNote s&enden - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - E:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.6.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe () O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKU\Administrator_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe () O20 - HKU\Administrator_ON_E Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\skype.dat) - E:\Users\Administrator\AppData\Roaming\skype.dat () O20 - HKU\Robert_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe () O20 - Winlogon\Notify\SDWinLogon: DllName - SDWinLogon.dll - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell - "" = AutoRun O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell\AutoRun\command - "" = F:\launcher.exe O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell - "" = AutoRun O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell\AutoRun\command - "" = E:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2013/03/30 21:30:43 | 000,000,000 | -HSD | C] -- E:\RECYCLER [2013/03/25 13:05:39 | 000,000,000 | ---D | C] -- E:\Users\Administrator\Desktop\World of Warcraft [2013/03/15 13:20:34 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\AppData\Local\ST6UNST #2 [2013/03/15 13:20:27 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\Documents\DAEMON Tools Lite [2013/03/10 19:34:14 | 000,000,000 | ---D | C] -- E:\ProgramData\szcvlmmrfopiwja [2012/11/18 06:17:28 | 000,929,844 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFC42D.DLL [2012/11/18 06:17:28 | 000,798,773 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFCO42D.DLL [2012/11/18 06:17:28 | 000,434,252 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRTD.DLL [2012/11/18 06:17:28 | 000,421,888 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRT.DLL [2012/11/18 06:17:27 | 000,069,632 | ---- | C] (MAX - DESIGN) -- E:\Program Files\Max_Sound.dll [2012/11/18 06:16:58 | 000,430,080 | ---- | C] (MAX - DESIGN) -- E:\Program Files\CompLogic.dll [2012/11/18 06:16:55 | 000,593,920 | ---- | C] (MAX DESIGN) -- E:\Program Files\AnnoFrame.dll [2012/11/18 06:16:12 | 000,933,331 | ---- | C] (MAX DESIGN) -- E:\Program Files\1503Startup.exe [2011/05/12 07:53:30 | 000,147,456 | ---- | C] ( ) -- E:\Windows\System32\lagarith.dll [2010/10/16 13:00:54 | 007,970,816 | ---- | C] (home) -- E:\Program Files\Hero Editor.exe [2010/02/03 19:00:00 | 000,139,264 | ---- | C] ( ) -- E:\Windows\sipr3260.dll ========== Files - Modified Within 30 Days ========== [2013/03/30 13:12:53 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat [2013/03/30 13:10:35 | 2616,057,856 | -HS- | M] () -- E:\hiberfil.sys [2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/03/29 22:48:27 | 000,000,004 | ---- | M] () -- E:\Users\Administrator\AppData\Roaming\skype.ini [2013/03/23 16:51:03 | 000,195,718 | ---- | M] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg [2013/03/23 09:10:41 | 000,700,168 | ---- | M] () -- E:\Windows\System32\perfh007.dat [2013/03/23 09:10:41 | 000,654,880 | ---- | M] () -- E:\Windows\System32\perfh009.dat [2013/03/23 09:10:41 | 000,148,964 | ---- | M] () -- E:\Windows\System32\perfc007.dat [2013/03/23 09:10:41 | 000,121,752 | ---- | M] () -- E:\Windows\System32\perfc009.dat [2013/03/17 11:47:18 | 000,540,468 | ---- | M] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg [2013/03/10 19:34:14 | 000,076,318 | ---- | M] () -- E:\ProgramData\ttiqexkmjhsphik [2013/03/10 19:33:53 | 000,121,856 | ---- | M] () -- E:\ProgramData\pkgndjoz.exe [2013/03/09 06:17:13 | 302,044,857 | ---- | M] () -- E:\Windows\MEMORY.DMP ========== Files Created - No Company Name ========== [2013/03/29 22:40:03 | 000,000,004 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.ini [2013/03/23 16:49:00 | 000,195,718 | ---- | C] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg [2013/03/17 11:46:59 | 000,540,468 | ---- | C] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg [2013/03/10 19:34:11 | 000,121,856 | ---- | C] () -- E:\ProgramData\pkgndjoz.exe [2013/03/10 19:33:53 | 000,076,318 | ---- | C] () -- E:\ProgramData\ttiqexkmjhsphik [2013/01/16 01:10:53 | 000,007,168 | ---- | C] () -- E:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/12/20 12:40:13 | 000,021,840 | ---- | C] () -- E:\Windows\System32\SIntfNT.dll [2012/12/20 12:40:13 | 000,017,212 | ---- | C] () -- E:\Windows\System32\SIntf32.dll [2012/12/20 12:40:13 | 000,012,067 | ---- | C] () -- E:\Windows\System32\SIntf16.dll [2012/12/13 17:57:45 | 000,000,004 | ---- | C] () -- E:\Users\Robert\AppData\Roaming\skype.ini [2012/12/02 20:55:06 | 001,008,496 | ---- | C] () -- E:\Windows\System32\dmwu.exe [2012/12/02 20:55:06 | 000,028,160 | ---- | C] () -- E:\Windows\System32\ImHttpComm.dll [2012/11/18 06:17:28 | 000,708,608 | ---- | C] () -- E:\Program Files\View.dll [2012/11/18 06:17:28 | 000,233,472 | ---- | C] () -- E:\Program Files\SAVRepair.exe [2012/11/18 06:17:28 | 000,043,279 | ---- | C] () -- E:\Program Files\Texte.dat [2012/11/18 06:17:27 | 002,519,642 | ---- | C] () -- E:\Program Files\Handbuch.pdf [2012/11/18 06:17:26 | 025,305,841 | ---- | C] () -- E:\Program Files\FigurenHeader.dat [2012/11/18 06:17:25 | 014,289,592 | ---- | C] () -- E:\Program Files\Figuren200.dat [2012/11/18 06:17:23 | 016,039,347 | ---- | C] () -- E:\Program Files\Figuren102.dat [2012/11/18 06:17:21 | 016,777,177 | ---- | C] () -- E:\Program Files\Figuren101.dat [2012/11/18 06:17:19 | 016,777,198 | ---- | C] () -- E:\Program Files\Figuren100.dat [2012/11/18 06:17:18 | 011,190,229 | ---- | C] () -- E:\Program Files\Figuren009.dat [2012/11/18 06:17:16 | 016,785,902 | ---- | C] () -- E:\Program Files\Figuren008.dat [2012/11/18 06:17:14 | 016,769,888 | ---- | C] () -- E:\Program Files\Figuren007.dat [2012/11/18 06:17:11 | 016,776,353 | ---- | C] () -- E:\Program Files\Figuren006.dat [2012/11/18 06:17:09 | 016,776,964 | ---- | C] () -- E:\Program Files\Figuren005.dat [2012/11/18 06:17:06 | 016,777,905 | ---- | C] () -- E:\Program Files\Figuren004.dat [2012/11/18 06:17:04 | 016,776,259 | ---- | C] () -- E:\Program Files\Figuren003.dat [2012/11/18 06:17:02 | 016,777,308 | ---- | C] () -- E:\Program Files\Figuren002.dat [2012/11/18 06:17:00 | 016,778,359 | ---- | C] () -- E:\Program Files\Figuren001.dat [2012/11/18 06:16:58 | 016,775,920 | ---- | C] () -- E:\Program Files\Figuren000.dat [2012/11/18 06:16:58 | 000,358,963 | ---- | C] () -- E:\Program Files\binkw32.dll [2012/11/18 06:16:57 | 002,187,264 | ---- | C] () -- E:\Program Files\AnnoSplash.exe [2012/11/18 06:16:57 | 000,909,312 | ---- | C] () -- E:\Program Files\AnnoWelt.dll [2012/11/18 06:16:57 | 000,221,184 | ---- | C] () -- E:\Program Files\AnnoScene.dll [2012/11/18 06:16:57 | 000,184,320 | ---- | C] () -- E:\Program Files\AnnoGame.dll [2012/11/18 06:16:55 | 000,385,024 | ---- | C] () -- E:\Program Files\AnnoDisplay.dll [2012/11/18 06:16:13 | 192,149,051 | ---- | C] () -- E:\Program Files\Anlagen.dat [2012/08/30 10:39:18 | 000,139,228 | -H-- | C] () -- E:\Windows\System32\mlfcache.dat [2012/04/13 07:59:57 | 000,139,128 | ---- | C] () -- E:\Windows\System32\drivers\PnkBstrK.sys [2012/04/13 07:59:48 | 000,189,248 | ---- | C] () -- E:\Windows\System32\PnkBstrB.exe [2012/04/13 07:59:28 | 000,075,136 | ---- | C] () -- E:\Windows\System32\PnkBstrA.exe [2012/03/13 15:41:58 | 000,010,240 | ---- | C] () -- E:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/03/13 14:11:34 | 000,084,480 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.dat [2012/03/13 12:43:51 | 000,065,536 | R--- | C] () -- E:\Windows\System32\XSrvSetup.exe [2012/03/13 12:43:03 | 000,073,728 | ---- | C] () -- E:\Windows\System32\RtNicProp32.dll [2012/03/13 12:39:10 | 000,000,010 | ---- | C] () -- E:\Windows\GSetup.ini [2012/03/13 12:33:54 | 000,097,360 | ---- | C] () -- E:\Windows\System32\drivers\Fwusb1b.bin [2012/03/13 12:29:22 | 000,000,000 | ---- | C] () -- E:\Windows\ativpsrm.bin [2012/02/14 22:28:34 | 000,157,144 | ---- | C] () -- E:\Windows\System32\ativvsva.dat [2012/02/14 22:28:32 | 000,204,952 | ---- | C] () -- E:\Windows\System32\ativvsvl.dat [2012/02/14 17:05:16 | 000,054,784 | ---- | C] () -- E:\Windows\System32\OVDecode.dll [2012/01/31 01:00:24 | 000,016,896 | ---- | C] () -- E:\Windows\System32\kdbsdk32.dll [2012/01/10 17:10:08 | 000,601,728 | ---- | C] () -- E:\Windows\System32\atiicdxx.dat [2011/09/12 18:06:16 | 000,003,917 | ---- | C] () -- E:\Windows\System32\atipblag.dat [2011/07/15 11:02:32 | 002,616,320 | ---- | C] () -- E:\Windows\explorer.exe [2011/05/13 04:58:12 | 002,785,280 | ---- | C] () -- E:\Windows\System32\x264vfw.dll [2011/04/11 21:30:05 | 000,700,168 | ---- | C] () -- E:\Windows\System32\perfh007.dat [2011/04/11 