Firefox öffnet selbstständig Tabs - Kein Programm findet etwas

Floxch · 04.04.2010, 21:32

Hallo liebes Forum,
ich habe mal wieder ein Problem mit meinem PC. Firefox öffnet manchmal von selbst Tabs oder öffnet, wenn ich auf ein Google-Suchergebnis klicke, etwas komplett anderes, also Spy/Adware denke ich mal. Das Problem ist, dass weder Bitdefender, noch Kaspersky, noch Anti-Malware, noch Spybot noch Ad-Aware etwas finden und auch mit HJT kann ich nichts wirklich verdächtiges finden.
Hier der Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:30:08, on 04.04.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 4802 bytes

Ich bitte um Hilfe, irgendwie ist es kein angenehmens Gefühl zu wissen, dass etwas da ist aber man nichts machen kann^^

Vielen Dank!!

MfG
Flo

Edit:// Ganz vergessen.. Frohe Ostern euch allen :-P

Chris4You · 04.04.2010, 22:40

Hi,

das hört sich nach Rootkit an, ist das ein Win7 64Bit-System?
Passiert das auch im IE? Wenn nein dann wie folgt vorgehen:
(Manipulierter FF?)

Arbeite alles was unter dem Link angegeben ist ab und
berichte dann im Thread!
Erstmal keine PlugIns installieren und das gemachte
Backup von Firefox nicht einspielen.
http://www.trojaner-board.de/411645-post19.html

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop
* Doppelklick auf die OTL.exe
* Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
* Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
* Unter Extra Registry, wähle bitte Use SafeList
* Klicke nun auf Run Scan links oben
* Wenn der Scan beendet wurde werden 2 Logfiles erstellt
* Poste die Logfiles hier in den Thread.

Cureit:
http://www.trojaner-board.de/59299-anleitung-drweb-cureit.html
Nach Beendigung des Scans findes Du das Log unter %USERPROFILE%\DoctorWeb\CureIt.log.
Bevor du irgendwelche Aktionen unternimmst, kopiere bitte den Inhalt des Logs und poste ihn.
Die Log Datei ist sehr groß, ca. über 5MB Text. Benutzt einfach die Suche nach "infiziert" und kopiert betreffende Teile heraus, bevor Du sie postet.

Floxch · 05.04.2010, 10:06

Hey,
danke für die schnelle Antwort. Die Firefox Neu-Installation habe ich so oder so ähnlich mit Registry säubern bereits mehrfach durchgeführt, mache es allerdings jetzt nochmal. Backup brauche ich nicht, da hier sowieso nichts drauf is. Habe Windows 7 32 Bit. Ich habs mit dem IE noch nicht getestet, aber da er sich manchmal von selbst öffnen will und dabei abstürzt, nehme ich mal an, dass es nicht an Firefox liegt.

Log "OTL.txt":

OTL logfile created on: 05.04.2010 10:43:48 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Users\Flo\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 401,53 Gb Total Space | 31,21 Gb Free Space | 7,77% Space Free | Partition Type: NTFS
Drive D: | 529,98 Gb Total Space | 26,62 Gb Free Space | 5,02% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 145,08 Gb Free Space | 31,15% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BEATSTATION
Current User Name: Flo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Flo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Programme\SpeedFan\speedfan.exe (Almico Software (www.almico.com))
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\Flo\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\msvcr80.dll

(Microsoft Corporation)
MOD - C:\Programme\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (DAUpdaterSvc) -- C:\Programme\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision

Corporation)

========== Driver Services (SafeList) ==========

DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (Avgfwfd) -- C:\Windows\System32\drivers\avgfwd6x.sys (AVG Technologies CZ, s.r.o.)
DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (klbg) -- C:\Windows\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (WmXlCore) -- C:\Windows\System32\drivers\WmXlCore.sys (Logitech Inc.)
DRV - (WmVirHid) -- C:\Windows\System32\drivers\WmVirHid.sys (Logitech Inc.)
DRV - (WmFilter) -- C:\Windows\System32\drivers\WmFilter.sys (Logitech Inc.)
DRV - (WmBEnum) -- C:\Windows\System32\drivers\WmBEnum.sys (Logitech Inc.)
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (RivaTuner32) -- C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys ()
DRV - (RTL8167) -- C:\Windows\System32\drivers\Rt86win7.sys (Realtek )
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC-Seriellschnittstellentreiber (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother

Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) Brother MFC-nur-Fax-Modem (USB) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries

Ltd.)
DRV - (BrUsbSer) Brother MFC-WDM-Treiber (USB,seriell) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother

Industries Ltd.)
DRV - (BrSerWdm) Brother WDM-Treiber (seriell) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries

Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (RTL85n86) -- C:\Windows\System32\drivers\RTL85n86.sys (Realtek)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek

Semiconductor Corp.)
DRV - (hotcore3) -- C:\Windows\system32\DRIVERS\hotcore3.sys (Paragon Software Group)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (speedfan) -- C:\Windows\system32\speedfan.sys (Windows (R) 2000 DDK provider)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (giveio) -- C:\Windows\system32\giveio.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 EF 41 43 3A D0 CA 01

[binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender

2010\bdaphffext\ [2010.04.04 14:43:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files

\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010.04.04 15:18:39 | 000,000,000 | ---D | M]

[2010.04.05 10:34:22 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.04.04 15:19:42 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru

O1 HOSTS File: ([2010.04.04 21:50:43 | 000,385,166 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 13311 more lines...
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky

Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky

Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - Startup: C:\Users\Flo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpeedFan.lnk = C:

\Programme\SpeedFan\speedfan.exe (Almico Software (www.almico.com))
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security

2010\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab

\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab

\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin..._0_15-windows-

i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin..._0_15-windows-

i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet

Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet

Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows

\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky

Lab)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:

\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{f3e89474-02b1-11df-b429-90e6baf69de8}\Shell - "" = AutoRun
O33 - MountPoints2\{f3e89474-02b1-11df-b429-90e6baf69de8}\Shell\AutoRun\command - "" = K:\pushinst.exe -- File not

found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.04.05 10:33:24 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Users\Flo\Desktop\OTL.exe
[2010.04.05 10:32:34 | 000,000,000 | ---D | C] -- C:\Users\Flo\Desktop\RegSeeker
[2010.04.04 15:33:51 | 000,000,000 | ---D | C] -- C:\Users\Flo\Documents\Command & Conquer 3 Kanes Rache
[2010.04.04 15:29:55 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.04.04 15:29:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010.04.04 15:25:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.04.04 15:18:15 | 000,000,000 | ---D | C] -- C:\Programme\Kaspersky Lab
[2010.04.04 15:18:00 | 000,311,312 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2010.04.04 15:17:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
[2010.04.04 15:11:55 | 000,301,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cmd.exe
[2010.04.04 15:10:22 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
[2010.04.04 15:10:19 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010.04.04 15:05:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010.04.04 15:05:09 | 000,000,000 | ---D | C] -- C:\Programme\Lavasoft
[2010.04.04 15:05:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2010.04.04 14:48:21 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2010.04.04 10:02:03 | 000,000,000 | ---D | C] -- C:\Users\Flo\Documents\Command & Conquer 3 Tiberium Wars
[2010.04.03 18:31:56 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\BitDefender
[2010.04.03 18:31:39 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\MSSoap
[2010.04.03 18:31:23 | 000,000,000 | ---D | C] -- C:\Programme\BitDefender
[2010.04.03 18:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\BitDefender
[2010.04.03 18:30:38 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\BitDefender
[2010.04.03 17:45:09 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\Red Alert 3
[2010.04.03 16:23:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2010.04.03 12:00:18 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2010.04.03 11:35:13 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.04.01 12:59:32 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.04.01 12:59:32 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.04.01 12:59:32 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.03.30 20:53:13 | 000,024,856 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers

