| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer öffnet von selbst und ungefragtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.06.2010, 13:11
| #1 |
 |  Internet Explorer öffnet von selbst und ungefragt Guten Tag. Von Zeit zu Zeit öffnet sich mein Internet Explorer selbst. Manchmal mit einer Werbungsseite, manchmal scheint es die zu öffnende Seite nicht mehr zu geben. Antivir habe ich auf die Jagd geschickt, aber es gab keine Beute. Ich habe schon viel im Internet gesucht aber keine Lösung gefunden. Gelernt habe ich aus der Internetsucherei nur, das man aus diesem HijackThis-Log das Problem herauslesen kann. Darum ist hier mal mein Log: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:01:56, on 23.06.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Users\Paul\AppData\Local\Temp\Pdj.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Steam\steam.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Logitech\SetPoint II\SetpointII.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Windows\ehome\ehmsas.exe C:\Windows\System32\mobsync.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\PROGRA~1\MI1933~1\Office12\OUTLOOK.EXE C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Windows\system32\conime.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Paul\Downloads\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing) R3 - URLSearchHook: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing) O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\system32\msxml71.dll (file missing) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing) O3 - Toolbar: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing) O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe GE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe -w O4 - HKCU\..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe -mini O4 - Global Startup: SetPointII.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) O16 - DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- End of file - 9245 bytes Ich hoffe das Problem lässt sich nun schnell und einfach klähren. Thx im Vorraus. |
|
23.06.2010, 13:58
| #2 |
| /// Malware-holic   | Internet Explorer öffnet von selbst und ungefragt ootl:
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "run Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt |
|
23.06.2010, 18:36
| #3 |
| | Internet Explorer öffnet von selbst und ungefragt Vielen Dank für die Antwort.
__________________Hier die 2 Reporte: Report 1(OTL) OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.06.2010 19:20:22 - Run 1 OTL by OldTimer - Version 3.2.6.1 Folder = C:\Users\Paul\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 911,96 Gb Total Space | 557,28 Gb Free Space | 61,11% Space Free | Partition Type: NTFS Drive D: | 19,54 Gb Total Space | 14,18 Gb Free Space | 72,54% Space Free | Partition Type: FAT32 Drive E: | 931,51 Gb Total Space | 931,39 Gb Free Space | 99,99% Space Free | Partition Type: NTFS F: Drive not present or media not loaded Drive G: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PAUL-PC Current User Name: Paul Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Paul\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Common Files\Steam\SteamService.exe (Valve Corporation) PRC - C:\Users\Paul\AppData\Local\Temp\Pdj.exe () PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Programme\Steam\steam.exe (Valve Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation) PRC - C:\Programme\Logitech\SetPoint II\SetPointII.exe (Logitech Inc.) PRC - C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.) PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE () PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Paul\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation) SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation) SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe () ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (libusb0) -- C:\Windows\System32\drivers\libusb0.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} IE - HKLM\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572 IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.03 17:10:07 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.12 18:39:49 | 000,000,000 | ---D | M] [2009.04.23 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla\Extensions [2010.06.23 13:11:14 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions [2010.04.30 14:19:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.15 18:34:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.04.30 14:19:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.06.13 20:11:57 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.05.12 18:39:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.03.15 19:11:03 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.03.15 19:11:03 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.03.15 19:11:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.03.15 19:11:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.03.15 19:11:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (XML Class) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\System32\msxml71.dll File not found O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found O3 - HKLM\..\Toolbar: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found O3 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\Toolbar\WebBrowser: (Eazel-DE Toolbar) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe (Google) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe (Take-Two Interactive Software, Inc.) O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Steam] c:\program files\steam\steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0 O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: CabBuilder hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.185.33 83.169.185.97 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2005.09.12 02:00:34 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>) - G:\autorun.exe -- [ CDFS ] O32 - AutoRun File - [2005.09.12 02:00:34 | 000,000,043 | R--- | M] () - G:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2005.09.12 02:00:34 | 000,001,042 | R--- | M] () - G:\autorun.ini -- [ CDFS ] O33 - MountPoints2\{03277723-2f72-11de-a973-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{03277723-2f72-11de-a973-806e6f6e6963}\Shell\AutoRun\command - "" = G:\autorun.exe -- [2005.09.12 02:00:34 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2008.01.21 04:34:27 | 000,000,000 | ---D | M] NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm () Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L) Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org) Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation) Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.06.15 04:16:24 | 000,086,016 | ---- | C] (Beepa P/L) -- C:\Windows\System32\frapsvid.dll [2010.06.12 08:28:21 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll [2010.06.12 08:28:19 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.06.12 08:28:19 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.06.12 08:28:14 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.06.12 08:28:14 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.06.12 08:28:13 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2010.06.12 08:28:13 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2010.06.12 08:28:06 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.06.04 22:55:37 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\Bioshock [2010.06.04 22:55:37 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Bioshock [2010.06.04 19:02:19 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\Futuremark [2010.06.04 