21:30:05 | 000,295,922 | ---- | C] () -- E:\Windows\System32\perfi007.dat [2011/04/11 21:30:05 | 000,148,964 | ---- | C] () -- E:\Windows\System32\perfc007.dat [2011/04/11 21:30:05 | 000,038,104 | ---- | C] () -- E:\Windows\System32\perfd007.dat [2011/04/11 14:09:18 | 000,073,216 | ---- | C] () -- E:\Windows\System32\ff_vfw.dll [2011/03/19 06:06:02 | 000,240,640 | ---- | C] () -- E:\Windows\System32\xvidvfw.dll [2011/03/19 06:04:28 | 000,650,752 | ---- | C] () -- E:\Windows\System32\xvidcore.dll [2010/11/20 17:29:34 | 000,080,896 | ---- | C] () -- E:\Windows\System32\RDVGHelper.exe [2010/11/20 17:29:26 | 000,066,048 | ---- | C] () -- E:\Windows\System32\PrintBrmUi.exe [2010/11/20 17:29:24 | 000,252,928 | ---- | C] () -- E:\Windows\System32\DShowRdpFilter.dll [2010/03/15 00:31:48 | 000,165,376 | ---- | C] () -- E:\Windows\System32\unrar.dll [2009/08/27 03:04:12 | 000,207,400 | R--- | C] () -- E:\Windows\GSetup.exe [2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat [2009/07/14 00:33:53 | 000,408,696 | ---- | C] () -- E:\Windows\System32\FNTCACHE.DAT [2009/07/13 22:05:48 | 000,654,880 | ---- | C] () -- E:\Windows\System32\perfh009.dat [2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- E:\Windows\System32\perfi009.dat [2009/07/13 22:05:48 | 000,121,752 | ---- | C] () -- E:\Windows\System32\perfc009.dat [2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- E:\Windows\System32\perfd009.dat [2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- E:\Windows\System32\NOISE.DAT [2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- E:\Windows\System32\dssec.dat [2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin [2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- E:\Windows\System32\BthpanContextHandler.dll [2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\System32\BWContextHandler.dll [2009/07/13 18:09:19 | 000,982,196 | ---- | C] () -- E:\Windows\System32\igkrng500.bin [2009/07/13 18:09:19 | 000,417,344 | ---- | C] () -- E:\Windows\System32\igcompkrng500.bin [2009/07/13 18:09:19 | 000,139,824 | ---- | C] () -- E:\Windows\System32\igfcg500.bin [2009/07/13 18:09:19 | 000,097,448 | ---- | C] () -- E:\Windows\System32\igfcg500m.bin [2009/06/19 15:06:22 | 000,197,912 | ---- | C] () -- E:\Windows\System32\physxcudart_20.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelTraditionalChinese.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSwedish.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSpanish.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSimplifiedChinese.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelPortugese.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelKorean.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelJapanese.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelGerman.dll [2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelFrench.dll [2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\System32\mlang.dat [2007/10/12 18:20:06 | 000,151,417 | ---- | C] () -- E:\Windows\System32\xlive.dll.cat [2007/02/05 15:05:26 | 000,000,038 | ---- | C] () -- E:\Windows\AviSplitter.INI [1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- E:\Windows\System32\giveio.sys ========== LOP Check ========== [2012/03/13 12:48:36 | 000,000,000 | ---D | M] -- E:\ProgramData\AMD [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data [2012/03/13 13:07:06 | 000,000,000 | ---D | M] -- E:\ProgramData\ashampoo [2012/09/23 18:04:43 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacks [2012/09/23 18:04:14 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacksSetup [2012/11/27 16:26:37 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites [2012/06/28 18:33:50 | 000,000,000 | ---D | M] -- E:\ProgramData\ICQ [2012/12/10 08:41:51 | 000,000,000 | ---D | M] -- E:\ProgramData\Solidshield [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü [2013/03/10 19:34:51 | 000,000,000 | ---D | M] -- E:\ProgramData\szcvlmmrfopiwja [2012/12/02 20:51:03 | 000,000,000 | ---D | M] -- E:\ProgramData\Tarma Installer [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen [2012/03/13 13:14:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Win7codecs [2013/01/30 15:19:19 | 000,032,632 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2013/01/14 12:26:37 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin [2012/03/13 12:46:28 | 000,000,000 | ---D | M] -- E:\AMD [2013/01/24 05:49:03 | 000,000,000 | -HSD | M] -- E:\Config.Msi [2012/10/07 08:35:12 | 000,000,000 | ---D | M] -- E:\DeusEx [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\Documents and Settings [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Dokumente und Einstellungen [2012/03/13 13:17:23 | 000,000,000 | RH-D | M] -- E:\MSOCache [2009/07/13 22:37:05 | 000,000,000 | ---D | M] -- E:\PerfLogs [2013/02/21 00:46:14 | 000,000,000 | ---D | M] -- E:\Program Files [2013/03/10 19:34:14 | 000,000,000 | -H-D | M] -- E:\ProgramData [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Programme [2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Recovery [2013/03/30 21:30:43 | 000,000,000 | -HSD | M] -- E:\RECYCLER [2013/03/23 04:05:15 | 000,000,000 | -HSD | M] -- E:\System Volume Information [2012/03/13 14:28:46 | 000,000,000 | ---D | M] -- E:\Temp [2013/01/14 12:26:30 | 000,000,000 | R--D | M] -- E:\Users [2013/03/29 22:51:57 | 000,000,000 | ---D | M] -- E:\Windows < %PROGRAMFILES%\*.exe > [2004/01/06 21:04:00 | 000,933,331 | ---- | M] (MAX DESIGN) -- E:\Program Files\1503Startup.exe [2005/10/05 07:00:16 | 002,187,264 | ---- | M] () -- E:\Program Files\AnnoSplash.exe [2010/10/16 13:00:54 | 007,970,816 | ---- | M] (home) -- E:\Program Files\Hero Editor.exe [2004/01/06 21:04:00 | 000,233,472 | ---- | M] () -- E:\Program Files\SAVRepair.exe Invalid Environment Variable: %LOCALAPPDATA%\*.exe < %systemroot%\*. /mp /s > < C:\Windows\system32\*.tsp > < MD5 for: AGP440.SYS > [2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\drivers\AGP440.sys [2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\drivers\atapi.sys [2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\System32\cngaudit.dll [2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2010/11/20 17:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2012/11/13 09:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) MD5=E4A0900CF535888DDD85B10040CA3E34 -- E:\Program Files\Spybot - Search & Destroy 2\explorer.exe [2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\explorer.exe [2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe < MD5 for: IASTORV.SYS > [2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\drivers\iaStorV.sys [2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011/03/11 01:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\System32\netlogon.dll [2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll < MD5 for: NVSTOR.SYS > [2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\drivers\nvstor.sys [2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys [2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011/03/11 01:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys [2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys < MD5 for: SCECLI.DLL > [2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\System32\scecli.dll [2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\System32\user32.dll [2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\System32\userinit.exe [2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe < MD5 for: WINLOGON.EXE > [2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\System32\winlogon.exe [2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\System32\drivers\ws2ifsl.sys [2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > [2010/11/20 17:29:08 | 000,828,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\fontext.dll [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\shell32.dll Invalid Environment Variable: %USERPROFILE%\*.* Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < CREATERESTOREPOINT > ========== Alternate Data Streams ========== @Alternate Data Stream - 763 bytes -> E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six: Vegas.LNK < End of report > die müssts sein |
|
31.03.2013, 08:25
| #17 |
| /// Malwareteam   | GVU Trojaner (abgesicherter modus nicht möglich) Du hast mir ein OTLPe-Logfile gepostet. Ich würd aber gern ein OTL-Log sehen.
__________________Lösche mal alle vorhandenen OTL.txt(s) und starte OTL (nicht OTLPE!) im normalen MOdus von Windows: Starte bitte die OTL.exe. Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button. Poste die OTL.txt und die Extras.txt hier in deinen Thread.