\avgfwd6x.sys
[2010.03.30 20:50:11 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Local\SKIDROW
[2010.03.29 15:58:01 | 000,000,000 | ---D | C] -- C:\!KillBox
[2010.03.27 19:05:20 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\s.t.a.l.k.e.r. - call of pripyat
[2010.03.27 18:34:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\directx
[2010.03.27 18:31:57 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\stalker-stcs
[2010.03.27 16:47:34 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\stalker-shoc
[2010.03.27 15:49:42 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Local\Logitech
[2010.03.27 15:48:31 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Logitech
[2010.03.27 15:41:36 | 000,000,000 | ---D | C] -- C:\Users\Flo\Documents\Square Enix
[2010.03.17 15:21:31 | 000,000,000 | ---D | C] -- C:\Users\Flo\Documents\4A Games
[2010.03.17 15:18:14 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Local\4A Games
[2010.03.17 15:17:06 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation
[2010.03.17 15:15:59 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2010.03.17 15:15:59 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2010.03.17 15:15:59 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2010.03.17 15:15:58 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2010.03.14 17:12:01 | 000,000,000 | ---D | C] -- C:\Windows\95FC26FB19FD4A96BBB1B1062E8648F5.TMP
[2010.03.14 17:11:55 | 000,000,000 | ---D | C] -- C:\ProgramData\THQ
[2010.03.14 12:57:49 | 000,000,000 | ---D | C] -- C:\Users\Flo\AppData\Roaming\BoneTown
[2010.03.14 12:33:23 | 000,000,000 | ---D | C] -- C:\Programme\BoneTown
[2010.03.13 11:05:35 | 000,000,000 | ---D | C] -- C:\Programme\Infogrames
[2010.03.13 11:05:23 | 000,315,904 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[2010.03.12 19:19:19 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2010.03.08 22:11:18 | 000,000,000 | ---D | C] -- C:\Windows\E4D153288C89484BB9AAF5BE9EA6D01C.TMP
[7 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.04.05 10:45:16 | 006,815,744 | -HS- | M] () -- C:\Users\Flo\NTUSER.DAT
[2010.04.05 10:33:18 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Flo\Desktop\OTL.exe
[2010.04.05 10:22:54 | 002,741,796 | -H-- | M] () -- C:\Users\Flo\AppData\Local\IconCache.db
[2010.04.05 10:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At11.job
[2010.04.05 09:06:03 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At10.job
[2010.04.05 08:59:25 | 001,501,000 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.04.05 08:59:25 | 000,654,096 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.04.05 08:59:25 | 000,615,760 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.04.05 08:59:25 | 000,130,952 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.04.05 08:59:25 | 000,107,396 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.04.05 08:58:25 | 000,019,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

1.C7483456-A289-439d-8115-601632D005A0
[2010.04.05 08:58:24 | 000,019,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-

0.C7483456-A289-439d-8115-601632D005A0
[2010.04.05 08:53:20 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.04.05 08:53:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.04.05 08:53:11 | 2408,931,328 | -HS- | M] () -- C:\hiberfil.sys
[2010.04.04 23:06:04 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At24.job
[2010.04.04 22:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At23.job
[2010.04.04 22:01:23 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At19.job
[2010.04.04 21:50:43 | 000,385,166 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.04.04 21:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At22.job
[2010.04.04 20:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At21.job
[2010.04.04 19:57:06 | 000,293,376 | ---- | M] () -- C:\Users\Flo\Desktop\ld4cdrly.exe
[2010.04.04 19:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At20.job
[2010.04.04 17:53:48 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At17.job
[2010.04.04 17:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At18.job
[2010.04.04 15:19:35 | 000,108,059 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat
[2010.04.04 15:19:35 | 000,095,259 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat
[2010.04.04 15:18:00 | 000,311,312 | ---- | M] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2010.04.04 15:10:18 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010.04.04 15:10:18 | 000,015,880 | ---- | M] () -- C:\Windows\System32\lsdelete.exe
[2010.04.04 15:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At16.job
[2010.04.04 14:43:00 | 000,000,052 | ---- | M] () -- C:\Windows\System32\ashttpstats.csv
[2010.04.04 14:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At15.job
[2010.04.04 13:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At14.job
[2010.04.04 12:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At13.job
[2010.04.04 11:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At12.job
[2010.04.04 01:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At2.job
[2010.04.04 00:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At1.job
[2010.04.03 21:49:03 | 000,000,025 | ---- | M] () -- C:\Users\Flo\AppData\Roaming\bdfvconp.ini
[2010.04.03 21:48:59 | 000,000,385 | ---- | M] () -- C:\Windows\System32\user_gensett.xml
[2010.04.03 19:03:13 | 000,004,096 | ---- | M] () -- C:\Windows\d3dx.dat
[2010.04.03 18:41:50 | 000,000,132 | ---- | M] () -- C:\Windows\System32\rezumatenoi.dat
[2010.04.03 18:40:06 | 000,072,200 | ---- | M] (BitDefender LLC) -- C:\Windows\System32\drivers\BdfNdisf6.sys
[2010.04.03 17:45:07 | 000,000,040 | ---- | M] () -- C:\ProgramData\ra3.ini
[2010.04.03 17:30:51 | 000,001,775 | ---- | M] () -- C:\Users\Public\Desktop\Command & Conquer™ Alarmstufe Rot

3.lnk
[2010.04.03 16:47:20 | 000,000,112 | ---- | M] () -- C:\ProgramData\42ubhu54.dat
[2010.04.03 12:00:14 | 000,001,463 | ---- | M] () -- C:\Users\Flo\Desktop\Command & Conquer 3 Tiberium Wars Kanes

Rache.lnk
[2010.04.03 11:29:20 | 000,000,564 | ---- | M] () -- C:\Users\Flo\Desktop\Command & Conquer 3 Tiberium Wars.lnk
[2010.04.02 14:13:52 | 000,005,632 | ---- | M] () -- C:\Windows\System32\BReWErS.dll
[2010.04.02 10:39:44 | 000,022,328 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.04.02 10:39:44 | 000,022,328 | ---- | M] () -- C:\Users\Flo\AppData\Roaming\PnkBstrK.sys
[2010.04.02 10:39:27 | 000,669,184 | ---- | M] () -- C:\Windows\System32\pbsvc.exe
[2010.04.01 14:53:08 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At9.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At8.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At7.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At6.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At5.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At4.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At3.job
[2010.03.30 21:14:47 | 000,024,856 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers

\avgfwd6x.sys
[2010.03.29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers

\mbamswissarmy.sys
[2010.03.29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.03.29 14:47:23 | 000,000,605 | ---- | M] () -- C:\Users\Flo\Desktop\Just Cause spielen.lnk
[2010.03.27 19:18:38 | 000,006,636 | ---- | M] () -- C:\Users\Public\Documents\s.t.a.l.k.e.r.ltx
[2010.03.14 17:57:01 | 000,215,144 | ---- | M] () -- C:\Windows\patchw32.dll
[2010.03.11 16:08:53 | 721,573,888 | ---- | M] () -- C:\Users\Flo\Desktop\LinuxMint-8.iso
[7 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.04 22:12:20 | 000,293,376 | ---- | C] () -- C:\Users\Flo\Desktop\ld4cdrly.exe
[2010.04.04 17:55:23 | 721,573,888 | ---- | C] () -- C:\Users\Flo\Desktop\LinuxMint-8.iso
[2010.04.04 15:19:35 | 000,108,059 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2010.04.04 15:19:35 | 000,095,259 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2010.04.04 15:16:46 | 000,430,080 | ---- | C] () -- C:\Users\Flo\Desktop\chcc3trn14.exe
[2010.04.04 15:12:15 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2010.04.03 22:43:24 | 000,000,052 | ---- | C] () -- C:\Windows\System32\ashttpstats.csv
[2010.04.03 21:49:03 | 000,000,025 | ---- | C] () -- C:\Users\Flo\AppData\Roaming\bdfvconp.ini
[2010.04.03 21:48:59 | 000,000,385 | ---- | C] () -- C:\Windows\System32\user_gensett.xml
[2010.04.03 19:03:13 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.04.03 18:41:50 | 000,000,132 | ---- | C] () -- C:\Windows\System32\rezumatenoi.dat
[2010.04.03 18:23:17 | 000,333,556 | ---- | C] () -- C:\Users\Flo\Desktop\ReUnion.exe
[2010.04.03 18:22:49 | 000,350,283 | ---- | C] () -- C:\Users\Flo\Desktop\rzr-cc1t.exe
[2010.04.03 17:45:07 | 000,000,040 | ---- | C] () -- C:\ProgramData\ra3.ini
[2010.04.03 17:30:51 | 000,001,775 | ---- | C] () -- C:\Users\Public\Desktop\Command & Conquer™ Alarmstufe Rot

3.lnk
[2010.04.03 12:00:14 | 000,001,463 | ---- | C] () -- C:\Users\Flo\Desktop\Command & Conquer 3 Tiberium Wars Kanes

Rache.lnk
[2010.04.03 11:40:32 | 000,659,456 | ---- | C] () -- C:\Users\Flo\Desktop\cnc3kwr-rs.exe
[2010.04.03 11:29:20 | 000,000,564 | ---- | C] () -- C:\Users\Flo\Desktop\Command & Conquer 3 Tiberium Wars.lnk
[2010.03.31 11:06:51 | 000,065,026 | ---- | C] () -- C:\Windows\Fonts\0e40I.com_
[2010.03.31 11:05:03 | 000,000,112 | ---- | C] () -- C:\ProgramData\42ubhu54.dat
[2010.03.31 11:04:48 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At24.job
[2010.03.31 11:04:47 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At23.job
[2010.03.31 11:04:47 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At22.job
[2010.03.31 11:04:47 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At21.job
[2010.03.31 11:04:46 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At20.job
[2010.03.31 11:04:46 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At19.job
[2010.03.31 11:04:46 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At18.job
[2010.03.31 11:04:46 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At17.job
[2010.03.31 11:04:45 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At16.job
[2010.03.31 11:04:45 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At15.job
[2010.03.31 11:04:45 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At14.job
[2010.03.31 11:04:44 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At13.job
[2010.03.31 11:04:44 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At12.job
[2010.03.31 11:04:44 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At11.job
[2010.03.31 11:04:44 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At10.job
[2010.03.31 11:04:43 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At9.job
[2010.03.31 11:04:43 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At8.job
[2010.03.31 11:04:42 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At7.job
[2010.03.31 11:04:42 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At6.job
[2010.03.31 11:04:42 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At5.job
[2010.03.31 11:04:41 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At4.job
[2010.03.31 11:04:41 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At3.job
[2010.03.31 11:04:41 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At2.job
[2010.03.31 11:04:40 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\At1.job
[2010.03.29 14:47:23 | 000,000,605 | ---- | C] () -- C:\Users\Flo\Desktop\Just Cause spielen.lnk
[2010.03.27 19:06:39 | 000,006,636 | ---- | C] () -- C:\Users\Public\Documents\s.t.a.l.k.e.r.ltx
[2010.03.14 17:57:01 | 000,215,144 | ---- | C] () -- C:\Windows\patchw32.dll
[2010.02.26 18:41:28 | 000,005,632 | ---- | C] () -- C:\Windows\System32\BReWErS.dll
[2010.02.16 13:14:53 | 000,000,810 | ---- | C] () -- C:\Windows\Rtcw.INI
[2010.02.16 09:59:02 | 000,000,031 | ---- | C] () -- C:\Windows\Q3CDKey.ini
[2010.02.16 09:36:39 | 000,000,871 | ---- | C] () -- C:\Windows\QIII.INI
[2010.02.15 12:35:06 | 000,000,987 | ---- | C] () -- C:\Windows\Q3TA.ini
[2010.02.15 01:36:16 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2010.02.15 00:45:11 | 000,000,347 | ---- | C] () -- C:\Windows\CODUO.ini
[2010.02.13 12:55:22 | 000,000,745 | ---- | C] () -- C:\Windows\COD.INI
[2010.01.31 12:58:38 | 000,000,000 | ---- | C] () -- C:\Windows\ZDDBView.INI
[2010.01.31 12:58:36 | 000,000,963 | ---- | C] () -- C:\Windows\AudioWB99.ini
[2010.01.31 12:58:36 | 000,000,002 | ---- | C] () -- C:\Windows\zdbui.ini
[2010.01.31 12:58:36 | 000,000,000 | ---- | C] () -- C:\Windows\zdbui32.ini
[2010.01.08 15:29:00 | 000,000,091 | ---- | C] () -- C:\Users\Flo\AppData\Local\fusioncache.dat
[2010.01.07 19:54:56 | 000,000,770 | ---- | C] () -- C:\Windows\Sof2.INI
[2010.01.07 18:59:25 | 000,000,991 | ---- | C] () -- C:\Windows\disney.ini
[2010.01.07 18:37:51 | 000,000,058 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2010.01.07 16:27:08 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.01.07 16:27:08 | 000,022,328 | ---- | C] () -- C:\Users\Flo\AppData\Roaming\PnkBstrK.sys
[2010.01.07 16:26:32 | 000,000,287 | ---- | C] () -- C:\Windows\game.ini
[2010.01.06 19:58:06 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2010.01.06 18:30:41 | 000,000,760 | ---- | C] () -- C:\Users\Flo\AppData\Roaming\setup_ldm.iss
[2010.01.06 18:15:10 | 006,815,744 | -HS- | C] () -- C:\Users\Flo\NTUSER.DAT
[2010.01.06 18:15:10 | 000,524,288 | -HS- | C] () -- C:\Users\Flo\NTUSER.DAT{6cced2f1-6e01-11de-8bed-