19:01:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll [2010.06.04 19:01:02 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll [2010.06.04 19:01:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll [2010.06.04 19:01:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll [2010.06.04 19:01:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll [2010.06.04 19:01:02 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll [2010.06.04 19:01:02 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll [2010.06.04 19:01:01 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll [2010.06.04 19:01:01 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll [2010.06.04 19:01:01 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll [2010.06.04 19:01:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll [2010.06.04 19:01:01 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll [2010.06.04 19:01:01 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll [2010.06.04 19:01:01 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll [2010.06.04 19:01:00 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll [2010.06.04 19:01:00 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll [2010.06.04 19:01:00 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll [2010.06.04 19:01:00 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll [2010.06.04 19:01:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll [2010.06.04 19:01:00 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll [2010.06.04 19:01:00 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll [2010.06.04 19:01:00 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll [2010.06.04 19:01:00 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll [2010.06.04 19:01:00 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll [2010.06.04 19:00:59 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll [2010.06.04 19:00:59 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll [2010.06.01 21:20:35 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\RPGVX [2010.06.01 21:03:38 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Enterbrain [2010.06.01 21:03:24 | 000,000,000 | ---D | C] -- C:\Programme\Enterbrain [2010.05.27 18:25:50 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\TechSmith [2010.05.26 21:36:41 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\Camtasia Studio [2010.05.26 21:36:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\QuickTime [2010.05.26 21:36:01 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\TechSmith Shared [2010.05.26 21:35:56 | 000,000,000 | ---D | C] -- C:\Programme\TechSmith [2010.05.26 21:35:56 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith [2010.05.26 19:48:30 | 000,000,000 | ---D | C] -- C:\Programme\No23 Recorder [2010.05.26 13:57:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll ========== Files - Modified Within 30 Days ========== [2010.06.23 19:24:11 | 009,961,472 | -HS- | M] () -- C:\Users\Paul\ntuser.dat [2010.06.23 19:21:52 | 001,427,406 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.06.23 19:21:52 | 000,621,714 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.06.23 19:21:52 | 000,589,884 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.06.23 19:21:52 | 000,123,646 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.06.23 19:21:52 | 000,101,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job [2010.06.23 19:15:21 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job [2010.06.23 19:15:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.06.23 19:15:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.06.23 19:15:08 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.06.23 19:15:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.06.23 19:14:50 | 3220,389,888 | -HS- | M] () -- C:\hiberfil.sys [2010.06.23 14:38:33 | 000,524,288 | -HS- | M] () -- C:\Users\Paul\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.06.23 14:38:33 | 000,065,536 | -HS- | M] () -- C:\Users\Paul\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.06.23 14:37:56 | 003,987,483 | -H-- | M] () -- C:\Users\Paul\AppData\Local\IconCache.db [2010.06.23 12:50:21 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job [2010.06.22 23:06:55 | 000,359,927 | ---- | M] () -- C:\Users\Paul\Desktop\ZeitungHeadHunter.jpg [2010.06.19 21:06:24 | 870,197,427 | ---- | M] () -- C:\Users\Paul\Desktop\Sex and the City 2.mp4 [2010.06.19 18:57:37 | 448,484,770 | ---- | M] () -- C:\Users\Paul\Desktop\AE4616DF3983569A.mp4 [2010.06.19 13:05:03 | 000,344,759 | ---- | M] () -- C:\Users\Paul\Desktop\Immobilienträume.jpg [2010.06.18 17:25:40 | 000,205,226 | ---- | M] () -- C:\Users\Paul\Desktop\Immobilienträume2.jpg [2010.06.16 22:42:55 | 003,903,167 | ---- | M] () -- C:\Users\Paul\Desktop\Senseless Killing - Intro.mp4 [2010.06.16 21:29:46 | 000,588,513 | ---- | M] () -- C:\Users\Paul\Desktop\Senseless Killing.jpg [2010.06.16 19:40:49 | 000,000,959 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 5.lnk [2010.06.16 15:39:49 | 000,039,424 | ---- | M] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.15 21:42:14 | 010,072,734 | ---- | M] () -- C:\Users\Paul\Desktop\gtaiv-20100615-2142043.avi [2010.06.15 20:16:16 | 002,171,535 | ---- | M] () -- C:\Users\Paul\Desktop\Killing Geonosian - Star Wars Republic Commando.mp4 [2010.06.15 18:57:38 | 002,081,066 | ---- | M] () -- C:\Users\Paul\Desktop\Killing Normal Infected - Left 4 Dead 2.mp4 [2010.06.15 17:34:09 | 000,183,296 | ---- | M] () -- C:\Users\Paul\Desktop\Stopikus.exe [2010.06.15 04:16:24 | 000,086,016 | ---- | M] (Beepa P/L) -- C:\Windows\System32\frapsvid.dll [2010.06.14 19:18:09 | 001,348,278 | ---- | M] () -- C:\Users\Paul\Desktop\Runes of Magic - Killing Golo.mp4 [2010.06.14 19:16:16 | 000,002,515 | ---- | M] () -- C:\Users\Paul\Desktop\TubeBox! starten.lnk [2010.06.14 16:17:35 | 000,000,780 | ---- | M] () -- C:\Users\Paul\Desktop\wegame.lnk [2010.06.13 18:30:49 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat [2010.06.13 12:43:49 | 000,264,328 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.06.03 10:54:31 | 000,001,890 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys [2010.06.01 21:41:11 | 000,000,905 | ---- | M] () -- C:\Users\Paul\Desktop\RPGVX.lnk [2010.06.01 21:07:12 | 000,000,088 | RHS- | M] () -- C:\ProgramData\9B84762691.sys [2010.05.26 21:36:17 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk [2010.05.26 19:48:31 | 000,000,934 | ---- | M] () -- C:\Users\Public\Desktop\No23 Recorder.lnk [2010.05.26 19:06:41 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.05.26 16:47:41 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll ========== Files Created - No Company Name ========== [2010.06.22 23:06:32 | 000,359,927 | ---- | C] () -- C:\Users\Paul\Desktop\ZeitungHeadHunter.jpg [2010.06.19 19:02:43 | 870,197,427 | ---- | C] () -- C:\Users\Paul\Desktop\Sex and the City 2.mp4 [2010.06.19 18:07:14 | 448,484,770 | ---- | C] () -- C:\Users\Paul\Desktop\AE4616DF3983569A.mp4 [2010.06.19 13:04:44 | 000,344,759 | ---- | C] () -- C:\Users\Paul\Desktop\Immobilienträume.jpg [2010.06.18 17:25:24 | 000,205,226 | ---- | C] () -- C:\Users\Paul\Desktop\Immobilienträume2.jpg [2010.06.16 22:42:34 | 003,903,167 | ---- | C] () -- C:\Users\Paul\Desktop\Senseless Killing - Intro.mp4 [2010.06.16 21:29:18 | 000,588,513 | ---- | C] () -- C:\Users\Paul\Desktop\Senseless Killing.jpg [2010.06.16 19:40:49 | 000,000,959 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 5.lnk [2010.06.15 21:42:04 | 010,072,734 | ---- | C] () -- C:\Users\Paul\Desktop\gtaiv-20100615-2142043.avi [2010.06.15 20:16:03 | 002,171,535 | ---- | C] () -- C:\Users\Paul\Desktop\Killing Geonosian - Star Wars Republic Commando.mp4 [2010.06.15 18:57:28 | 