| |
| |||||||
Log-Analyse und Auswertung: Antimalware Doctor Trojaner vollständig entfernt?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.04.2010, 23:04
| #1 |
| |  Antimalware Doctor Trojaner vollständig entfernt? Hi Leute, ich hab leider nich so viel Ahnung aber den gleichen Virus hier drauf gehabt (http://www.trojaner-board.de/85480-a...-entfernt.html) !! Vielleicht könnt ihr ja auch bei mir mal drübergucken :] Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:04:07, on 30.4.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Creative\Shared Files\CTAudSvc.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\DAEMON Tools Lite\DTLite.exe C:\Programme\Logitech\SetPoint\SetPoint.exe C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE C:\Programme\Analog Devices\SoundMAX\spkrmon.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\Ati2evxx.exe F:\mIRC\mirc.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\explorer.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Malwarebytes' Anti-Malware\mbam.exe c:\programme\avira\antivir desktop\avcenter.exe C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Downloads\HiJackThis.exe O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "F:\Programme\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [gotnewupdate000.exe] C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\435163068CAED22EF215A0C8EEB9F9DE\gotnewupdate000.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-21-1275210071-308236825-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'nich admin') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Programme\Gemeinsame Dateien\Creative Labs Shared\Service\CTAELicensing.exe O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Programme\Creative\Shared Files\CTAudSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe O23 - Service: spkrmon - Unknown owner - C:\Programme\Analog Devices\SoundMAX\spkrmon.exe -- End of file - 5471 bytes |
|
30.04.2010, 14:58
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Antimalware Doctor Trojaner vollständig entfernt? Hallo und
__________________ bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
02.05.2010, 23:46
| #3 |
| | Antimalware Doctor Trojaner vollständig entfernt? Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|H:\|I:\|K:\|)
__________________Durchsuchte Objekte: 210508 Laufzeit: 55 Minute(n), 3 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\System Volume Information\_restore{9DECF3F0-FD73-404C-B544-A1EDB9364C3B}\RP109\A0020109.dll (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. |
|
02.05.2010, 23:51
| #4 |
| | Antimalware Doctor Trojaner vollständig entfernt? OTL logfile created on: 3.5.2010 00:47:04 - Run 1 OTL by OldTimer - Version 3.2.4.0 Folder = C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy 1.023,00 Mb Total Physical Memory | 413,00 Mb Available Physical Memory | 40,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 72,00% Paging File free Paging file location(s): c:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 31,49 Gb Total Space | 8,98 Gb Free Space | 28,51% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: | 154,82 Gb Total Space | 6,10 Gb Free Space | 3,94% Space Free | Partition Type: NTFS Drive G: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF H: Drive not present or media not loaded Drive I: | 7,39 Gb Total Space | 1,46 Gb Free Space | 19,76% Space Free | Partition Type: FAT32 Drive K: | 298,02 Gb Total Space | 258,15 Gb Free Space | 86,62% Space Free | Partition Type: FAT32 Computer Name: DESKTOP-PC Current User Name: Fab Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) PRC - F:\Programme\Steam\Steam.exe (Valve Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\MediaMonkey\MediaMonkey.exe (Ventis Media Inc.) PRC - C:\Programme\QIP\qip.exe (The Author of QIP) PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.) PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd) PRC - C:\Programme\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) PRC - F:\mIRC\mirc.exe (mIRC Co. Ltd.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation) PRC - C:\Programme\Analog Devices\SoundMAX\spkrmon.exe () ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Programme\MediaMonkey\MMHelper.dll () MOD - C:\Programme\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.) MOD - C:\Programme\Logitech\SetPoint\GameHook.dll (Logitech, Inc.) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\ctagent.dll (Creative Technology Ltd) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Creative Audio Engine Licensing Service) -- C:\Programme\Gemeinsame Dateien\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs) SRV - (LBTServ) -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (CTAudSvcService) -- C:\Programme\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies) SRV - (SimpTcp) -- C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation) SRV - (spkrmon) -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe () ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys () DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (hap17v2k) -- C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd) DRV - (hap16v2k) -- C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd) DRV - (ha10kx2k) -- C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd) DRV - (emupia) -- C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd) DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV - (ctprxy2k) -- C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd) DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV - (ctdvda2k) -- C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd) DRV - (ctaud2k) Creative Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd) DRV - (ctac32k) -- C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd) DRV - (CTERFXFX.SYS) -- C:\WINDOWS\System32\drivers\CTERFXFX.SYS (Creative Technology Ltd) DRV - (CTERFXFX) -- C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd) DRV - (CTSBLFX.SYS) -- C:\WINDOWS\System32\drivers\CTSBLFX.SYS (Creative Technology Ltd) DRV - (CTSBLFX) -- C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd) DRV - (CTAUDFX.SYS) -- C:\WINDOWS\System32\drivers\CTAUDFX.SYS (Creative Technology Ltd) DRV - (CTAUDFX) -- C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd) DRV - (COMMONFX.SYS) -- C:\WINDOWS\System32\drivers\COMMONFX.SYS (Creative Technology Ltd) DRV - (COMMONFX) -- C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd) DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.) DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.) DRV - (L8042Kbd) -- C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation) DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation) DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies) DRV - (OMCI) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.6.6 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.28 17:13:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.29 23:38:24 | 000,000,000 | ---D | M] [2010.01.07 15:03:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Mozilla\Extensions [2010.01.07 15:03:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Mozilla\Extensions\songbird@songbirdnest.com [2010.05.02 23:26:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Mozilla\Firefox\Profiles\9dg7tut5.default\extensions [2010.03.18 13:20:08 | 000,000,000 | ---D | M] (Modify Headers) -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Mozilla\Firefox\Profiles\9dg7tut5.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe} [2010.01.08 04:16:41 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Mozilla\Firefox\Profiles\9dg7tut5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.05.02 23:26:06 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.04.29 23:38:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll [2010.04.12 20:44:41 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.04.12 20:44:41 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.04.12 20:44:41 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.04.12 20:44:41 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.04.12 20:44:41 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2003.07.21 22:56:04 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [gotnewupdate000.exe] C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\435163068CAED22EF215A0C8EEB9F9DE\gotnewupdate000.exe File not found O4 - HKCU..\Run: [Steam] F:\Programme\Steam\Steam.exe (Valve Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\Fab\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Dokumente und Einstellungen\Fab\Startmenü\Programme\Autostart\Xfire.lnk = C:\Programme\Xfire\Xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Fab\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Fab\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.12.22 21:29:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008.10.21 19:23:01 | 000,094,208 | R--- | M] (Obsidian Entertainment, Inc.) - G:\autorun.exe -- [ UDF ] O32 - AutoRun File - [2008.10.21 19:14:30 | 000,000,441 | R--- | M] () - G:\autorun.inf -- [ UDF ] O32 - AutoRun File - [2008.05.30 09:31:56 | 000,000,054 | -H-- | M] () - K:\autorun.inf -- [ FAT32 ] O32 - AutoRun File - [2008.07.22 14:51:26 | 000,000,000 | ---D | M] - K:\autorun -- [ FAT32 ] O33 - MountPoints2\{44071c51-ef37-11de-8dda-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{44071c51-ef37-11de-8dda-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{44071c51-ef37-11de-8dda-806d6172696f}\Shell\AutoRun\command - "" = G:\autorun.exe -- [2008.10.21 19:23:01 | 000,094,208 | R--- | M] (Obsidian Entertainment, Inc.) O33 - MountPoints2\{44071c51-ef37-11de-8dda-806d6172696f}\Shell\install\command - "" = G:\setup.exe -- [2004.07.16 02:09:36 | 000,117,200 | R--- | M] (InstallShield Software Corporation) O33 - MountPoints2\{44071c53-ef37-11de-8dda-806d6172696f}\Shell\AutoRun\command - "" = K:\WDSetup.exe -- [2008.07.08 11:53:30 | 001,760,039 | ---- | M] (Western Digital Corporation ) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.29 23:40:32 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Fab\Recent [2010.04.29 23:39:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun [2010.04.29 23:38:57 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2010.04.29 23:38:24 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010.04.29 23:38:24 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010.04.29 23:38:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010.04.29 23:38:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010.04.29 23:20:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2010.04.28 20:09:36 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010.04.28 17:18:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Malwarebytes [2010.04.28 17:17:28 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.04.28 17:17:21 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.04.28 17:17:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.04.28 