001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2010.01.06 18:15:10 | 000,524,288 | -HS- | C] () -- C:\Users\Flo\NTUSER.DAT{6cced2f1-6e01-11de-8bed-

001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.01.06 18:15:10 | 000,262,144 | -HS- | C] () -- C:\Users\Flo\ntuser.dat.LOG1
[2010.01.06 18:15:10 | 000,065,536 | -HS- | C] () -- C:\Users\Flo\NTUSER.DAT{6cced2f1-6e01-11de-8bed-

001e0bcd1824}.TM.blf
[2010.01.06 18:15:10 | 000,000,020 | -HS- | C] () -- C:\Users\Flo\ntuser.ini
[2010.01.06 18:15:10 | 000,000,000 | -HS- | C] () -- C:\Users\Flo\ntuser.dat.LOG2
[2009.12.11 21:49:46 | 000,023,040 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.03.04 00:54:58 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2004.08.13 10:56:20 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2002.10.03 15:42:27 | 000,000,034 | ---- | C] () -- C:\Windows\Q3version.ini
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
< End of report >

Log "Extras.txt":

OTL Extras logfile created on: 05.04.2010 10:43:48 - Run 1
OTL by OldTimer - Version 3.2.1.0 Folder = C:\Users\Flo\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 401,53 Gb Total Space | 31,21 Gb Free Space | 7,77% Space Free | Partition Type: NTFS
Drive D: | 529,98 Gb Total Space | 26,62 Gb Free Space | 5,02% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 145,08 Gb Free Space | 31,15% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BEATSTATION
Current User Name: Flo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1"

()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1"

()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{05C077EA-6B28-35E8-FCE9-86A08FDA0414}" = ccc-utility
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0B9E0BD1-328D-415C-80A5-6B0028F0C104}" = Call of Duty(R) 2 Patch 1.2
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{11BFB898-71E5-488A-A8FF-0E462667FB72}" = Soldier of Fortune Payback
"{1367FA2F-2B3D-430F-872F-588B93420BFC}" = TimeShift
"{152B782A-05F3-48EC-9AAC-4D3EB68D9E20}" = Quake 4(TM)
"{18EF2DEE-DCB0-466A-ABA5-4C73E508530A}" = Medal of Honor Allied Assault(tm) Spearhead Patch 2.15
"{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{217254AD-7DC2-8E55-B0AA-DF40293E2568}" = Catalyst Control Center Graphics Full Existing
"{2319A25C-57C8-148A-B89E-963B691F80AB}" = CCC Help Hungarian
"{24508D50-EB8F-4FE6-B69D-B4935D8745EF}_is1" = Warsow 0.5
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{25F28E39-FDBB-11DB-8314-0800200C9A66}" = Medal of Honor Airborne
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquer™ Alarmstufe Rot 3
"{2B653229-9854-4989-B780-D978F5F13EAB}" = FEAR
"{2C8B0579-46E6-4088-8E57-44833265798F}" = THE HOUSE OF THE DEAD 2
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}" = Need for Speed™ ProStreet
"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations
"{2EE6972B-6DE0-0DF9-2D45-5FCA0110BB35}" = ATI AVIVO Codecs
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{329BF75E-4876-4687-9CAD-5AE7DE56EA22}" = The Punisher
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{33BC9D7E-E790-495E-A4EA-CFB160C17A91}" = Logitech Gaming Software 5.08
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{462E2065-E54B-4CFD-87A2-BAE82EEFACD1}" = Catalyst Control Center Core Implementation
"{46D1B803-63C8-B1F7-F803-2CABFF3BADD3}" = CCC Help French
"{4BBDC0E5-6457-CDB9-F1C4-C79321D448AA}" = CCC Help Portuguese
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{50A1E01F-21A4-4FB9-B0BA-76CEB5D8D5F5}" = SCARFACE: THE WORLD IS YOURS
"{52B65911-1559-4ED5-9461-46957FDD48CD}" = Borderlands
"{52D1D62C-FEAB-4580-849E-1DB624BADBBD}" = DiRT2
"{54194F60-988C-4D03-B922-C2B00EFDA39A}" = NVIDIA PhysX
"{54510837-BD04-4C32-9676-DB1000028201}" = Red Faction: Guerrilla
"{557EDA52-5803-C91F-A0A5-635317063D8D}" = Catalyst Control Center Graphics Full New
"{56CFA833-F44F-4199-8C58-7F8B38F2BC7B}" = Medal of Honor Pacific Assault(tm)
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{57B89E30-0BBA-4F20-9F2C-8E8CDE1CEDB6}" = DiRT
"{5A0B7BA5-4682-4273-81C2-69B17E649103}" = GRID
"{5A9A2B89-58BC-DFB9-CF7F-1127A26A6D1D}" = CCC Help Spanish
"{5C9A7E65-5B71-4C7F-876A-8C6AF9E9E23D}" = Saboteur™
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{5E7C721D-B008-4269-A1C4-2CE7E9757983}" = BoneTown
"{5EAC9508-9B4C-84B4-A7B8-62734E8EC4BF}" = ATI Problem Report Wizard
"{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}" = GameSpy Comrade
"{65A7D970-7915-4311-E3CC-08745BDF6A66}" = CCC Help English
"{6AC06152-AD39-D387-6D3B-2A4D0556F207}" = Catalyst Control Center Graphics Previews Common
"{6C9FA746-8759-4040-A436-42922CB3492E}" = VistaBootPRO 3.3
"{6D71D21F-1535-487B-BB5D-57E3A8A764A2}_is1" = NecroVisioN Patch 1.2
"{7222FE15-CEDA-9142-A488-CB4AA559F7F9}" = Catalyst Control Center Graphics Previews Vista
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{78D8028B-D2BA-A3B9-2EA8-D30F25E3F87F}" = ccc-core-static
"{7914BE1E-F186-4790-B8F4-9F63C52A41C1}" = Medal of Honor Allied Assault(tm) Spearhead
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7E06305E-6E2C-EBFA-69E9-782891EF06EF}" = Catalyst Control Center Localization All
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{81FF29CE-2D23-45FC-8BDE-7491A15F2B02}" = NecroVisioN
"{823A68CC-3049-4A6B-8F63-7DC85E4BB1C9}" = Medal of Honor Allied Assault(tm) Breakthrough
"{83437081-8186-4F63-BD39-4BE8A691E055}" = Hidden & Dangerous 2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{89661B04-C646-4412-B6D3-5E19F02F1F37}" = EAX4 Unified Redist
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{91C514E8-C92E-48E4-BDEE-DE3407837194}" = Wolfenstein(TM) 1.2 Patch
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"{934DE9F7-7498-0FC4-FC6A-166097F218F4}" = CCC Help Italian
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A996B6A-846E-4A89-B9C4-17546B7BE49F}" = Burnout(TM) Paradise The Ultimate Box
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{A1416622-0DDE-45B5-B06C-DFC3ED94C53B}" = Der Pate® II
"{A35001F0-F1E4-11DD-A38B-005056C00008}" = Paragon Partition Manager™ 10.0 Professional
"{A357EF4C-2B6F-4980-ACA9-B1E42A74D7F3}" = Red Faction Guerrilla
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}" = Hitman Blood Money
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B418F434-15CD-4B68-A022-CFE0DB92A6F9}" = THE HOUSE OF THE DEAD 3
"{B7E797F4-2642-BEF9-055B-13B930C9D665}" = CCC Help German
"{BB47D7EA-7EF1-475C-9C14-AF5B8FCA45E2}" = Condemned - Criminal Origins
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{BE699EDC-9E58-4671-A23E-9CDF7F6F42F2}" = Medal of Honor Allied Assault(tm) Spearhead
"{BE9A67F1-BDD3-4259-9F5C-2EFCE6B3A6C5}" = Clive Barker's Jericho
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C12A2A3D-0D08-8262-E189-E831A8AC3D37}" = Catalyst Control Center InstallProxy
"{C139A440-9691-AB3C-8AFB-F8FCAC960014}" = CCC Help Polish
"{C24EF652-3DEF-418A-AD96-B95D86AFCB82}_is1" = NecroVisioN Patch 1.1
"{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}" = Test Drive Unlimited
"{C3A5A0C9-5DBE-7A06-1285-D00F21E19FCF}" = Catalyst Control Center Graphics Light
"{C40C3C3D-97CF-44B5-836C-766E374464B3}" = 3DMark Vantage
"{C711E88C-9DC2-4254-A989-D6E017844DDF}" = Frontlines: Fuel of War
"{C9E270CC-AE42-4BD8-B9C6-1EB3A8657FF5}" = Just Cause 1.00.0000
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kanes Rache
"{CC53FB29-E042-1744-2D35-DE2A100B6210}" = CCC Help Greek
"{CE8C262E-5DB4-C8AC-7DA2-DC88767653A1}" = HydraVision
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.3.22 Game
"{D3F3A0AC-45BF-43FD-B6C6-DDBE9D65C189}_is1" = NecroVisioN Lost Company
"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{DD6A0EE6-A8D3-449F-95B7-C971FBB0D19D}" = Call of Duty(R) 2 Patch 1.01
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF9046D6-5F1F-40B6-9782-3DC2D902D391}" = Medal of Honor Allied Assault(tm) Breakthrough v2.40 Patch
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{E701BC6B-26B5-4F72-AA45-A24AC88624E9}_is1" = S.T.A.L.K.E.R. - Shadow of Chernobyl
"{E85E4F22-F753-4463-8DF2-9E5B7BFF5FC7}" = Hidden & Dangerous 2 Sabre Squadron
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F241EC95-C81A-466E-8006-6B0B364B07A0}" = PCMark Vantage
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F51FF206-2273-4B3E-A90A-4752AE288C12}" = FUEL
"{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"{FDBBAF14-5ED8-49B7-A5BE-1C35668B074D}" = Unreal Tournament 3 (LG)
"{FE2188AD-BDFA-AC75-F326-86043F06B48F}" = Catalyst Control Center HydraVision Full
"{FEFAF112-4DA8-479C-89E2-7DE25091711A}" = Call of Juarez - Bound in Blood
"{FF3C203A-2F19-43A2-9C7C-EC1B5A0FC873}" = Pure
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Alien Shooter" = Alien Shooter
"Alien Shooter - Vengeance" = Alien Shooter - Vengeance
"Alien Shooter 2" = Alien Shooter 2
"Best of C64 Classix" = Best of C64 Classix
"Blood2" = Blood2
"Blood2 v1.01 Patch" = Blood2 v1.01 Patch
"Brothers in Arms - Hell's Highway" = Brothers in Arms: Hell's Highway
"BrothersInArms" = Brothers In Arms
"BrothersInArmsEiB" = Brothers In Arms EiB
"Call of Duty" = Call of Duty
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"CCleaner" = CCleaner
"Counter-Strike 1.6 V35" = Counter-Strike 1.6 V35
"Counter-Strike: Source v17" = Counter-Strike: Source v17
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"Darkest of Days v1.05 Update" = Darkest of Days v1.05 Update
"Darkest of Days_is1" = Raven Squad
"DFX for Windows Media Player" = DFX for Windows Media Player
"EADM" = EA Download Manager
"EAX Unified" = EAX Unified
"HD2: Sabre Squadron Patch" = HD2: Sabre Squadron Patch
"Hell In The Pacific 2.0" = Hell In The Pacific 2.0
"Hell In The Pacific 2.0.1 Patch" = Hell In The Pacific 2.0.1 Patch
"Hidden & Dangerous 2 Patch" = Hidden & Dangerous 2 Patch
"HijackThis" = HijackThis 2.0.2
"Hogs Of War" = Frontschweine
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{152B782A-05F3-48EC-9AAC-4D3EB68D9E20}" = Quake 4(TM)
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{50A1E01F-21A4-4FB9-B0BA-76CEB5D8D5F5}" = SCARFACE: THE WORLD IS YOURS
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{83437081-8186-4F63-BD39-4BE8A691E055}" = Hidden & Dangerous 2
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer

Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{91C514E8-C92E-48E4-BDEE-DE3407837194}" = Wolfenstein(TM) 1.2 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM)
"InstallShield_{A357EF4C-2B6F-4980-ACA9-B1E42A74D7F3}" = Red Faction Guerrilla
"InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"InstallShield_{E85E4F22-F753-4463-8DF2-9E5B7BFF5FC7}" = Hidden & Dangerous 2 Sabre Squadron
"InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein
"InstallShield_{FEFAF112-4DA8-479C-89E2-7DE25091711A}" = Call of Juarez - Bound in Blood
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"JDownloader" = JDownloader
"Just Cause 2_is1" = Just Cause 2
"kopfjeager_is1" = Operation Blitzsturm (1.01)
"Left 4 Dead" = Left 4 Dead
"Mafia" = Mafia
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MegaTrainer eXperience_is1" = MegaTrainer eXperience V1.0.0.4b
"Mortyr2_is1" = Mortyr 2 v 1.350
"OpenAL" = OpenAL
"Postal Fudge Pack" = Postal Fudge Pack
"PunkBusterSvc" = PunkBuster Services
"Quake III Arena" = Quake III Arena
"Quake III Arena Point Release 1.32" = Quake III Arena Point Release 1.32
"Quake III Team Arena" = Quake III Team Arena
"Race On_is1" = Race On
"Return to Castle Wolfenstein" = Return to Castle Wolfenstein
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"Saints Row 2 Update 2" = Saints Row 2 Update 2
"SAS Secure Tomorrow_is1" = SAS Secure Tomorrow (1.0)
"Soldat_is1" = Soldat 1.5.0
"Soldier of Fortune II - Double Helix" = Soldier of Fortune II - Double Helix
"Steamless Day of Defeat Source Pack" = Steamless Day of Defeat Source Pack
"Steamless Left4Dead2 Pack" = Steamless Left4Dead2 Pack
"Steamless Team Fortress 2 Pack" = Steamless Team Fortress 2 Pack
"VLC media player" = VLC media player 1.0.5
"WhiteCap" = WhiteCap
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"Zombie Driver" = Zombie Driver 1.0.3
"Zombie Shooter 2_is1" = Zombie Shooter 2 v 1.0
"Zombie Shooter_is1" = Zombie Shooter

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"InstallShield_{FDBBAF14-5ED8-49B7-A5BE-1C35668B074D}" = Unreal Tournament 3 (LG)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 02.04.2010 04:29:26 | Computer Name = Beatstation | Source = MsiInstaller | ID = 1024
Description =