002,081,066 | ---- | C] () -- C:\Users\Paul\Desktop\Killing Normal Infected - Left 4 Dead 2.mp4 [2010.06.15 17:38:20 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job [2010.06.15 17:38:19 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.06.15 17:34:09 | 000,183,296 | ---- | C] () -- C:\Users\Paul\Desktop\Stopikus.exe [2010.06.14 19:17:56 | 001,348,278 | ---- | C] () -- C:\Users\Paul\Desktop\Runes of Magic - Killing Golo.mp4 [2010.06.14 16:17:35 | 000,000,780 | ---- | C] () -- C:\Users\Paul\Desktop\wegame.lnk [2010.06.13 18:30:49 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2010.06.13 18:02:48 | 3220,389,888 | -HS- | C] () -- C:\hiberfil.sys [2010.06.01 21:41:11 | 000,000,905 | ---- | C] () -- C:\Users\Paul\Desktop\RPGVX.lnk [2010.06.01 21:07:08 | 000,001,890 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2010.06.01 21:07:08 | 000,000,088 | RHS- | C] () -- C:\ProgramData\9B84762691.sys [2010.05.26 21:36:17 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk [2010.05.26 19:48:31 | 000,000,934 | ---- | C] () -- C:\Users\Public\Desktop\No23 Recorder.lnk [2010.05.16 15:27:38 | 000,033,792 | ---- | C] () -- C:\Windows\System32\drivers\libusb0.sys [2010.04.02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2010.02.28 19:46:44 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2009.12.28 00:31:08 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2009.10.20 22:42:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.21 18:17:58 | 000,000,162 | ---- | C] () -- C:\Windows\System32\swctl.dll [2009.09.21 18:17:58 | 000,000,144 | -H-- | C] () -- C:\Windows\System32\CTLSW.INI [2009.08.30 19:27:39 | 000,034,308 | ---- | C] () -- C:\Windows\System32\Chip.dll [2009.06.14 14:36:54 | 000,339,968 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll [2009.06.14 14:36:54 | 000,114,688 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll [2009.04.23 19:11:45 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2009.04.23 19:11:45 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2009.04.23 19:11:45 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2009.04.23 14:22:51 | 000,000,228 | ---- | C] () -- C:\Windows\SIERRA.INI [2009.04.23 13:49:14 | 000,532,480 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll [2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2008.08.01 06:47:26 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2007.09.04 12:56:10 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== LOP Check ========== [2010.06.14 18:26:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Bioshock [2010.03.18 21:32:06 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mumble [2009.11.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Petroglyph [2009.07.12 11:04:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony [2009.07.12 11:02:33 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Setup [2009.06.10 19:51:43 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TeamViewer [2009.04.26 18:43:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Teeworlds [2010.05.23 17:28:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TS3Client [2009.09.16 22:11:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TubeBox [2009.06.24 23:59:59 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Uniblue [2009.09.28 18:27:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vso [2010.03.01 22:38:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\xVideoServiceThief [2010.06.23 14:38:22 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.06.23 12:50:21 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job [2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job [2010.06.23 19:15:21 | 000,000,282 | -H-- | M] () -- C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.05.16 18:25:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Adobe [2010.04.01 20:04:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Avira [2010.06.14 18:26:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Bioshock [2010.05.18 15:28:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\DivX [2009.04.23 15:18:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Google [2009.04.22 21:31:18 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Macromedia [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Media Center Programs [2010.04.15 20:26:36 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Media Player Classic [2010.03.15 18:37:25 | 000,000,000 | --SD | M] -- C:\Users\Paul\AppData\Roaming\Microsoft [2009.04.23 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla [2010.03.18 21:32:06 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mumble [2009.09.26 18:33:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nero [2009.11.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Petroglyph [2009.07.06 21:22:17 | 000,000,000 | RH-D | M] -- C:\Users\Paul\AppData\Roaming\SecuROM [2010.06.23 19:20:31 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Skype [2010.06.23 19:16:57 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\skypePM [2009.07.12 11:04:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony [2009.12.28 00:08:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Corporation [2009.07.12 11:02:33 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Setup [2010.03.29 20:46:07 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\teamspeak2 [2009.06.10 19:51:43 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TeamViewer [2009.04.26 18:43:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Teeworlds [2010.05.23 17:28:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TS3Client [2009.09.16 22:11:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TubeBox [2009.06.24 23:59:59 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Uniblue [2009.09.28 18:27:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vso [2009.04.26 18:10:13 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\WinRAR [2010.03.01 22:38:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\xVideoServiceThief < %APPDATA%\*.exe /s > [2009.09.28 18:27:41 | 000,087,608 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\inst.exe [2009.09.16 22:11:23 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{0D4F1C87-FECE-4DAC-AF46-4BC51DD4BAE0}\_6FEFF9B68218417F98F549.exe [2009.10.05 16:27:13 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe [2009.08.19 14:07:52 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{15262616-05AF-48F3-B03B-FEA7EB76BE38}\_6FEFF9B68218417F98F549.exe [2010.06.14 19:16:08 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_31A93269CEE5A678B80674.exe [2010.06.14 19:16:08 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_6FEFF9B68218417F98F549.exe [2010.06.14 19:16:08 | 000,025,214 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_CF21A7E464043C42ED6C28.exe [2010.06.14 19:16:08 | 000,355,574 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_D0CACB2DEDB677B81D19FE.exe [2010.06.14 19:16:08 | 000,355,574 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_FD16FB707C97B681CE3586.exe [2009.11.10 15:55:40 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{2E2F9C65-38BC-4400-A27C-D65A507587D0}\_6FEFF9B68218417F98F549.exe [2009.08.24 22:10:56 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{3680AE1C-8DC4-42CE-9286-32FE5337C3F3}\_6FEFF9B68218417F98F549.exe [2010.06.04 20:08:03 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe [2009.10.12 21:53:21 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{489BBD5A-7B60-4166-A3A7-6494A78E8509}\_6FEFF9B68218417F98F549.exe [2009.10.28 23:20:20 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{9DAC9A37-1280-4A87-BFA4-9AFF27C84955}\_6FEFF9B68218417F98F549.exe [2009.11.05 22:34:12 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\ARPPRODUCTICON.exe [2009.11.05 22:34:12 | 000,004,286 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\Fahrenheit.exe_B11493A1D18C4B5FAD8D53D777C9C16A.exe [2009.11.05 22:34:12 | 000,008,854 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\Uninstall_Fahrenheit_8C2B6FBDC8D14FA595F7B3231B7D8CBC.exe [2009.11.28 00:30:30 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{D761C5D2-E727-415A-BC4E-52642CEA1A1C}\_6FEFF9B68218417F98F549.exe [2009.05.10 19:01:28 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{EA61BCD3-FA73-4F6B-A525-8BD816E7C840}\_6FEFF9B68218417F98F549.exe [2009.07.12 11:02:39 | 021,935,408 | ---- | M] (Apple Inc.) -- C:\Users\Paul\AppData\Roaming\Sony Setup\A189E68E-2253-4c3b-86B7-D77E36F13C55\QuickTimeInstaller.