17:17:20 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.04.22 15:31:10 | 000,094,208 | ---- | C] (Blizzard Entertainment) -- C:\WINDOWS\DIIUnin.exe [2010.04.21 22:11:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Warsow [2010.04.20 22:07:17 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe [2010.04.19 22:42:50 | 000,000,000 | ---D | C] -- C:\Programme\Backgammon-v0.3.2 [2010.04.16 03:00:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\Avira [2010.04.16 02:54:54 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys [2010.04.16 02:54:52 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2010.04.16 02:54:52 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010.04.16 02:54:52 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys [2010.04.16 02:54:52 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys [2010.04.16 02:54:51 | 000,000,000 | ---D | C] -- C:\Programme\Avira [2010.04.16 02:54:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira [2010.04.14 18:23:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Fab\Desktop\uni [2010.04.13 20:11:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Microsys [2010.04.13 20:11:23 | 000,000,000 | ---D | C] -- C:\Programme\Backgammon Classic 6 [2009.06.23 12:49:14 | 000,010,752 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll [9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.05.03 00:06:36 | 000,052,736 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.05.02 23:13:13 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.05.02 23:13:11 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.05.02 23:13:09 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.04.30 16:10:38 | 000,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll [2010.04.30 16:10:38 | 000,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll [2010.04.30 16:10:38 | 000,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll [2010.04.29 23:30:25 | 000,033,232 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000002-00001102-00000004-20021102}.rfx [2010.04.29 23:30:25 | 000,033,232 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000002-00000000-00000002-00001102-00000004-20021102}.rfx [2010.04.29 23:30:25 | 000,032,448 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000002-00001102-00000004-20021102}.rfx [2010.04.29 23:30:25 | 000,032,448 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000002-00001102-00000004-20021102}.rfx [2010.04.29 23:30:25 | 000,011,564 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000004-20021102}.rfx [2010.04.29 23:30:17 | 002,621,440 | -H-- | M] () -- C:\Dokumente und Einstellungen\Fab\NTUSER.DAT [2010.04.29 23:30:17 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Fab\ntuser.ini [2010.04.28 20:09:38 | 000,001,512 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Desktop\CCleaner.lnk [2010.04.28 17:17:33 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.27 17:55:46 | 000,000,475 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Warhammer Online - Age of Reckoning.lnk [2010.04.27 10:32:07 | 000,271,179 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Desktop\L111(2).pdf [2010.04.22 21:20:24 | 000,000,534 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Desktop\Diablo II - Lord of Destruction.lnk [2010.04.22 15:34:06 | 000,025,917 | ---- | M] () -- C:\WINDOWS\DIIUnin.dat [2010.04.22 15:31:12 | 000,000,528 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Diablo II.lnk [2010.04.22 15:31:10 | 000,094,208 | ---- | M] (Blizzard Entertainment) -- C:\WINDOWS\DIIUnin.exe [2010.04.22 15:31:10 | 000,002,829 | ---- | M] () -- C:\WINDOWS\DIIUnin.pif [2010.04.20 11:02:45 | 000,063,873 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Desktop\image00048.jpg [2010.04.19 19:14:07 | 000,042,802 | ---- | M] () -- C:\Dokumente und Einstellungen\Fab\Desktop\1-4189c2ae012218d99711d7887ec8a0b5.jpg [2010.04.16 15:26:41 | 000,000,128 | -H-- | M] () -- C:\Dokumente und Einstellungen\Fab\microsoft.dat [2010.04.16 02:55:07 | 000,001,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk [2010.04.12 17:29:27 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010.04.12 17:29:26 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010.04.12 17:29:25 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010.04.12 15:19:02 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.04.28 20:09:38 | 000,001,512 | ---- | C] () -- C:\Dokumente und Einstellungen\Fab\Desktop\CCleaner.lnk [2010.04.28 17:17:33 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.27 17:55:46 | 000,000,475 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Warhammer Online - Age of Reckoning.lnk [2010.04.27 10:32:06 | 000,271,179 | ---- | C] () -- C:\Dokumente und Einstellungen\Fab\Desktop\L111(2).pdf [2010.04.22 15:34:19 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2010.04.22 15:34:19 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2010.04.22 15:34:19 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2010.04.22 15:34:06 | 000,000,534 | ---- | C] () -- C:\Dokumente und Einstellungen\Fab\Desktop\Diablo II - Lord of Destruction.lnk [2010.04.22 15:31:12 | 000,025,917 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat [2010.04.22 15:31:12 | 000,000,528 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Diablo II.lnk [2010.04.22 15:31:10 | 000,002,829 | ---- | C] () -- C:\WINDOWS\DIIUnin.pif [2010.04.20 11:02:45 | 000,063,873 | ---- | C] () -- C:\Dokumente und Einstellungen\Fab\Desktop\image00048.jpg [2010.04.19 19:14:07 | 000,042,802 | ---- | C] () -- C:\Dokumente und Einstellungen\Fab\Desktop\1-4189c2ae012218d99711d7887ec8a0b5.jpg [2010.04.16 02:55:07 | 000,001,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk [2010.04.13 20:11:29 | 000,000,128 | -H-- | C] () -- C:\Dokumente und Einstellungen\Fab\microsoft.dat [2010.01.10 17:44:17 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2010.01.07 19:24:46 | 000,000,283 | ---- | C] () -- C:\WINDOWS\game.ini [2010.01.07 19:14:30 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009.12.22 22:34:48 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll [2009.06.23 13:29:50 | 000,049,719 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini [2009.06.23 13:29:48 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2009.06.23 12:51:00 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CTBurst.dll [2007.08.13 21:45:02 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\ctmmactl.dll [2006.10.02 18:25:18 | 000,000,307 | ---- | C] () -- C:\WINDOWS\System32\kill.ini [2005.08.02 23:24:01 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll < End of report > OTL Extras logfile created on: 3.5.2010 00:47:04 - Run 1 OTL by OldTimer - Version 3.2.4.0 Folder = C:\Dokumente und Einstellungen\Fab\Eigene Dateien\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy 1.023,00 Mb Total Physical Memory | 413,00 Mb Available Physical Memory | 40,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 72,00% Paging File free Paging file location(s): c:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 31,49 Gb Total Space | 8,98 Gb Free Space | 28,51% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: | 154,82 Gb Total Space | 6,10 Gb Free Space | 3,94% Space Free | Partition Type: NTFS Drive G: | 5,75 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF H: Drive not present or media not loaded Drive I: | 7,39 Gb Total Space | 1,46 Gb Free Space | 19,76% Space Free | Partition Type: FAT32 Drive K: | 298,02 Gb Total Space | 258,15 Gb Free Space | 86,62% Space Free | Partition Type: FAT32 Computer Name: DESKTOP-PC Current User Name: Fab Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [MediaMonkey.1Play] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.) Directory [MediaMonkey.2PlayNext] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.) Directory [MediaMonkey.3Enqueue] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.) Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "AntiVirusDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "8394:TCP" = 8394:TCP:*:Enabled:League of Legends Launcher "8394:UDP" = 8394:UDP:*:Enabled:League of Legends Launcher "6968:TCP" = 6968:TCP:*:Enabled:League of Legends Launcher "6968:UDP" = 6968:UDP:*:Enabled:League of Legends Launcher "6896:TCP" = 6896:TCP:*:Enabled:League of Legends Launcher "6896:UDP" = 6896:UDP:*:Enabled:League of Legends Launcher "6889:TCP" = 6889:TCP:*:Enabled:League of Legends Launcher "6889:UDP" = 6889:UDP:*:Enabled:League of Legends Launcher ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "F:\mIRC\mirc.exe" = F:\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.) "E:\Programme\mIRC\mirc.exe" = E:\Programme\mIRC\mirc.exe:*:Enabled:mIRC -- File not found "C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\NoNameScript\nnrepair.exe" = C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\NoNameScript\nnrepair.exe:*:Enabled:Repair NoNameScript -- (ESNation) "F:\Programme\Steam\Steam.exe" = F:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation) "F:\Programme\uTorrent\uTorrent.exe" = F:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.) "F:\Warcraft III\war3.exe" = F:\Warcraft III\war3.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment) "C:\Programme\QIP\qip.exe" = C:\Programme\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP) "F:\Programme\League of Legends\Air\LolClient.exe" = F:\Programme\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby -- () "F:\Programme\League of Legends\Game\League of Legends.exe" = F:\Programme\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client -- () "F:\Warcraft III\Warcraft III.exe" = F:\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment) "E:\Neverwinter Nights 2\nwn2main.exe" = E:\Neverwinter Nights 2\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main -- File not found "E:\Neverwinter Nights 2\nwn2main_amdxp.exe" = E:\Neverwinter Nights 2\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD -- File not found "E:\Neverwinter Nights 2\nwupdate.exe" = E:\Neverwinter Nights 2\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater -- File not found "E:\Neverwinter Nights 2\nwn2server.exe" = E:\Neverwinter Nights 2\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server -- File not found "F:\Programme\Warsow\warsow_x86.exe" = F:\Programme\Warsow\warsow_x86.exe:*:Enabled:Warsow -- (Chasseur de bots) "F:\Programme\Steam\steamapps\manoman600\counter-strike\hl.exe" = F:\Programme\Steam\steamapps\manoman600\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{06053AB3-B607-B752-3252-4A2EA9E9761E}" = CCC Help Dutch "{0B4A8658-43F1-50CA-AF30-C67E3AE2C9ED}" = CCC Help Greek "{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer "{0CC61470-D776-2353-D5CB-C7BC20204863}" = CCC Help Finnish "{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox "{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center "{12655AB3-9285-A2F0-5BBC-C5C45E4D718C}" = CCC Help Czech "{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu "{167F938F-5AD3-40e2-B05D-2B7C6F0FDE48}" = HP Deskjet D1500 Printer Driver 10.0 Rel .3 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding "{20F1FFAF-1BFF-450C-A8C7-03D1BE24B950}" = Microsoft .NET Framework (German) "{24700C01-3A72-29D4-001B-6EE6BF71EB5E}" = CCC Help Korean "{26262388-95BF-58B0-CD46-A8F957BB67BF}" = Catalyst Control Center Graphics Full Existing "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 20 "{305468A6-DE2D-43ba-A168-2F45A97A89DA}" = DJ_SF_03_D1500_Software_Min "{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper "{329376FB-FB6C-C587-F483-07E3418456F5}" = ccc-utility "{33A38A8B-9E1E-BCBB-EA87-CE797EC75080}" = CCC Help Chinese Traditional "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{369EEB32-64D1-F22A-1B2C-A3E81582E767}" = CCC Help Japanese "{3FCD8F30-057D-C96F-AEF4-B0D77DE9730C}" = CCC Help Portuguese "{46605BDE-7F82-DB0F-7906-3279A7E639BE}" = Catalyst Control Center Localization All "{480A8E00-D808-7D79-977B-CEBBB3BEB409}" = CCC Help French "{48C7FD10-D6AD-8EE0-2E8E-0480C4EEB1BD}" = Catalyst Control Center HydraVision Full "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5CA7ABC3-5F89-3A1D-A113-046EA4C7FCEB}" = ccc-core-static "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5 "{6F77AD48-BA04-F868-2D04-FC1BFF5E00BA}" = Catalyst Control Center Graphics Light "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{788907C5-C83B-9785-A1F0-67050017324E}" = CCC Help Spanish "{7F5F1767-88C6-CBFC-5DD3-D853343FD5AE}" = CCC Help German "{84DE3702-3262-BE38-27E8-5ED423D803C6}" = CCC Help Chinese Standard "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2007 "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU "{95053B5A-42E0-830E-85BD-733FAFC28BA7}" = ccc-core-preinstall "{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1 "{9B40D533-4F38-893D-EE5A-17226104BBC2}" = Skins "{A08CB73B-5DEA-185D-5D98-2230004D75ED}" = CCC Help Danish "{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU "{A22D91C3-E7BD-CBEE-7CDC-DE4C42FA27B7}" = CCC Help Hungarian "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT "{AD0DD974-ADC2-8C10-DFA6-C1203A6E5106}" = CCC Help Polish "{B014F739-B305-5319-D996-6612BD60ED74}" = CCC Help Swedish "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C570CAF4-D734-5412-C842-9AB150803074}" = Catalyst Control Center Core Implementation "{C615B4A6-DDE8-4325-BCF8-E53E913D95E9}_is1" = AMR to MP3 Converter 1.4 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D01F5B2C-2776-6C46-441C-E819C08DF4FF}" = CCC Help Turkish "{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2 "{D2FCA53F-F568-D08A-458F-F7C9769A30ED}" = CCC Help Norwegian "{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD "{D89B70AB-CF91-36A4-8658-FACA3AF6A654}" = Catalyst Control Center Graphics Previews Common "{DF1274DC-02D4-B2D7-6197-5D24E1EF84B1}" = CCC Help Thai "{E000D42E-5842-20A6-EEB1-6DED8C2746C5}" = CCC Help Italian "{E7679B31-21F5-4AAE-1620-0DFACF702325}" = Catalyst Control Center Graphics Full New "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F1CBC6F7-D82D-4DC5-B81C-9A14F418593A}_is1" = WC3Banlist "{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2 "{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint "{F83491F9-7CDF-46A7-9994-9E002CE5CE75}" = CCC Help Russian "{FDE409B1-1FF3-DC39-083E-C0F4ED496D5E}" = CCC Help English "7-Zip" = 7-Zip 4.65 "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software "Arasan_is1" = Arasan 11.7a "ATI Display Driver" = ATI Display Driver "AudioCS" = Creative-Audiokonsole "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Backgammon_v0.3.2" = Backgammon-v0.3.2 "CCleaner" = CCleaner "Creative Software AutoUpdate" = Creative Software AutoUpdate "Diablo II" = Diablo II "Exifer_is1" = Exifer "FileZilla Client" = FileZilla Client 3.3.1 "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2 "Free YouTube Download_is1" = Free YouTube Download 2.3 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2 "HijackThis" = HijackThis 2.0.2 "InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2 "League of Legends_is1" = League of Legends "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "MediaMonkey_is1" = MediaMonkey 3.2 "Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework Full v1.0.3705 (1031)" = Microsoft .NET Framework (German) v1.0.3705 "mIRC" = mIRC "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "PROSet" = Intel(R) PRO Network Adapters and Drivers "Steam App 10" = Counter-Strike "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "Uninstall_is1" = Uninstall 1.0.0.1 "uTorrent" = µTorrent "VLC media player" = VLC media player 1.0.3 "Warhammer Online - Age of Reckoning_is1" = Warhammer Online - Age of Reckoning "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 "WinPcapInst" = WinPcap 3.1 "WORD" = Microsoft Office Word 2007 "Xfire" = Xfire (remove only) "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "NoNameScript" = NNScript "QIP 2005" = QIP 2005 8095 "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 16.3.2010 19:37:34 | Computer Name = DESKTOP-PC | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung nwn2main.exe, Version 1.0.23.1765, fehlgeschlagenes Modul nwn2main.exe, Version 1.0.23.1765, Fehleradresse 0x000901b4. Error - 16.3.2010 19:38:13 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung nwn2main.exe, Version 1.0.23.1765, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 19.3.2010 20:18:58 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung vlc.exe, Version 1.0.3.