Error - 02.04.2010 04:31:08 | Computer Name = Beatstation | Source = MsiInstaller | ID = 1024
Description =

Error - 02.04.2010 05:03:10 | Computer Name = Beatstation | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Crysis.exe, Version: 1.1.1.6156,
Zeitstempel: 0x47d6d167 Name des fehlerhaften Moduls: CryGame.dll, Version: 1.1.1.6156,
Zeitstempel: 0x47d6d60e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000853ae ID des fehlerhaften
Prozesses: 0xd80 Startzeit der fehlerhaften Anwendung: 0x01cad2432801734c Pfad der
fehlerhaften Anwendung: C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CryGame.dll
Berichtskennung:
8ef14b83-3e36-11df-9e01-001a4f479f7d

Error - 02.04.2010 05:49:24 | Computer Name = Beatstation | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Crysis.exe, Version: 1.1.1.6156,
Zeitstempel: 0x47d6d167 Name des fehlerhaften Moduls: cryaction.dll, Version: 1.1.1.6156,
Zeitstempel: 0x47d6d492 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001c03c ID des fehlerhaften
Prozesses: 0x2a8 Startzeit der fehlerhaften Anwendung: 0x01cad2436e2f00bf Pfad der
fehlerhaften Anwendung: C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\cryaction.dll
Berichtskennung:
046d94df-3e3d-11df-9e01-001a4f479f7d

Error - 03.04.2010 04:37:34 | Computer Name = Beatstation | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16385,
Zeitstempel: 0x4a5bc69e Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000e5d0 ID des fehlerhaften
Prozesses: 0xe1c Startzeit der fehlerhaften Anwendung: 0x01cad308e76e7de0 Pfad der
fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe Pfad des
fehlerhaften Moduls: unknown Berichtskennung: 25e2fc57-3efc-11df-8062-001a4f479f7d

Error - 03.04.2010 11:26:06 | Computer Name = Beatstation | Source = MsiInstaller | ID = 11500
Description =

Error - 03.04.2010 11:26:06 | Computer Name = Beatstation | Source = MsiInstaller | ID = 11500
Description =

Error - 03.04.2010 11:26:07 | Computer Name = Beatstation | Source = MsiInstaller | ID = 11500
Description =

Error - 03.04.2010 11:26:07 | Computer Name = Beatstation | Source = MsiInstaller | ID = 11500
Description =

Error - 03.04.2010 11:31:10 | Computer Name = Beatstation | Source = MsiInstaller | ID = 11500
Description =

[ System Events ]
Error - 01.04.2010 14:44:49 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgfwfd

Error - 02.04.2010 03:12:37 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgfwfd

Error - 02.04.2010 03:16:30 | Computer Name = Beatstation | Source = bowser | ID = 8003
Description =

Error - 02.04.2010 08:11:25 | Computer Name = Beatstation | Source = ag8z0ja5 | ID = 262153
Description =

Error - 02.04.2010 08:57:35 | Computer Name = Beatstation | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.

Error - 03.04.2010 04:34:34 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgfwfd

Error - 03.04.2010 11:09:28 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
Fehler beendet: %%-2147014847

Error - 03.04.2010 11:09:33 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgfwfd

Error - 03.04.2010 11:10:32 | Computer Name = Beatstation | Source = WMPNetworkSvc | ID = 866300
Description =

Error - 03.04.2010 11:14:58 | Computer Name = Beatstation | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Avgfwfd

< End of report >

DrWeb Log:

[Speicherscannen] Speichervorgang: C:\Windows\system32\svchost.exe:1252 infiziert mit BackDoor.Tdss.565 - beseitigt
C:\Windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - wird nach Neustart desinfiziert
C:\Windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - Desinfektion nicht möglich

Dann fragte mich Dr. Web ob ich die atapi.sys desinfizieren will.. Nunja.. seitdem geht es im Log so weiter:

[Scanpfad] c:\windows\system32\drivers\atapi.sys
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert
c:\windows\system32\drivers\atapi.sys infiziert mit BackDoor.Tdss.2213 - desinfiziert

u.s.w. u.s.w. u.s.w. ... Habe Dr. Web nach dem 1000. Desinfizierungsversuch gekillt, werde jetzt mal neustarten und dann nochmal scannen.

MfG

Flo

Edit:// So, nun gibts ein anderes Problem, der PC geht nichtmehr an. Erst hat ihm im drivers-Ordner irgend eine TMP-Datei gefehlt, Windows CD rein, reparieren und jetzt fehlt im diese atapi.sys .. Mal schauen ob ich ihn zumindest wieder zum hochfahren kriege.

Edit2:// Ich sehe grade.. man erkennt, dass ich ziemlich gerne Shooter spiele^^ Und bevor Kommentare dazu kommen.. Ich bekenne mich schuldig, ich habe ein Spiel von SkidRow installiert..

Edit3:// PC bootet wieder. Habe die infizierte Datei übern USB Stick und CMD von der Windows DVD mit der atapi.sys von meinem Laptop ersetzt. Mal schauen ob Dr. Web jetzt noch was findet.

Chris4You · 06.04.2010, 09:17

Hi,

TDSS-Rootkit (wie vermutet). Allerdings hätte CureIT es ohne Probleme entfernen sollen, dazu aber später mehr:

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Users\Flo\Desktop\ld4cdrly.exe

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:

ATTFilter

:OTL
[2010.04.05 10:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At11.job
[2010.04.05 09:06:03 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At10.job
[2010.04.04 23:06:04 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At24.job
[2010.04.04 22:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At23.job
[2010.04.04 22:01:23 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At19.job
[2010.04.04 21:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At22.job
[2010.04.04 20:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At21.job
[2010.04.04 19:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At20.job
[2010.04.04 17:53:48 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At17.job
[2010.04.04 17:06:01 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At18.job
[2010.04.04 14:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At15.job
[2010.04.04 13:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At14.job
[2010.04.04 12:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At13.job
[2010.04.04 11:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At12.job
[2010.04.04 01:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At2.job
[2010.04.04 00:06:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At1.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At9.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At8.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At7.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At6.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At5.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At4.job
[2010.03.31 15:03:55 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\At3.job
:Commands
[emptytemp]
[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Du musst JAVA updaten (stark veraltet), weiterhin nochmal MAM updaten und laufen lassen!

chris

Floxch · 06.04.2010, 15:05

Hey,

die Datei C:\Users\Flo\Desktop\ld4cdrly.exe gibt es nicht mehr, ich nehme allerdings an, dass es ein Trainer für ein Spiel war, die haben oft solche Namen, oder eins von den Tools zum scannen auf Rootkits wie GMER, die generieren beim Download ja zufällige Namen.