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys [2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.03.12 08:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTORV.SYS > [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2007.12.08 09:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\drivers\nvstor32.sys [2007.12.08 09:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_933da2ea\nvstor32.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < End of report > Report 2(Extras): OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 23.06.2010 19:20:22 - Run 1
OTL by OldTimer - Version 3.2.6.1 Folder = C:\Users\Paul\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,96 Gb Total Space | 557,28 Gb Free Space | 61,11% Space Free | Partition Type: NTFS
Drive D: | 19,54 Gb Total Space | 14,18 Gb Free Space | 72,54% Space Free | Partition Type: FAT32
Drive E: | 931,51 Gb Total Space | 931,39 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: PAUL-PC
Current User Name: Paul
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04E8D9AC-FACF-410B-9E0E-F103C55D0F7D}" = lport=137 | protocol=17 | dir=in | app=system |
"{07A77BFB-ABA6-40AD-B19E-FEA034BC20FC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{214AE818-1EFD-4DD5-A04B-282EA4B6AD58}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3549BD0B-FB85-49D1-B164-3D3FA0D1F710}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4B544538-CBA2-4089-94DC-B25A47BF4C01}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{4D67DF8F-E83D-4A4B-BC8B-00406114A977}" = lport=139 | protocol=6 | dir=in | app=system |
"{64BB0AFB-95FB-442C-8BA0-0FC2229EE88E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{7926E926-EFF9-4F82-B376-678CA4A3C632}" = rport=138 | protocol=17 | dir=out | app=system |
"{87073FEC-8F27-4DD0-A72B-C557191426AF}" = lport=138 | protocol=17 | dir=in | app=system |
"{8841FA86-0EBA-4FB7-BDA2-F3349429FD35}" = rport=139 | protocol=6 | dir=out | app=system |
"{AA5EED59-EB24-4F55-914F-87BCD0B11AB7}" = rport=445 | protocol=6 | dir=out | app=system |
"{B4F85158-9AA2-42FF-9BC3-E326394D0DC3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{C014C6AB-4E10-4E17-888F-35F7BE873802}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C1A1CB4F-76F9-438D-A883-12BFA5102AEF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C69D54C4-7D4A-4132-8438-95B5439C2094}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CAF90A7C-A4FB-4D0F-904D-CC9282CDF96A}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{CD8B8062-3535-41FD-BDA6-610FC1CFD5A1}" = rport=137 | protocol=17 | dir=out | app=system |
"{D56F5971-4B5E-4A79-92FC-707D82215817}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{E645BDCE-CCEF-4E0D-8571-AD822DC39551}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F485E387-7D75-4D5C-896F-4B4426F6DBB0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F6C118F4-0246-48AC-99AE-94455A131758}" = lport=445 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008240A0-C6E8-45E4-9542-6A71C4C43F7B}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-dede-downloader.exe |
"{00FDB1DD-1DB6-49BD-952C-62EC93E8C36A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bioshock demo\builds\release\bioshock.exe |
"{016DE37F-3954-4B86-BEFA-F1B9B05CC5F9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{02E31C6A-A6D6-4ADB-B0D4-B304C77C2ACD}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe |
"{0313E36E-B10F-4814-A855-0C5807A2C6D4}" = protocol=6 | dir=in | app=c:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe |
"{0FC54272-D23D-4E80-8C40-1CBD58929DEE}" = protocol=6 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe |
"{1C39F286-AE7F-4383-8196-902775C813BC}" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{21203E0C-2929-4664-9D47-EFE5123AE2C4}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{2D0BA810-8587-44B3-8ABF-71AD769EFB4C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{388877D7-8A64-4524-9057-88BF7680EA43}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{3F9BF258-CEDB-4D3A-84C8-4C0AE5FBF3D5}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-dede-downloader.exe |
"{406D2904-3CF0-45E7-94F2-F441FD32532F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{430BF7F7-F145-48F0-BE66-326B5D1FDC6F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5C2FB9D0-57D2-441A-A09C-8911DEE55846}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe |
"{5D5424DB-9884-42D4-9E15-C51943AE30EB}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe |
"{629EC649-CCC4-4A46-9E0D-0ED6F3571DCB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{6797286D-19BE-4D2A-A81B-CE100ACBA341}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{6D42A1A7-E810-49F0-A0E6-C68DF4B7706B}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{766727A6-4477-4F4B-83B2-43C1452D9DC6}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe |
"{77BF7183-EAED-45FF-833A-919A40A20F1D}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{7903F55E-76F9-41F4-BFBB-D5B5FB2FBADA}" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{79078C29-470F-4A48-8AF2-88C01C1E00A4}" = protocol=17 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe |
"{864E5F35-437A-4FDA-AC24-BBC776C9675D}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{8912FCA4-A408-41A6-AC58-6E0DE0935BC5}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-dede-downloader.exe |
"{8C32D54D-D832-43FE-A01A-EAA6C58CFBDF}" = protocol=17 | dir=in | app=c:\program files\runes of magic\runes of magic.exe |
"{90C12740-67CF-4582-AB97-1BBF87152956}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{9E6AB3B1-E9DD-462D-8EE8-D084584513FF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bioshock demo\builds\release\bioshock.exe |
"{A929134D-6743-4A55-B23E-61275BA60098}" = protocol=17 | dir=in | app=c:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe |
"{AAFF830D-CEB5-429D-BEF5-3C6A43952E95}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe |
"{AEB701CD-434B-4452-B07E-20805E82F11A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B37D0CDA-B604-4CCA-B3E7-0457C50B22E9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BE6D62E6-6A49-4F2F-8611-2B838C25F54B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{BF3BF091-37D2-4C17-9A10-694584BF5484}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe |
"{C239AF71-B89B-4395-B6F3-5DBF56F93A81}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C287B6FE-CA03-430E-94E1-3B4B061CF308}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{CA149566-AC28-4324-BE55-F11BEB39E5CE}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{CBFCE86B-3BEF-4A71-99E8-E970FA50389F}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{CFD4112B-8BAA-473A-A9F2-C761FCF41511}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront\gamedata\battlefront.exe |
"{D29D646E-967E-4E2E-9702-392D5EAC5637}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{D8BDDB75-3299-4BB9-AEE9-AB6F459B983D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E1E843D3-5071-45F1-947B-611D0F52727E}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe |
"{E5AB5E04-1C1D-400C-888A-74D91A1DFA62}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe |
"{E6FBBBB6-F889-4054-ACE2-2F822F7B6738}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe |
"{E94BF8D2-8D97-44BD-B546-1AC89982B3E0}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{F1EA5398-9C4F-4D6C-8046-EC65431C39AD}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront\gamedata\battlefront.exe |
"{F54C9CA6-B475-4573-A4FB-75E7D2062FB3}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe |
"{F895A930-74CF-44E4-8952-3A2F71AC5BC6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{FEFA9032-1BA1-4D1F-A46A-AE157133CF8C}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-dede-downloader.exe |
"{FFBFEF32-F06F-4C9B-BE6C-67C811333730}" = protocol=6 | dir=in | app=c:\program files\runes of magic\runes of magic.exe |
"TCP Query User{14E482AB-76C8-4AC4-90E7-B8D75F477331}C:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe |
"TCP Query User{39733E74-7BCE-4FE9-82C5-B75E41BE3150}C:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe |
"TCP Query User{4DC5625A-C3E5-43DC-B3BA-3963A6694A88}C:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe |
"TCP Query User{67B79F7B-3B75-4780-B68A-CC05B5F95D1D}C:\program files\chilirec\chilirec.exe" = protocol=6 | dir=in | app=c:\program files\chilirec\chilirec.exe |
"TCP Query User{8CC08B55-3D15-4CF6-BB1D-2CAF52157809}C:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe" = protocol=6 | dir=in | app=c:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe |
"TCP Query User{A9111D62-F283-4BC8-85C1-91FF4D3A3581}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"TCP Query User{C75083AB-2298-4EB2-BA4B-7F0E6EF17802}C:\program files\runes of magic\launcher.exe" = protocol=6 | dir=in | app=c:\program files\runes of magic\launcher.exe |
"TCP Query User{D585A7D6-E570-4C29-AA1C-6C227AB5065B}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{D85F7210-191F-4B46-B2F4-5618953C01D7}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"TCP Query User{DC2AFDA4-B9DA-4077-A896-18C7ABD9C638}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe |
"TCP Query User{DF8A9479-C190-4F7A-96EF-6AC6E117D30A}C:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe |
"TCP Query User{F5E32804-3C5A-4F73-9102-0310B475450D}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe |
"UDP Query User{0381275B-D6C2-425E-92C6-B479430DAB9F}C:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe" = protocol=17 | dir=in | app=c:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe |
"UDP Query User{16C18791-C81D-4599-AB57-A1F817296A5F}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{22C8B15E-AFAD-4A37-A1B0-EF60F0E3485E}C:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe |
"UDP Query User{53C5CFA4-68FA-4935-87CA-EA89C0BF2ED0}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe |
"UDP Query User{66352977-C358-454D-8888-C72B3AE4887B}C:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe |
"UDP Query User{82B53376-A58E-477B-9022-F47F9BB04523}C:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe |
"UDP Query User{88FB27B7-B408-499C-BD33-F07879833ABA}C:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe |
"UDP Query User{8EDFAB33-A826-46DD-A86C-6274684700D5}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"UDP Query User{B00F1C08-2124-45EB-BD5C-CE677E9E17FA}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"UDP Query User{D6C8FC52-F2C8-4909-9DB6-0588EC229F53}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe |
"UDP Query User{D6DB7EB8-7BC2-43D7-9585-BC188FC101CA}C:\program files\chilirec\chilirec.exe" = protocol=17 | dir=in | app=c:\program files\chilirec\chilirec.exe |
"UDP Query User{D9F038F2-732E-4599-B5E7-39751B39A327}C:\program files\runes of magic\launcher.exe" = protocol=17 | dir=in | app=c:\program files\runes of magic\launcher.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20AB57C7-FED7-4394-8166-A409DEA20253}" = TubeBox!
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 20
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}" = Star Wars Knights of the Old Republic
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D87DC92-C328-46EC-A7B4-9C88129DC696}" = Dead Space™
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6592FDEC-2C1A-413A-9985-25FEC2F0848D}" = Star Wars Empire at War Forces of Corruption
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{8681B1E6-CD96-46EF-9065-CE0D1085ED99}" = Star Wars JK II Jedi Outcast
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_STANDARD_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_STANDARD_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_STANDARD_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A200E68-D5F4-4E70-910F-2871753A0E2B}" = Worms World Party
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{AEE307D5-9E65-4971-818E-C4D96DF55C64}" = Media Go
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{BA10AC78-E687-4523-8B93-540428FC256F}" = Fahrenheit
"{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU]
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{C1C91319-52B5-2624-8333-F741EDCE89D5}" = Catalyst Control Center InstallProxy
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C79CB9C7-10A4-4814-8402-F574672C2192}" = Star Wars Battlefront
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3120436-1358-4253-9EB2-257FFE8CE1D9}" = Logitech SetPoint 5.20
"{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}" = Star Wars Republic Commando
"{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12345_is1" = WeGame Client Public Beta 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Free Studio_is1" = Free Studio version 4.2
"Grand Theft Auto" = Grand Theft Auto
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"Labtec Media Keyboard V5.1" = Labtec Media Keyboard V5.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mumble" = Mumble and Murmur
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Picasa 3" = Picasa 3
"psp ebook creator_is1" = psp ebook creator v1.0.3
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPG Maker VX_is1" = RPG Maker VX
"STANDARD" = Microsoft Office Standard 2007
"Steam App 219" = Half-Life 2: Demo
"Steam App 240" = Counter-Strike: Source
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 564" = Left 4 Dead 2 Add-on Support
"Steam App 7710" = Bioshock Demo
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 5" = TeamViewer 5
"Uninstall_is1" = Uninstall 1.0.0.1
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"World of Warcraft" = World of Warcraft
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"c467f97a5a092d3f" = ROM-Runecalc
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 18.06.2010 06:43:29 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2010 06:45:08 | Computer Name = Paul-PC | Source = VSS | ID = 8194
Description =
Error - 18.06.2010 15:12:16 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 20.06.2010 12:24:31 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.06.2010 06:01:14 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.06.2010 14:53:33 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 23.06.2010 06:47:32 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
Error - 23.06.2010 07:12:16 | Computer Name = Paul-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 23.06.2010 08:27:21 | Computer Name = Paul-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hl2.exe, Version 0.0.0.0, Zeitstempel 0x4445c334,
fehlerhaftes Modul filesystem_steam.dll_unloaded, Version 0.0.0.0, Zeitstempel
0x47e2d72b, Ausnahmecode 0xc0000005, Fehleroffset 0x0051553e, Prozess-ID 0x1104,
Anwendungsstartzeit 01cb12cdccf58838.