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 23.3.2010 14:41:07 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung qip.exe, Version 8.0.9.5, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 1.4.2010 17:22:28 | Computer Name = DESKTOP-PC | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung nwn2main.exe, Version 1.0.23.1765, fehlgeschlagenes Modul nwn2main.exe, Version 1.0.23.1765, Fehleradresse 0x000901b4. Error - 12.4.2010 14:42:38 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung hl.exe, Version 1.1.1.1, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 16.4.2010 06:19:08 | Computer Name = DESKTOP-PC | Source = VSS | ID = 5013 Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager" aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070015" (konvertiert in 0x800423f3) fehlgeschlagen. Error - 19.4.2010 19:16:34 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung vlc.exe, Version 1.0.3.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 21.4.2010 04:56:07 | Computer Name = DESKTOP-PC | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung MediaMonkey.exe, Version 3.2.0.1294, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. Error - 29.4.2010 17:21:26 | Computer Name = DESKTOP-PC | Source = Application Error | ID = 1000 Description = Fehlgeschlagene Anwendung gotnewupdate000.exe, Version 0.1.0.0, fehlgeschlagenes Modul kernel32.dll, Version 5.1.2600.5781, Fehleradresse 0x00012afb. [ System Events ] Error - 4.3.2010 13:59:16 | Computer Name = DESKTOP-PC | Source = Service Control Manager | ID = 7034 Description = Dienst "Einfache TCP/IP-Dienste" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error - 4.3.2010 13:59:19 | Computer Name = DESKTOP-PC | Source = Service Control Manager | ID = 7034 Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error - 8.3.2010 13:24:06 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "JLMS DVD-ROM XJ-HD166" (IDE\CdRomJLMS_DVD-ROM_XJ-HD166___________________DD05____\5&3a22a7d4&0&0.0.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 8.3.2010 13:24:06 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "SAMSUNG CD-R/RW SW-252S" (IDE\CdRomSAMSUNG_CD-R/RW_SW-252S_________________R901____\5&3a22a7d4&0&0.1.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 10.3.2010 11:44:52 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "JLMS DVD-ROM XJ-HD166" (IDE\CdRomJLMS_DVD-ROM_XJ-HD166___________________DD05____\5&3a22a7d4&0&0.0.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 10.3.2010 11:44:52 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "SAMSUNG CD-R/RW SW-252S" (IDE\CdRomSAMSUNG_CD-R/RW_SW-252S_________________R901____\5&3a22a7d4&0&0.1.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 17.3.2010 20:26:48 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "JLMS DVD-ROM XJ-HD166" (IDE\CdRomJLMS_DVD-ROM_XJ-HD166___________________DD05____\5&3a22a7d4&0&0.0.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 17.3.2010 20:26:48 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "SAMSUNG CD-R/RW SW-252S" (IDE\CdRomSAMSUNG_CD-R/RW_SW-252S_________________R901____\5&3a22a7d4&0&0.1.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 30.3.2010 20:03:33 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "JLMS DVD-ROM XJ-HD166" (IDE\CdRomJLMS_DVD-ROM_XJ-HD166___________________DD05____\5&3a22a7d4&0&0.0.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. Error - 30.3.2010 20:03:33 | Computer Name = DESKTOP-PC | Source = PlugPlayManager | ID = 12 Description = Das Gerät "SAMSUNG CD-R/RW SW-252S" (IDE\CdRomSAMSUNG_CD-R/RW_SW-252S_________________R901____\5&3a22a7d4&0&0.1.0) wurde ohne vorbereitende Maßnahmen vom System entfernt. < End of report > Vielen Dank schonmal!!!  |
|
03.05.2010, 11:33
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor Trojaner vollständig entfernt? Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O4 - HKCU..\Run: [gotnewupdate000.exe] C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\435163068CAED22EF215A0C8EEB9F9DE\gotnewupdate000.exe File not found
O32 - AutoRun File - [2008.10.21 19:14:30 | 000,000,441 | R--- | M] () - G:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2008.05.30 09:31:56 | 000,000,054 | -H-- | M] () - K:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2008.07.22 14:51:26 | 000,000,000 | ---D | M] - K:\autorun -- [ FAT32 ]
:Files
C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\435163068CAED22EF215A0C8EEB9F9DE
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.05.2010, 11:49
| #6 |
| | Antimalware Doctor Trojaner vollständig entfernt? All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\gotnewupdate000.exe deleted successfully. File G:\autorun.inf not found. File move failed. K:\autorun.inf scheduled to be moved on reboot. File not found. ========== FILES ========== File\Folder C:\Dokumente und Einstellungen\Fab\Anwendungsdaten\435163068CAED22EF215A0C8EEB9F9DE not found. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41620 bytes User: Fab ->Temp folder emptied: 921410396 bytes ->Temporary Internet Files folder emptied: 406564 bytes ->Java cache emptied: 5424 bytes ->FireFox cache emptied: 85516931 bytes ->Flash cache emptied: 50143 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: nich admin ->Temp folder emptied: 222 bytes ->Temporary Internet Files folder emptied: 54354 bytes ->Flash cache emptied: 41620 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 3064129 bytes %systemroot%\System32 .tmp files removed: 2951 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 44683291 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1.007,00 mb OTL by OldTimer - Version 3.2.4.0 log created on 05032010_124522 Files\Folders moved on Reboot... K:\autorun.inf moved successfully. Registry entries deleted on Reboot... ---------- Danke sehr, ich nehme mal an, jetzt bin ich fertig? =) |