OTL Log:

All processes killed
========== OTL ==========
File C:\Windows\tasks\At11.job not found.
File C:\Windows\tasks\At10.job not found.
File C:\Windows\tasks\At24.job not found.
File C:\Windows\tasks\At23.job not found.
File C:\Windows\tasks\At19.job not found.
File C:\Windows\tasks\At22.job not found.
File C:\Windows\tasks\At21.job not found.
File C:\Windows\tasks\At20.job not found.
File C:\Windows\tasks\At17.job not found.
File C:\Windows\tasks\At18.job not found.
File C:\Windows\tasks\At15.job not found.
File C:\Windows\tasks\At14.job not found.
File C:\Windows\tasks\At13.job not found.
File C:\Windows\tasks\At12.job not found.
File C:\Windows\tasks\At2.job not found.
File C:\Windows\tasks\At1.job not found.
File C:\Windows\tasks\At9.job not found.
File C:\Windows\tasks\At8.job not found.
File C:\Windows\tasks\At7.job not found.
File C:\Windows\tasks\At6.job not found.
File C:\Windows\tasks\At5.job not found.
File C:\Windows\tasks\At4.job not found.
File C:\Windows\tasks\At3.job not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Flo
->Temp folder emptied: 364544 bytes
->Temporary Internet Files folder emptied: 360742 bytes
->Java cache emptied: 14067027 bytes
->FireFox cache emptied: 99389777 bytes
->Flash cache emptied: 1869 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1134592 bytes
%systemroot%\System32 .tmp files removed: 3229920 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3492 bytes
RecycleBin emptied: 1661282250 bytes

Total Files Cleaned = 1.697,00 mb

OTL by OldTimer - Version 3.2.1.0 log created on 04062010_160021

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Java upgedated, MAM läuft noch, CureIt!, GMER und ComboFix sagen der PC ist clean.

Chris4You · 06.04.2010, 16:11

Hi,

die Jobs hat dann wohl auch eines der Scannprogramme schon gelöscht, die dienten mit Sicherheit der "zeitgesteuerten" Reaktivierung, falls die Malware tatsächlich "ausgeknippst" wird...

Wenn die Scanner nichts mehr finden machen wir noch die Gegenprobe mit Kapi wie folgt:

TDSS-Killer
Download und Anweisung unter: http://www.trojaner-board.de/82358-tdsskiller-google-umleitungen-tdss-tdl3-alureon-rootkit-entfernen.html#post640150
Entpacke alle Dateien!

Start.bat erstellen:
Start->alle Programme->Zubehör->Editor und kopiere folgenden Text rein:

Code:

ATTFilter

@ECHO OFF
TDSSKiller.exe -l report.txt -v
DEL %0

Speichern als: start.bat

abspeichern unter : Dateityp: alle Dateien

speichere die Datei im Ordner wo auch TDSSKiller.exe steht

Doppelklick start.bat

TDSSKiller.exe wird gestartet und ein Log erzeugen(report.txt).
Wenn TDSSKiller fertig ist poste den Inhalt der report.txt.

Der liebe TDSS hat nämlich auch die Option, andere Treiber als atapi.sys (Festplattentreiber von Windows) zu verseuchen...

chris

Floxch · 06.04.2010, 17:35

Soo, hier noch das MAM-Log:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3960

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

06.04.2010 18:30:51
mbam-log-2010-04-06 (18-30-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 1265271
Laufzeit: 2 Stunde(n), 18 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

TDSS-Killer-Log:

18:32:22:520 1892 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
18:32:22:520 1892 ================================================================================
18:32:22:520 1892 SystemInfo:

18:32:22:520 1892 OS Version: 6.1.7600 ServicePack: 0.0
18:32:22:520 1892 Product type: Workstation
18:32:22:520 1892 ComputerName: BEATSTATION
18:32:22:520 1892 UserName: Flo
18:32:22:520 1892 Windows directory: C:\Windows
18:32:22:520 1892 Processor architecture: Intel x86
18:32:22:520 1892 Number of processors: 8
18:32:22:520 1892 Page size: 0x1000
18:32:22:520 1892 Boot type: Normal boot
18:32:22:520 1892 ================================================================================
18:32:22:520 1892 UnloadDriverW: NtUnloadDriver error 2
18:32:22:520 1892 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
18:32:23:650 1892 wfopen_ex: Trying to open file C:\Windows\system32\config\system
18:32:23:650 1892 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:32:23:650 1892 wfopen_ex: Trying to KLMD file open
18:32:23:650 1892 wfopen_ex: File opened ok (Flags 2)
18:32:23:670 1892 wfopen_ex: Trying to open file C:\Windows\system32\config\software
18:32:23:670 1892 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:32:23:670 1892 wfopen_ex: Trying to KLMD file open
18:32:23:670 1892 wfopen_ex: File opened ok (Flags 2)
18:32:23:690 1892 Initialize success
18:32:23:690 1892
18:32:23:690 1892 Scanning Services ...
18:32:24:760 1892 Raw services enum returned 477 services
18:32:24:770 1892
18:32:24:770 1892 Scanning Kernel memory ...
18:32:24:770 1892 Devices to scan: 3
18:32:24:770 1892
18:32:24:770 1892 Driver Name: USBSTOR
18:32:24:770 1892 IRP_MJ_CREATE : 86904500
18:32:24:770 1892 IRP_MJ_CREATE_NAMED_PIPE : 82EC0537
18:32:24:770 1892 IRP_MJ_CLOSE : 86904500
18:32:24:770 1892 IRP_MJ_READ : 86904500
18:32:24:770 1892 IRP_MJ_WRITE : 86904500
18:32:24:770 1892 IRP_MJ_QUERY_INFORMATION : 82EC0537
18:32:24:770 1892 IRP_MJ_SET_INFORMATION : 82EC0537
18:32:24:770 1892 IRP_MJ_QUERY_EA : 82EC0537
18:32:24:770 1892 IRP_MJ_SET_EA : 82EC0537
18:32:24:770 1892 IRP_MJ_FLUSH_BUFFERS : 82EC0537
18:32:24:770 1892 IRP_MJ_QUERY_VOLUME_INFORMATION : 82EC0537
18:32:24:770 1892 IRP_MJ_SET_VOLUME_INFORMATION : 82EC0537
18:32:24:770 1892 IRP_MJ_DIRECTORY_CONTROL : 82EC0537
18:32:24:770 1892 IRP_MJ_FILE_SYSTEM_CONTROL : 82EC0537
18:32:24:770 1892 IRP_MJ_DEVICE_CONTROL : 86904500
18:32:24:770 1892 IRP_MJ_INTERNAL_DEVICE_CONTROL : 86904500
18:32:24:770 1892 IRP_MJ_SHUTDOWN : 82EC0537
18:32:24:770 1892 IRP_MJ_LOCK_CONTROL : 82EC0537
18:32:24:770 1892 IRP_MJ_CLEANUP : 82EC0537
18:32:24:770 1892 IRP_MJ_CREATE_MAILSLOT : 82EC0537
18:32:24:770 1892 IRP_MJ_QUERY_SECURITY : 82EC0537
18:32:24:770 1892 IRP_MJ_SET_SECURITY : 82EC0537
18:32:24:770 1892 IRP_MJ_POWER : 86904500
18:32:24:770 1892 IRP_MJ_SYSTEM_CONTROL : 86904500
18:32:24:770 1892 IRP_MJ_DEVICE_CHANGE : 82EC0537
18:32:24:770 1892 IRP_MJ_QUERY_QUOTA : 82EC0537
18:32:24:770 1892 IRP_MJ_SET_QUOTA : 82EC0537
18:32:24:790 1892 C:\Windows\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
18:32:24:790 1892
18:32:24:790 1892 Driver Name: atapi
18:32:24:790 1892 IRP_MJ_CREATE : 857941F8
18:32:24:790 1892 IRP_MJ_CREATE_NAMED_PIPE : 82EC0537
18:32:24:790 1892 IRP_MJ_CLOSE : 857941F8
18:32:24:790 1892 IRP_MJ_READ : 82EC0537
18:32:24:790 1892 IRP_MJ_WRITE : 82EC0537
18:32:24:790 1892 IRP_MJ_QUERY_INFORMATION : 82EC0537
18:32:24:790 1892 IRP_MJ_SET_INFORMATION : 82EC0537
18:32:24:790 1892 IRP_MJ_QUERY_EA : 82EC0537
18:32:24:790 1892 IRP_MJ_SET_EA : 82EC0537
18:32:24:790 1892 IRP_MJ_FLUSH_BUFFERS : 82EC0537
18:32:24:790 1892 IRP_MJ_QUERY_VOLUME_INFORMATION : 82EC0537
18:32:24:790 1892 IRP_MJ_SET_VOLUME_INFORMATION : 82EC0537
18:32:24:790 1892 IRP_MJ_DIRECTORY_CONTROL : 82EC0537
18:32:24:790 1892 IRP_MJ_FILE_SYSTEM_CONTROL : 82EC0537
18:32:24:790 1892 IRP_MJ_DEVICE_CONTROL : 857941F8
18:32:24:790 1892 IRP_MJ_INTERNAL_DEVICE_CONTROL : 857941F8
18:32:24:790 1892 IRP_MJ_SHUTDOWN : 82EC0537
18:32:24:790 1892 IRP_MJ_LOCK_CONTROL : 82EC0537
18:32:24:790 1892 IRP_MJ_CLEANUP : 82EC0537
18:32:24:790 1892 IRP_MJ_CREATE_MAILSLOT : 82EC0537
18:32:24:790 1892 IRP_MJ_QUERY_SECURITY : 82EC0537
18:32:24:790 1892 IRP_MJ_SET_SECURITY : 82EC0537
18:32:24:790 1892 IRP_MJ_POWER : 857941F8
18:32:24:790 1892 IRP_MJ_SYSTEM_CONTROL : 857941F8
18:32:24:790 1892 IRP_MJ_DEVICE_CHANGE : 82EC0537
18:32:24:790 1892 IRP_MJ_QUERY_QUOTA : 82EC0537
18:32:24:790 1892 IRP_MJ_SET_QUOTA : 82EC0537
18:32:24:810 1892 C:\Windows\system32\DRIVERS\atapi.sys - Verdict: 1
18:32:24:810 1892
18:32:24:810 1892 Driver Name: atapi
18:32:24:810 1892 IRP_MJ_CREATE : 857941F8
18:32:24:810 1892 IRP_MJ_CREATE_NAMED_PIPE : 82EC0537
18:32:24:810 1892 IRP_MJ_CLOSE : 857941F8
18:32:24:810 1892 IRP_MJ_READ : 82EC0537
18:32:24:810 1892 IRP_MJ_WRITE : 82EC0537
18:32:24:810 1892 IRP_MJ_QUERY_INFORMATION : 82EC0537
18:32:24:810 1892 IRP_MJ_SET_INFORMATION : 82EC0537
18:32:24:810 1892 IRP_MJ_QUERY_EA : 82EC0537
18:32:24:810 1892 IRP_MJ_SET_EA : 82EC0537
18:32:24:810 1892 IRP_MJ_FLUSH_BUFFERS : 82EC0537
18:32:24:810 1892 IRP_MJ_QUERY_VOLUME_INFORMATION : 82EC0537
18:32:24:810 1892 IRP_MJ_SET_VOLUME_INFORMATION : 82EC0537
18:32:24:810 1892 IRP_MJ_DIRECTORY_CONTROL : 82EC0537
18:32:24:810 1892 IRP_MJ_FILE_SYSTEM_CONTROL : 82EC0537
18:32:24:810 1892 IRP_MJ_DEVICE_CONTROL : 857941F8
18:32:24:810 1892 IRP_MJ_INTERNAL_DEVICE_CONTROL : 857941F8
18:32:24:810 1892 IRP_MJ_SHUTDOWN : 82EC0537
18:32:24:810 1892 IRP_MJ_LOCK_CONTROL : 82EC0537
18:32:24:810 1892 IRP_MJ_CLEANUP : 82EC0537
18:32:24:810 1892 IRP_MJ_CREATE_MAILSLOT : 82EC0537
18:32:24:810 1892 IRP_MJ_QUERY_SECURITY : 82EC0537
18:32:24:810 1892 IRP_MJ_SET_SECURITY : 82EC0537
18:32:24:810 1892 IRP_MJ_POWER : 857941F8
18:32:24:810 1892 IRP_MJ_SYSTEM_CONTROL : 857941F8
18:32:24:810 1892 IRP_MJ_DEVICE_CHANGE : 82EC0537
18:32:24:810 1892 IRP_MJ_QUERY_QUOTA : 82EC0537
18:32:24:810 1892 IRP_MJ_SET_QUOTA : 82EC0537
18:32:24:810 1892 C:\Windows\system32\DRIVERS\atapi.sys - Verdict: 1
18:32:24:810 1892
18:32:24:810 1892 Completed
18:32:24:810 1892
18:32:24:810 1892 Results:
18:32:24:810 1892 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
18:32:24:810 1892 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
18:32:24:810 1892 File objects infected / cured / cured on reboot: 0 / 0 / 0
18:32:24:810 1892
18:32:24:810 1892 fclose_ex: Trying to close file C:\Windows\system32\config\system
18:32:24:810 1892 fclose_ex: Trying to close file C:\Windows\system32\config\software
18:32:24:810 1892 KLMD(ARK) unloaded successfully

Ich nehme also an ich bin wieder clean^^ Btw noch irgendeinen Tipp für eine Antiviren-Suite, damit so etwas nicht nochmal passiert? Habe KIS 2010 und auch immer angeschaltet und Einstellungen auf höchstmögliche Sicherheit, auch die heuristische Suche, dank i7 habe ich dadurch keine Einschränkungen, schade, dass so etwas trotzdem durchkommt..

Vielen Dank für die Hilfe!!

Mfg Flo

Chris4You · 07.04.2010, 06:44

Hi,

KIS ist eigentlich Ok (hab ich auch auf einem Rechner), auf einem anderen läuft dann Avira-free und Threadfire...

Zum Surfen einen Guest-Account mit eingeschränkten Rechten erstellen (dann kann keine SW/Treiber installiert werden, ausser die Malware verschafft sich durch Sicherheitslücken die entsprechende Rechte), FF nehmen mit den Plug-Ins "NoScript", "WOT"... Oder Du nutzt gleich die virtuelle Umgebung von Kaspersky zum surfen...

chris

Floxch · 07.04.2010, 10:00

Hey,

vielen Dank für die Tipps, auf die Idee mti der virtuellen Umgebung bin ich noch nicht gekommen^^ So werde ichs dann wohl machen ;-)

MfG

Flo

Firefox öffnet selbstständig Tabs - Kein Programm findet etwas

Plagegeister aller Art und deren Bekämpfung: Firefox öffnet selbstständig Tabs - Kein Programm findet etwas