Error - 23.06.2010 13:16:36 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 13.06.2010 06:44:31 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 13.06.2010 06:44:31 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 13.06.2010 06:45:04 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 13.06.2010 06:45:06 | Computer Name = Paul-PC | Source = DCOM | ID = 10005
Description =
Error - 13.06.2010 06:45:09 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 13.06.2010 12:04:15 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7009
Description =
Error - 13.06.2010 12:04:15 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 15.06.2010 16:02:05 | Computer Name = Paul-PC | Source = DCOM | ID = 10010
Description =
Error - 17.06.2010 14:53:48 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7009
Description =
Error - 17.06.2010 14:53:48 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
|
|
23.06.2010, 18:54
| #4 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt Fixen mit OTL • Starte bitte die OTL.exe. Vista-User mit Rechtsklick "als Administrator starten" • Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Users\Paul\AppData\Local\Temp\Pdj.exe () O2 - BHO: (XML Class) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\System32\msxml71.dll File not found O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found O3 - HKLM\..\Toolbar: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe File not found [2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job :Files C:\Users\Paul\AppData\Local\Temp\Pdj.exe :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument dieses posten |
|
23.06.2010, 19:09
| #5 |
| | Internet Explorer öffnet von selbst und ungefragt Gut...das ist dabei rausgekommen: All processes killed ========== OTL ========== No active process named Pdj.exe was found! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9508125-4747-4733-b048-e4b82dc9716d}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c9508125-4747-4733-b048-e4b82dc9716d} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\ not found. Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DS3 Tool deleted successfully. Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Uniblue RegistryBooster 2009 deleted successfully. File c:\program files\uniblue\registrybooster\StartRegistryBooster.exe not found. Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Uniblue RegistryBooster 2009 not found. File c:\program files\uniblue\registrybooster\StartRegistryBooster.exe not found. Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Wallpaper4U deleted successfully. C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job moved successfully. C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job moved successfully. ========== FILES ========== C:\Users\Paul\AppData\Local\Temp\Pdj.exe moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 83 bytes User: Default User ->Flash cache emptied: 0 bytes User: Paul ->Flash cache emptied: 45905 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Paul ->Temp folder emptied: 8063526841 bytes ->Temporary Internet Files folder emptied: 28042980 bytes ->Java cache emptied: 41870161 bytes ->FireFox cache emptied: 93151552 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 57478357 bytes RecycleBin emptied: 1233056 bytes Total Files Cleaned = 7.902,00 mb OTL by OldTimer - Version 3.2.6.1 log created on 06232010_200353 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
23.06.2010, 19:16
| #6 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix |
|
23.06.2010, 19:48
| #7 |
| | Internet Explorer öffnet von selbst und ungefragt Das Programm klang ja schon ziemlich gefährlich, ich hoffe es ist nichts schief gegangen. Hier is der Log: Combofix Logfile: Code:
ATTFilter ComboFix 10-06-23.01 - Paul 23.06.2010 20:32:07.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.2025 [GMT 2:00]
ausgeführt von:: c:\users\Paul\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Paul\AppData\Roaming\inst.exe
c:\windows\system32\Chip.dll
E:\install.exe
.
((((((((((((((((((((((( Dateien erstellt von 2010-05-23 bis 2010-06-23 ))))))))))))))))))))))))))))))
.
2010-06-23 18:03 . 2010-06-23 18:03 -------- d-----w- C:\_OTL
2010-06-15 02:16 . 2010-06-15 02:16 86016 ----a-w- c:\windows\system32\frapsvid.dll
2010-06-14 17:16 . 2010-06-14 17:16 9662 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_6FEFF9B68218417F98F549.exe
2010-06-14 17:16 . 2010-06-14 17:16 355574 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_FD16FB707C97B681CE3586.exe
2010-06-14 17:16 . 2010-06-14 17:16 355574 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_D0CACB2DEDB677B81D19FE.exe
2010-06-14 17:16 . 2010-06-14 17:16 25214 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_CF21A7E464043C42ED6C28.exe
2010-06-14 17:16 . 2010-06-14 17:16 10134 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_31A93269CEE5A678B80674.exe
2010-06-13 16:30 . 2010-06-13 16:30 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-06-06 13:52 . 2010-06-06 13:52 56997 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 56765 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 57715 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 54644 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-06-04 20:55 . 2010-06-14 16:26 -------- d-----w- c:\users\Paul\AppData\Roaming\Bioshock
2010-06-04 18:08 . 2010-06-04 18:08 9662 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe
2010-06-04 17:02 . 2010-06-04 17:02 -------- d-----w- c:\users\Paul\AppData\Local\Futuremark
2010-06-04 17:00 . 2008-07-10 09:01 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-06-04 17:00 . 2008-07-10 09:00 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-06-01 19:07 . 2010-06-03 08:54 1890 --sha-w- c:\programdata\KGyGaAvL.sys
2010-06-01 19:07 . 2010-06-01 19:07 88 --sh--r- c:\programdata\9B84762691.sys
2010-06-01 19:03 . 2010-06-01 19:03 -------- d-----w- c:\program files\Common Files\Enterbrain
2010-06-01 19:03 . 2010-06-01 19:03 -------- d-----w- c:\program files\Enterbrain
2010-05-27 16:25 . 2010-05-27 16:25 -------- d-----w- c:\users\Paul\AppData\Local\TechSmith
2010-05-26 19:36 . 2010-03-04 15:27 411480 ----a-w- c:\windows\system32\tsccvid.dll