|
03.05.2010, 12:44
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor Trojaner vollständig entfernt? ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.05.2010, 15:11
| #8 |
| | Antimalware Doctor Trojaner vollständig entfernt? ComboFix 10-05-02.03 - Fab 03.05.2010 16:04:00.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1023.686 [GMT 2:00] ausgeführt von:: c:\dokumente und einstellungen\Fab\Desktop\cofi.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\dokumente und einstellungen\Fab\Anwendungsdaten\chrtmp . ((((((((((((((((((((((( Dateien erstellt von 2010-04-03 bis 2010-05-03 )))))))))))))))))))))))))))))) . 2010-05-03 10:45 . 2010-05-03 10:45 -------- d-----w- C:\_OTL 2010-04-29 21:38 . 2010-04-29 21:38 -------- d-----w- c:\programme\Gemeinsame Dateien\Java 2010-04-29 21:38 . 2010-04-29 21:38 503808 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-287782fa-n\msvcp71.dll 2010-04-29 21:38 . 2010-04-29 21:38 499712 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-287782fa-n\jmc.dll 2010-04-29 21:38 . 2010-04-29 21:38 348160 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-287782fa-n\msvcr71.dll 2010-04-29 21:38 . 2010-04-29 21:38 61440 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a382969-n\decora-sse.dll 2010-04-29 21:38 . 2010-04-29 21:38 12800 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a382969-n\decora-d3d.dll 2010-04-29 21:38 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-04-28 18:09 . 2010-04-28 18:09 -------- d-----w- c:\programme\CCleaner 2010-04-28 15:18 . 2010-04-28 15:18 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Malwarebytes 2010-04-28 15:17 . 2010-03-29 13:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-28 15:17 . 2010-04-28 15:17 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes 2010-04-28 15:17 . 2010-03-29 13:24 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-28 15:17 . 2010-04-28 15:17 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware 2010-04-22 13:34 . 2010-04-30 14:10 21840 ----atw- c:\windows\system32\SIntfNT.dll 2010-04-22 13:34 . 2010-04-30 14:10 17212 ----atw- c:\windows\system32\SIntf32.dll 2010-04-22 13:34 . 2010-04-30 14:10 12067 ----atw- c:\windows\system32\SIntf16.dll 2010-04-22 13:31 . 2010-04-22 13:34 25917 ----a-w- c:\windows\DIIUnin.dat 2010-04-22 13:31 . 2010-04-22 13:31 94208 ----a-w- c:\windows\DIIUnin.exe 2010-04-22 13:31 . 2010-04-22 13:31 2829 ----a-w- c:\windows\DIIUnin.pif 2010-04-21 20:11 . 2010-04-21 20:11 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Warsow 2010-04-20 20:07 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe 2010-04-19 20:42 . 2010-04-19 20:42 -------- d-----w- c:\programme\Backgammon-v0.3.2 2010-04-16 01:00 . 2010-04-16 01:00 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\Avira 2010-04-16 00:54 . 2010-03-01 07:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-04-16 00:54 . 2010-02-16 11:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-04-16 00:54 . 2009-05-11 09:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2010-04-16 00:54 . 2009-05-11 09:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2010-04-16 00:54 . 2010-04-16 00:54 -------- d-----w- c:\programme\Avira 2010-04-16 00:54 . 2010-04-16 00:54 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira 2010-04-13 18:11 . 2010-04-16 13:26 128 ---ha-w- c:\dokumente und einstellungen\Fab\microsoft.dat 2010-04-13 18:11 . 2010-04-16 13:26 -------- d-----w- c:\programme\Backgammon Classic 6 . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-03 13:59 . 2009-12-22 20:46 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\NoNameScript 2010-05-02 22:45 . 2009-12-22 21:58 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\vlc 2010-04-29 21:38 . 2010-01-09 15:21 -------- d-----w- c:\programme\Java 2010-04-29 21:34 . 2010-04-29 21:34 -------- d-----w- c:\dokumente und einstellungen\nich admin\Anwendungsdaten\Malwarebytes 2010-04-29 21:34 . 2010-04-29 21:34 30480 ----a-w- c:\dokumente und einstellungen\nich admin\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT 2010-04-29 21:34 . 2010-04-29 21:34 -------- d-----w- c:\dokumente und einstellungen\nich admin\Anwendungsdaten\Logitech 2010-04-29 21:34 . 2010-04-29 21:34 -------- d-----w- c:\dokumente und einstellungen\nich admin\Anwendungsdaten\ATI 2010-04-29 20:39 . 2010-01-07 12:35 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\FileZilla 2010-04-26 16:27 . 2010-01-06 21:55 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\uTorrent 2010-04-01 22:43 . 2009-12-23 02:08 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\dvdcss 2010-03-29 19:35 . 2010-01-08 21:18 30 ----a-w- c:\programme\Exiferupdate.ini 2010-03-29 19:35 . 2010-03-29 19:34 -------- d-----w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\SteelBytes 2010-03-29 16:01 . 2003-07-21 21:08 448816 ----a-w- c:\windows\system32\perfh007.dat 2010-03-29 16:01 . 2003-07-21 21:08 79918 ----a-w- c:\windows\system32\perfc007.dat 2010-03-12 10:25 . 2010-01-07 13:33 -------- d-----w- c:\programme\Gemeinsame Dateien\DVDVideoSoft 2010-03-09 11:09 . 