__________________ |
|
31.03.2013, 17:13
| #18 |
| | GVU Trojaner (abgesicherter modus nicht möglich) Habs (hoffentlich).OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 31.03.2013 18:05:00 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 25,30% Memory free 7,25 Gb Paging File | 4,11 Gb Available in Paging File | 56,71% Paging File free Paging file location(s): c:\pagefile.sys 4096 4096 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 465,66 Gb Total Space | 63,96 Gb Free Space | 13,74% Space Free | Partition Type: NTFS Drive F: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive G: | 465,73 Gb Total Space | 95,84 Gb Free Space | 20,58% Space Free | Partition Type: NTFS Computer Name: ROBERT-PC | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\IB Updater\ExtensionUpdaterService.exe () PRC - C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\dmwu.exe () PRC - C:\Program Files\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.) PRC - C:\Program Files\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.) PRC - C:\Program Files\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.) PRC - C:\Program Files\BlueStacks\HD-SharedFolder.exe (BlueStack Systems) PRC - C:\Program Files\BlueStacks\HD-BlockDevice.exe (BlueStack Systems) PRC - C:\Program Files\BlueStacks\HD-Network.exe (BlueStack Systems) PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Guard-ICQ\GuardICQ.exe () PRC - C:\Windows\System32\atieclxx.exe (AMD) PRC - C:\Windows\System32\atiesrxx.exe (AMD) PRC - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.) PRC - G:\Marcel\World of Warcraft\Wow.exe (Blizzard Entertainment) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) PRC - C:\Windows\System32\XSrvSetup.exe () PRC - C:\Program Files\avmwlanstick\FRITZWLANMini.exe (AVM Berlin) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\9f7b241c4cff24e6d0b554efb60aa8be\WindowsFormsIntegration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\239d84cfdb9de9730c1efb43840ef2eb\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\JSON\9a38bfe40050ff9fd8de66bf58f66d03\JSON.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\68b2aae0586d328fe37e3ded4e0b0fd0\HD-Agent.ni.exe () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7c4de95aa433eb8d81a81caf805947a8\PresentationFramework.Aero.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\03cfab5534482e8fc313ead6edc19100\System.Web.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\413288993ff690e8251d2dbe32bee01f\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1ec80905a71750be50dfc7981ad5ae28\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\aa983d1ad8df4422c0859ab4d6e19a83\UIAutomationProvider.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\53d6d827964619285771ed72332d3659\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b311b783e1efaa9527f4c2c9680c44d1\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll () MOD - C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl () MOD - C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl () MOD - C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl () MOD - C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl () MOD - C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl () MOD - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll () MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll () MOD - G:\Marcel\World of Warcraft\DivxDecoder.dll () MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll () MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF () MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () ========== Services (SafeList) ========== SRV - (SDWSCService) -- C:\Program Files\Spybot File not found SRV - (SDUpdateService) -- C:\Program Files\Spybot File not found SRV - (SDScannerService) -- C:\Program Files\Spybot File not found SRV - (KMService) -- C:\Windows\system32\srvany.exe File not found SRV - (IB Updater) -- C:\Program Files\IB Updater\ExtensionUpdaterService.exe () SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies) SRV - (IBUpdaterService) -- C:\Windows\System32\dmwu.exe () SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) SRV - (BstHdLogRotatorSvc) -- C:\Program Files\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.) SRV - (BstHdAndroidSvc) -- C:\Program Files\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.) SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (Guard.Mail.ru) -- C:\Program Files\Guard-ICQ\GuardICQ.exe () SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD) SRV - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.) SRV - (JMB36X) -- C:\Windows\System32\XSrvSetup.exe () SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found DRV - (gdrv) -- C:\Windows\gdrv.sys File not found DRV - (MpKsl04e96763) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl04e96763.sys (Microsoft Corporation) DRV - (MpKsl9a732883) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys () DRV - (MpKsl07894b93) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys () DRV - (MpKsl3d312dd0) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys () DRV - (MpKsle2a982e2) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys () DRV - (MpKsld861874d) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys () DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV - (BstHdDrv) -- C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys (BlueStack Systems) DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV - (AODDriver4.1) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices) DRV - (speedfan) -- C:\Windows\System32\speedfan.sys (Almico Software) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (tsusbhub) -- C:\Windows\System32\drivers\tsusbhub.sys (Microsoft Corporation) DRV - (Synth3dVsc) -- C:\Windows\System32\drivers\Synth3dVsc.sys (Microsoft Corporation) DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation) DRV - (terminpt) -- C:\Windows\System32\drivers\terminpt.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (amdiox86) -- C:\Windows\System32\drivers\amdiox86.sys (Advanced Micro Devices) DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.) DRV - (nusb3xhc) -- C:\Windows\System32\drivers\nusb3xhc.sys (NEC Electronics Corporation) DRV - (nusb3hub) -- C:\Windows\System32\drivers\nusb3hub.sys (NEC Electronics Corporation) DRV - (JRAID) -- C:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.) DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin) DRV - (giveio) -- C:\Windows\System32\giveio.