2010-05-26 19:36 . 2010-05-26 19:36 -------- d-----w- c:\windows\system32\QuickTime
2010-05-26 19:36 . 2010-05-26 19:36 -------- d-----w- c:\program files\Common Files\TechSmith Shared
2010-05-26 19:35 . 2010-05-26 19:36 -------- d-----w- c:\programdata\TechSmith
2010-05-26 19:35 . 2010-05-26 19:35 -------- d-----w- c:\program files\TechSmith
2010-05-26 17:48 . 2010-06-14 20:20 -------- d-----w- c:\program files\No23 Recorder
2010-05-26 11:57 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-23 18:21 . 2009-04-23 11:52 -------- d-----w- c:\users\Paul\AppData\Roaming\Skype
2010-06-23 18:14 . 2009-05-04 11:51 -------- d-----w- c:\program files\Steam
2010-06-23 18:12 . 2008-01-21 07:15 621714 ----a-w- c:\windows\system32\perfh007.dat
2010-06-23 18:12 . 2008-01-21 07:15 123646 ----a-w- c:\windows\system32\perfc007.dat
2010-06-23 17:16 . 2009-04-23 11:54 -------- d-----w- c:\users\Paul\AppData\Roaming\skypePM
2010-06-23 17:16 . 2009-10-28 15:16 -------- d-----w- c:\program files\Runes of Magic
2010-06-18 10:23 . 2009-05-04 11:51 -------- d-----w- c:\program files\Common Files\Steam
2010-06-16 17:40 . 2009-06-10 17:33 -------- d-----w- c:\program files\TeamViewer
2010-06-14 14:17 . 2009-11-16 16:36 -------- d-----w- c:\program files\WeGame
2010-06-13 10:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-12 18:12 . 2009-04-26 09:27 -------- d-----w- c:\programdata\Microsoft Help
2010-06-06 13:52 . 2010-05-18 11:28 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-06-06 13:52 . 2010-05-18 11:27 -------- d-----w- c:\programdata\DivX
2010-06-06 13:52 . 2009-07-08 19:54 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-06-06 13:52 . 2009-07-08 19:54 -------- d-----w- c:\program files\DivX
2010-06-06 13:51 . 2010-05-18 11:43 1062184 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-06-06 13:51 . 2010-05-18 11:28 895256 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-06-04 17:02 . 2009-07-06 19:06 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-06-04 17:02 . 2009-07-06 19:06 -------- d-----w- c:\program files\AGEIA Technologies
2010-06-04 15:08 . 2008-10-27 13:47 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-29 17:14 . 2009-04-22 19:31 -------- d-----w- c:\program files\Google
2010-05-26 17:06 . 2010-06-12 06:28 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-12 06:28 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-23 15:28 . 2010-03-18 17:11 -------- d-----w- c:\users\Paul\AppData\Roaming\TS3Client
2010-05-23 12:02 . 2010-03-18 17:11 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-05-21 12:14 . 2009-10-03 10:10 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-18 13:28 . 2009-07-09 16:25 -------- d-----w- c:\users\Paul\AppData\Roaming\DivX
2010-05-18 11:43 . 2010-05-18 11:43 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-05-16 14:18 . 2010-05-16 13:52 -------- d-----w- c:\program files\MotioninJoy
2010-05-16 13:58 . 2010-05-16 13:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_MijUfilt_01009.Wdf
2010-05-16 13:58 . 2010-05-16 13:58 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-05-16 13:52 . 2010-05-16 13:52 67584 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-05-16 13:52 . 2010-05-16 13:52 17408 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijUfilt.sys
2010-05-16 13:52 . 2010-05-16 13:52 24576 ----a-w- c:\programdata\MotioninJoy\DS3tool\update\drivers\MijBThid.sys
2010-05-16 13:52 . 2010-05-16 13:52 -------- d-----w- c:\programdata\MotioninJoy
2010-05-16 13:51 . 2010-05-16 13:45 -------- d-----w- c:\program files\LibUSB-Win32-0.1.10.1
2010-05-12 16:39 . 2009-11-06 21:47 -------- d-----w- c:\program files\Java
2010-05-04 19:15 . 2010-06-12 06:28 834048 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 18:37 . 2010-06-12 06:28 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-01 14:13 . 2010-06-12 06:28 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-04-28 20:37 . 2010-04-28 20:37 -------- d-----w- c:\program files\psp ebook creator
2010-04-27 12:45 . 2010-04-27 12:45 72856 ----a-w- c:\windows\system32\xliveinstallhost.exe
2010-04-27 12:45 . 2010-04-27 12:45 187544 ----a-w- c:\windows\system32\xliveinstall.dll
2010-04-12 15:29 . 2010-05-12 16:39 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-05 17:01 . 2010-06-12 06:28 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-04-02 15:17 . 2010-04-02 15:17 15426200 ----a-w- c:\windows\system32\xlive.dll
2010-04-02 15:17 . 2010-04-02 15:17 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2010-03-31 01:58 . 2009-04-23 11:49 133616 ------w- c:\windows\system32\pxafs.dll
2010-03-31 01:58 . 2009-04-23 11:49 125424 ------w- c:\windows\system32\pxinsi64.exe
2010-03-31 01:58 . 2009-04-23 11:49 123888 ------w- c:\windows\system32\pxcpyi64.exe
2006-05-03 09:06 . 2009-12-27 22:29 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-12-27 22:29 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-12-27 22:29 216064 --sh--r- c:\windows\System32\nbDX.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Steam"="c:\program files\steam\steam.exe" [2010-05-08 1238352]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2008-11-14 305064]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-09 6281760]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-10-14 20480]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2009-7-21 323584]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
"VistaSp2"=hex(b):86,92,38,16,b7,53,ca,01
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 MotioninJoyUSBFilter;MotioninJoy USB Filter Driver;c:\windows\system32\DRIVERS\MijUfilt.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-09-21 3474384]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-01-11 36384]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-05-21 173352]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
2010-06-23 c:\windows\Tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
URLSearchHooks-{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - (no file)
URLSearchHooks-{c9508125-4747-4733-b048-e4b82dc9716d} - (no file)
WebBrowser-{69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - (no file)