2003-07-21 21:16 430080 ----a-w- c:\windows\system32\vbscript.dll 2010-02-26 05:41 . 2003-07-21 21:18 672768 ----a-w- c:\windows\system32\wininet.dll 2010-02-26 05:41 . 2009-12-22 21:41 81920 ------w- c:\windows\system32\ieencode.dll 2010-02-24 13:11 . 2003-07-21 21:01 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-17 12:04 . 2003-07-21 21:07 2192256 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 19:04 . 2002-08-29 03:41 2069120 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2003-07-21 20:48 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2003-07-21 21:14 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys 2010-02-04 18:02 . 2010-02-04 17:17 175461 ----a-w- c:\windows\hphins26.dat 2010-02-04 17:08 . 2010-01-09 15:24 1 ----a-w- c:\dokumente und einstellungen\Fab\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="f:\programme\Steam\Steam.exe" [2010-04-28 1238352] "DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTHelper"="CTHELPER.EXE" [2009-06-23 19456] "StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824] "SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040] "avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\dokumente und einstellungen\Fab\Startmen\Programme\Autostart\ OpenOffice.org 3.1.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000] Xfire.lnk - c:\programme\Xfire\Xfire.exe [2006-6-7 4154504] c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\ Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2009-12-23 813584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2009-07-20 11:28 72208 ----a-w- c:\programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "f:\\mIRC\\mirc.exe"= "c:\\Dokumente und Einstellungen\\Fab\\Anwendungsdaten\\NoNameScript\\nnrepair.exe"= "f:\\Programme\\Steam\\Steam.exe"= "f:\\Programme\\uTorrent\\uTorrent.exe"= "c:\\Programme\\ICQ6.5\\ICQ.exe"= "f:\\Warcraft III\\war3.exe"= "c:\\Programme\\QIP\\qip.exe"= "f:\\Programme\\League of Legends\\Air\\LolClient.exe"= "f:\\Programme\\League of Legends\\Game\\League of Legends.exe"= "f:\\Warcraft III\\Warcraft III.exe"= "f:\\Programme\\Warsow\\warsow_x86.exe"= "f:\\Programme\\Steam\\steamapps\\manoman600\\counter-strike\\hl.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6968:TCP"= 6968:TCP:League of Legends Launcher "6968:UDP"= 6968:UDP:League of Legends Launcher "6896:TCP"= 6896:TCP:League of Legends Launcher "6896:UDP"= 6896:UDP:League of Legends Launcher "6889:TCP"= 6889:TCP:League of Legends Launcher "6889:UDP"= 6889:UDP:League of Legends Launcher R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [16.4.2010 02:54 135336] R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [23.12.2009 00:48 10384] R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [23.6.2009 14:34 99352] R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [23.6.2009 14:34 555032] R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [23.6.2009 14:34 566296] S0 irxkx;irxkx; [x] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.1.2010 19:14 691696] S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [23.6.2009 14:34 99352] S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\programme\Gemeinsame Dateien\Creative Labs Shared\Service\CTAELicensing.exe [22.12.2009 22:56 79360] S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [23.6.2009 14:34 555032] S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [23.6.2009 14:35 100888] S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [23.6.2009 14:35 100888] S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [23.6.2009 14:34 566296] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2.8.2005 23:10 32512] . . ------- Zusätzlicher Suchlauf ------- . FF - ProfilePath - c:\dokumente und einstellungen\Fab\Anwendungsdaten\Mozilla\Firefox\Profiles\9dg7tut5.default\ FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: c:\programme\Mozilla Firefox\plugins\npwachk.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - Entfernte verwaiste Registrierungseinträge - - - - AddRemove-mIRC - e:\mirc\uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-05-03 16:07 Windows 5.1.2600 Service Pack 3 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\Ati2evxx.dll c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTServ.dll . Zeit der Fertigstellung: 2010-05-03 16:08:55 ComboFix-quarantined-files.txt 2010-05-03 14:08 Vor Suchlauf: 10 Verzeichnis(se), 10.604.531.712 Bytes frei Nach Suchlauf: 13 Verzeichnis(se), 10.605.252.608 Bytes frei WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn - - End Of File - - 9F23C07377C371FAA7247A5A68068250 |
|
03.05.2010, 16:00
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor Trojaner vollständig entfernt? Bitte mal den Avenger anwenden: 1.) Lade Dir von hier Avenger: Swandog46's Public Anti-Malware Tools (Download, linksseitig) 2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:  3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld: Code:
ATTFilter files to delete:
c:\windows\DIIUnin.dat
c:\windows\DIIUnin.exe
c:\windows\DIIUnin.pif
drivers to delete:
irxkx
5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein. 6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso. 7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier. 8.) Die Datei c:\avenger\backup.zip bei file-upload.net hochladen und hier verlinken
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Antimalware Doctor Trojaner vollständig entfernt? |
| entfernt?, hkus\s-1-5-18, jusched.exe, malwarebytes' anti-malware, plug-in |
Linear-Darstellung