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - C:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 5E 1C 2C 75 F2 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013.02.28 16:57:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}: C:\Program Files\IB Updater\Firefox [2013.02.28 16:57:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.30 04:20:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.30 04:20:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.08.25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.08.25 04:49:52 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.25 04:49:52 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.08.25 04:49:52 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.08.25 04:49:52 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.08.25 04:49:52 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - C:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh) O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\IB Updater\Extension32.dll () O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll File not found O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - C:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll File not found O3 - HKLM\..\Toolbar: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - C:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll File not found O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe (AVM Berlin) O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey File not found O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) F3 - HKCU WinNT: Run - (C:\Users\ADMINI~1\DOCUME~1\DAEMON~1\DAEMON~1.EXE) - File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: An OneNote s&enden - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.6.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C38115B5-928D-4845-A2B5-C20AC626E37A}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2011.03.09 21:28:18 | 000,231,518 | R--- | M] () - F:\autorun.ico -- [ UDF ] O32 - AutoRun File - [2010.02.11 05:05:02 | 000,000,047 | R--- | M] () - F:\autorun.inf -- [ UDF ] O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell - "" = AutoRun O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2010.09.15 22:54:40 | 000,394,016 | R--- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.31 06:39:37 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\UPDATE [2013.03.31 06:39:37 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\SKIDROW [2013.03.31 06:29:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\F3 [2013.03.31 04:37:49 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2013.03.31 04:37:45 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\Games for Windows - LIVE Demos [2013.03.31 03:54:16 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\ExpressFiles [2013.03.31 03:54:16 | 000,000,000 | ---D | C] -- C:\Program Files\ExpressFiles [2013.03.31 03:47:43 | 000,000,000 | ---D | C] -- C:\_OTL [2013.03.31 03:30:43 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2013.03.31 03:11:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2013.03.31 02:26:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows - LIVE [2013.03.31 02:25:32 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Games for Windows - LIVE [2013.03.31 02:06:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\DAEMON Tools Lite [2013.03.30 23:08:52 | 000,000,000 | ---D | C] -- C:\FRST [2013.03.15 19:20:34 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\ST6UNST #2 [2013.03.15 19:20:27 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\DAEMON Tools Lite [2012.11.18 12:17:28 | 000,929,844 | ---- | C] (Microsoft Corporation) -- C:\Program Files\MFC42D.DLL [2012.11.18 12:17:28 | 000,798,773 | ---- | C] (Microsoft Corporation) -- C:\Program Files\MFCO42D.DLL [2012.11.18 12:17:28 | 000,434,252 | ---- | C] (Microsoft Corporation) -- C:\Program Files\MSVCRTD.DLL [2012.11.18 12:17:28 | 000,421,888 | ---- | C] (Microsoft Corporation) -- C:\Program Files\MSVCRT.DLL [2012.11.18 12:17:27 | 000,069,632 | ---- | C] (MAX - DESIGN) -- C:\Program Files\Max_Sound.dll [2012.11.18 12:16:58 | 000,430,080 | ---- | C] (MAX - DESIGN) -- C:\Program Files\CompLogic.dll [2012.11.18 12:16:55 | 000,593,920 | ---- | C] (MAX DESIGN) -- C:\Program Files\AnnoFrame.dll [2012.11.18 12:16:12 | 000,933,331 | ---- | C] (MAX DESIGN) -- C:\Program Files\1503Startup.exe [2010.10.16 19:00:54 | 007,970,816 | ---- | C] (home) -- C:\Program Files\Hero Editor.exe ========== Files - Modified Within 30 Days ========== [2013.03.31 17:31:44 | 000,026,544 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.31 17:31:44 | 000,026,544 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.31 17:30:49 | 000,700,168 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.03.31 17:30:49 | 000,654,880 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.03.31 17:30:49 | 000,148,964 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.03.31 17:30:49 | 000,121,752 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.03.31 17:24:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.03.31 17:24:27 | 2616,057,856 | -HS- | M] () -- C:\hiberfil.sys [2013.03.31 04:03:58 | 015,532,679 | ---- | M] () -- C:\Users\Administrator\Desktop\Fable3crack-SR-BTARENA.rar [2013.03.31 03:53:53 | 000,000,000 | ---- | M] () -- C:\END [2013.03.31 03:37:03 | 000,441,022 | ---- | M] () -- C:\Users\Administrator\Desktop\pm-fcfiii.rar [2013.03.30 18:39:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe [2013.03.23 22:51:03 | 000,195,718 | ---- | M] () -- C:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg [2013.03.17 17:47:18 | 000,540,468 | ---- | M] () -- C:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg [2013.03.09 12:17:13 | 302,044,857 | ---- | M] () -- C:\Windows\MEMORY.DMP ========== Files Created - No Company Name ========== [2013.03.31 03:55:20 | 015,532,679 | ---- | C] () -- C:\Users\Administrator\Desktop\Fable3crack-SR-BTARENA.rar [2013.03.31 03:53:53 | 000,000,000 | ---- | C] () -- C:\END [2013.03.31 03:36:54 | 000,441,022 | ---- | C] () -- C:\Users\Administrator\Desktop\pm-fcfiii.rar [2013.03.23 22:49:00 | 000,195,718 | ---- | C] () -- C:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg [2013.03.17 17:46:59 | 000,540,468 | ---- | C] () -- C:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg [2013.01.16 07:10:53 | 000,007,168 | ---- | C] () -- C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.12.20 18:40:13 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2012.12.20 18:40:13 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2012.12.20 18:40:13 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2012.12.03 02:55:06 | 001,008,496 | ---- | C] () -- C:\Windows\System32\dmwu.exe [2012.12.03 02:55:06 | 000,028,160 | ---- | C] () -- C:\Windows\System32\ImHttpComm.dll [2012.11.18 12:17:28 | 000,708,608 | ---- | C] () -- C:\Program Files\View.dll [2012.11.18 12:17:28 | 000,233,472 | ---- | C] () -- C:\Program Files\SAVRepair.exe [2012.11.18 12:17:28 | 000,043,279 | ---- | C] () -- C:\Program Files\Texte.dat [2012.11.18 12:17:27 | 002,519,642 | ---- | C] () -- C:\Program Files\Handbuch.pdf [2012.11.18 12:17:26 | 025,305,841 | ---- | C] () -- C:\Program Files\FigurenHeader.dat [2012.11.18 12:17:25 | 014,289,592 | ---- | C] () -- C:\Program Files\Figuren200.dat [2012.11.18 12:17:23 | 016,039,347 | ---- | C] () -- C:\Program Files\Figuren102.dat [2012.11.18 12:17:21 | 016,777,177 | ---- | C] () -- C:\Program Files\Figuren101.dat [2012.11.18 12:17:19 | 016,777,198 | ---- | C] () -- C:\Program Files\Figuren100.dat [2012.11.18 12:17:18 | 011,190,229 | ---- | C] () -- C:\Program Files\Figuren009.dat [2012.11.18 12:17:16 | 016,785,902 | ---- | C] () -- C:\Program Files\Figuren008.dat [2012.11.18 12:17:14 | 016,769,888 | ---- | C] () -- C:\Program Files\Figuren007.dat [2012.11.18 12:17:11 | 016,776,353 | ---- | C] () -- C:\Program Files\Figuren006.dat [2012.11.18 12:17:09 | 016,776,964 | ---- | C] () -- C:\Program Files\Figuren005.dat [2012.11.18 12:17:06 | 016,777,905 | ---- | C] () -- C:\Program Files\Figuren004.dat [2012.11.18 12:17:04 | 016,776,259 | ---- | C] () -- C:\Program Files\Figuren003.dat [2012.11.18 12:17:02 | 016,777,308 | ---- | C] () -- C:\Program Files\Figuren002.dat [2012.11.18 12:17:00 | 016,778,359 | ---- | C] () -- C:\Program Files\Figuren001.dat [2012.11.18 12:16:58 | 016,775,920 | ---- | C] () -- C:\Program Files\Figuren000.dat [2012.11.18 12:16:58 | 000,358,963 | ---- | C] () -- C:\Program Files\binkw32.dll [2012.11.18 12:16:57 | 002,187,264 | ---- | C] () -- C:\Program Files\AnnoSplash.exe [2012.11.18 12:16:57 | 000,909,312 | ---- | C] () -- C:\Program Files\AnnoWelt.dll [2012.11.18 12:16:57 | 000,221,184 | ---- | C] () -- C:\Program Files\AnnoScene.dll [2012.11.18 12:16:57 | 000,184,320 | ---- | C] () -- C:\Program Files\AnnoGame.dll [2012.11.18 12:16:55 | 000,385,024 | ---- | C] () -- C:\Program Files\AnnoDisplay.dll [2012.11.18 12:16:13 | 192,149,051 | ---- | C] () -- C:\Program Files\Anlagen.dat [2012.08.30 16:39:18 | 000,139,228 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2012.04.13 13:59:57 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012.04.13 13:59:48 | 000,189,248 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2012.04.13 13:59:28 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2012.03.13 20:11:34 | 000,084,480 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\skype.dat [2012.03.13 18:43:51 | 000,065,536 | R--- | C] () -- C:\Windows\System32\XSrvSetup.exe [2012.03.13 18:43:03 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2012.03.13 18:39:10 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini [2012.03.13 18:33:54 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2012.03.13 18:29:22 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.02.15 04:28:34 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat [2012.02.15 04:28:32 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat [2012.02.14 23:05:16 | 000,054,784 | ---- | C] () -- C:\Windows\System32\OVDecode.dll [2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll [2012.01.10 23:10:08 | 000,601,728 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2011.05.13 10:58:12 | 002,785,280 | ---- | C] () -- C:\Windows\System32\x264vfw.dll [2011.05.12 13:53:30 | 000,147,456 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll [2011.04.12 03:30:05 | 000,700,168 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.04.12 03:30:05 | 000,148,964 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2011.04.11 20:09:18 | 000,073,216 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll ========== ZeroAccess Check ========== [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] "ThreadingModel" = Both "" = C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b\n. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 31.03.2013 18:05:00 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 25,30% Memory free
7,25 Gb Paging File | 4,11 Gb Available in Paging File | 56,71% Paging File free
Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,66 Gb Total Space | 63,96 Gb Free Space | 13,74% Space Free | Partition Type: NTFS
Drive F: | 7,55 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 465,73 Gb Total Space | 95,84 Gb Free Space | 20,58% Space Free | Partition Type: NTFS
Computer Name: ROBERT-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallDisableNotify" = 1
"FirewallOverride" = 0
"UpdatesDisableNotify" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish
"{0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD}" = ICQ Sparberater
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = IB Updater 2.0.0.574
"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Cinfigurer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018301}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018302}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018303}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018304}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018305}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018306}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018307}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018308}" = Fable III
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{4F198874-3C7D-5983-02EB-9E234C43F174}" = AMD Steady Video Plug-In
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{5731C0A8-B266-451A-8D3F-8066AA21836F}" = Tom Clancy's Rainbow Six Vegas
"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian
"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard
"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.03
"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.2.0.9
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian
"{943B2619-0E00-E9F1-73E3-03090965484E}" = AMD Media Foundation Decoders
"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DB7A055-0C66-C319-9613-CACDC50DDB38}" = ccc-utility
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A994E9F7-A748-FFB1-01C2-9D64ADE870B4}" = AMD Accelerated Video Transcoding
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish
"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian
"{C4100721-2D71-CC80-8877-0A7855B6EEFB}" = AMD Catalyst Install Manager
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese
"{CBAE26C1-B3B1-66FC-81A0-FA1774CF2B20}" = AMD Fuel
"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy
"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English
"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch
"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common
"{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503
"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F46AB543-90D1-86D7-99EE-4F94C1D206C8}" = AMD Drag and Drop Transcoding
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FC478285-6996-44A3-AB77-ECB34942A5E3}" = BlueStacks
"1ClickDownload" = Movie2KDownloader
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced
"DAEMON Tools Lite" = DAEMON Tools Lite
"Deus Ex" = Deus Ex
"FileConverter_1.3 Toolbar" = FileConverter 1.3 Toolbar
"GFWL_{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"Guard.Mail.ru" = Guard.ICQ
"incredibar" = Incredibar Toolbar on IE
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"Just Cause 2_is1" = Just Cause 2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PunkBusterSvc" = PunkBuster Services
"SpeedFan" = SpeedFan (remove only)
"ST6UNST #1" = Hero Editor V1.04
"ST6UNST #2" = Hero Editor V1.04 (C:\Program Files\Hero Editor\)
"Tactical Ops" = Tactical Ops
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 2.0.0
"WNLT" = IB Updater Service
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ExpressFiles" = ExpressFiles
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 29.03.2013 23:47:04 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 29.03.2013 23:53:10 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 30.03.2013 00:04:56 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 30.03.2013 00:06:05 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.03.2013 09:49:13 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 30.03.2013 09:50:22 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.03.2013 10:33:53 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 30.03.2013 10:35:30 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.03.2013 11:06:54 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.03.2013 11:10:02 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
Error - 30.03.2013 13:04:19 | Computer Name = Robert-PC | Source = BstHdAndroidSvc | ID = 0
Description = Der Dienst kann nicht gestartet werden. System.ApplicationException:
Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args) bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object
state)
[ System Events ]
Error - 31.03.2013 11:24:37 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 31.03.2013 11:24:37 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Microsoft Network Inspection System" ist von folgendem
Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 31.03.2013 11:24:37 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 31.03.2013 11:24:37 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist von folgendem
Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.
Error - 31.03.2013 11:24:39 | Computer Name = Robert-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
Feature:
%%886 Fehlercode: 0x8007042c Fehlerbeschreibung: Der Abhängigkeitsdienst oder die
Abhängigkeitsgruppe konnte nicht gestartet werden. Grund: %%892
Error - 31.03.2013 11:24:39 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Microsoft Network Inspection System" ist von folgendem
Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 31.03.2013 11:24:39 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Microsoft-Netzwerkinspektion" ist vom Dienst "Microsoft
Network Inspection System" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1075
Error - 31.03.2013 11:29:24 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 31.03.2013 11:29:24 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2147024891
Error - 31.03.2013 11:34:59 | Computer Name = Robert-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.147.712.0 Aktualisierungsquelle: %%859
Aktualisierungsphase:
%%852 Quellpfad: Default URL Signaturtyp: %%800 Aktualisierungstyp: %%803 Benutzer:
NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: Vorherige Modulversion: 1.1.9302.0 Fehlercode:
0x80070422 Fehlerbeschreibung: Der angegebene Dienst kann nicht gestartet werden.
Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
< End of report >
mfg devil94 |
|
31.03.2013, 18:37
| #19 | |
| /// Malwareteam | GVU Trojaner (abgesicherter modus nicht möglich) Mann, warum nur? Und dann auch noch während einer Bereinigung? Zitat:
Halte dich in Zukunft von sowas fern, solche Dateien sind zu 99% mit Schadprogrammen infiziert, die auf deinem PC als Backdoor fungieren und andere Malware nachladen. Auch von Warez-Seiten und Streaming-Portalen solltest du aus demselben Grund in Zukunft die Finger lassen. Sei mir nicht böse, aber so sind die Regeln. Gruß
__________________ Keep Jazzing!  DerJazzer Imperare sibi maximum imperium est. ©Seneca Wenn du uns unterstützen möchtest | http://www.anaesthesist-werden.de/ |
|
01.04.2013, 08:24
| #20 |
| | GVU Trojaner (abgesicherter modus nicht möglich) Okay, sorry und danke für den Support bis jetzt. Habe das spiel auf meinem laptop gefunden mit dem ich das geschrieben hab während mein pc infiziert war und wollts dann doch nochmal testen. war aber im endeffekt zu blöd ihn dann richtig zu benutzen.  hab die datei gelöscht. mfg devil94 |
|
| Themen zu GVU Trojaner (abgesicherter modus nicht möglich) |
| administrator, anlage, bho, bluestacks, error, explorer, explorer.exe, firefox, format, html, logfile, microsoft, mozilla, neu, nicht möglich, nvidia, object, plug-in, realtek, registry, required, rundll, scan, security, senden, software, stick, tarma, trojaner, winlogon, winlogon.exe |
Linear-Darstellung