AddRemove-World of Warcraft - c:\program files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-23 20:38
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\SecuROM\License information*]
"datasecu"=hex:90,c8,f2,48,a1,ca,f3,0c,80,49,78,86,c8,78,4b,aa,1c,ac,ed,66,55,
14,86,a6,6c,2c,36,d5,12,57,6c,6a,2c,05,91,94,df,70,a0,82,9d,06,85,a0,99,ba,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
Zeit der Fertigstellung: 2010-06-23 20:40:15
ComboFix-quarantined-files.txt 2010-06-23 18:40
Vor Suchlauf: 14 Verzeichnis(se), 605.384.462.336 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 605.314.572.288 Bytes frei
- - End Of File - - 712EE09B3AB87763BE1064D3C40DACD4
|
|
24.06.2010, 11:00
| #8 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt VirusTotal - Free Online Virus and Malware Scan prüfe dort: c:\programdata\9B84762691.sys falls bereits analysiert, klickke erneut prüfen, ergebniss posten |
|
24.06.2010, 13:11
| #9 |
| | Internet Explorer öffnet von selbst und ungefragt Datei 9B84762691.sys empfangen 2010.06.24 12:03:46 (UTC) Status: Beendet Ergebnis: 0/41 (0%) weitere Informationen File size: 88 bytes MD5...: 7b7950f919b879f1c289598cfa0d85dd SHA1..: eebadb87063d098ba960967c0768b47a910920c5 SHA256: 3d3cfe0b988364b3e9d5ad2b7b8f7dd18066c395abe0a671361823b286f28985 ssdeep: 3:hl/1suj4Q:hR PEiD..: - PEInfo: - RDS...: NSRL Reference Data Set - pdfid.: - trid..: MS Flight Simulator Aircraft Performance Info (100.0%) sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned |
|
24.06.2010, 13:38
| #10 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt ok, jetzt rechtsklick auf den avira schirm, guard deaktivieren. dann öfnest du "mein computer" (arbeitsplatz) und dort c: da siehst du _OTL da einen rechtsklick, zu _OTL.rar oder zip hinzufügen, das selbe mit qoobox. http://www.trojaner-board.de/54791-a...ner-board.html hier an uns hochladen, gib bescheid, wenn fertig. downloade nun malwarebytes: Malwarebytes instalieren, dann öffnen, registerkarte scanner, komplett scan, funde löschen, log posten, dann avira wieder einschalten |
|
24.06.2010, 15:03
| #11 |
| | Internet Explorer öffnet von selbst und ungefragt Ok, also. Die rar Dateien habe ich hochgeladen. (Datei: _OTL.rar empfangen Datei: Qoobox.rar empfangen Vorgang erfolgreich abgeschlossen.) Malwarebytes-Log: alwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4232 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 24.06.2010 16:00:25 mbam-log-2010-06-24 (16-00-25).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 344871 Laufzeit: 1 Stunde(n), 2 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Team17\Worms World Party\Install Fix - WWP.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Team17\Worms World Party\wwp.exe (Trojan.Dropper) -> Quarantined and deleted successfully. |
|
24.06.2010, 15:22
| #12 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt avira avira so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm. dann öffne avira, lokaler schutz, rechtsklick auf lokale laufwerke, suchlauf als admin starten. funde in quarantäne, log posten |
|
24.06.2010, 16:59
| #13 |
| | Internet Explorer öffnet von selbst und ungefragt Das Antivir einen Log hat wusste ich nicht, und musste erstmal suchen. Ich hoffe ich habe damit das richtige gefunden was du brauchst: Avira AntiVir Personal Erstellungsdatum der Reportdatei: Donnerstag, 24. Juni 2010 16:38 Es wird nach 2266069 Virenstämmen gesucht. Das Programm läuft als uneingeschränkte Vollversion. Online-Dienste stehen zur Verfügung. Lizenznehmer : Avira AntiVir Personal - FREE Antivirus Seriennummer : 0000149996-ADJIE-0000001 Plattform : Windows Vista Windowsversion : (Service Pack 2) [6.0.6002] Boot Modus : Normal gebootet Benutzername : Paul Computername : PAUL-PC Versionsinformationen: BUILD.DAT : 10.0.0.567 32097 Bytes 19.04.2010 15:50:00 AVSCAN.EXE : 10.0.3.0 433832 Bytes 19.04.2010 11:56:58 AVSCAN.DLL : 10.0.3.0 56168 Bytes 19.04.2010 11:56:58 LUKE.DLL : 10.0.2.3 104296 Bytes 07.03.2010 17:32:59 LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 10:59:47 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 13:04:34 VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 13:04:34 VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 13:55:23 VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 14:11:15 VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 07:36:05 VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 21:29:43 VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 13:45:15 VBASE007.VDF : 7.10.7.219 2048 Bytes 02.06.2010 13:45:15 VBASE008.VDF : 7.10.7.220 2048 Bytes 02.06.2010 13:45:15 VBASE009.VDF : 7.10.7.221 2048 Bytes 02.06.2010 13:45:15 VBASE010.VDF : 7.10.7.222 2048 Bytes 02.06.2010 13:45:15 VBASE011.VDF : 7.10.7.223 2048 Bytes 02.06.2010 13:45:15 VBASE012.VDF : 7.10.7.224 2048 Bytes 02.06.2010 13:45:15 VBASE013.VDF : 7.10.8.37 270336 Bytes 10.06.2010 06:19:00 VBASE014.VDF : 7.10.8.69 138752 Bytes 14.06.2010 11:54:13 VBASE015.VDF : 7.10.8.102 130560 Bytes 16.06.2010 12:07:07 VBASE016.VDF : 7.10.8.135 152064 Bytes 21.06.2010 10:03:13 VBASE017.VDF : 7.10.8.163 432128 Bytes 23.06.2010 14:27:15 VBASE018.VDF : 7.10.8.164 2048 Bytes 23.06.2010 14:27:15 VBASE019.VDF : 7.10.8.165 2048 Bytes 23.06.2010 14:27:15 VBASE020.VDF : 7.10.8.166 2048 Bytes 23.06.2010 14:27:15 VBASE021.VDF : 7.10.8.167 2048 Bytes 23.06.2010 14:27:15 VBASE022.VDF : 7.10.8.168 2048 Bytes 23.06.2010 14:27:15 VBASE023.VDF : 7.10.8.169 2048 Bytes 23.06.2010 14:27:15 VBASE024.VDF : 7.10.8.170 2048 Bytes 23.06.2010 14:27:15 VBASE025.VDF : 7.10.8.171 2048 Bytes 23.06.2010 14:27:15 VBASE026.VDF : 7.10.8.172 2048 Bytes 23.06.2010 14:27:15 VBASE027.VDF : 7.10.8.173 2048 Bytes 23.06.2010 14:27:15 VBASE028.VDF : 7.10.8.174 2048 Bytes 23.06.2010 14:27:15 VBASE029.VDF : 7.10.8.175 2048 Bytes 23.06.2010 14:27:15 VBASE030.VDF : 7.10.8.176 2048 Bytes 23.06.2010 14:27:15 VBASE031.VDF : 7.10.8.184 60928 Bytes 24.06.2010 14:27:15 Engineversion : 8.2.4.2 AEVDF.DLL : 8.1.2.0 106868 Bytes 25.04.2010 12:20:35 AESCRIPT.DLL : 8.1.3.33 1356155 Bytes 24.06.2010 14:27:17 AESCN.DLL : 8.1.6.1 127347 Bytes 14.05.2010 11:00:11 AESBX.DLL : 8.1.3.1 254324 Bytes 25.04.2010 12:20:35 AERDL.DLL : 8.1.4.6 541043 Bytes 17.04.2010 21:29:46 AEPACK.DLL : 8.2.2.5 430453 Bytes 24.06.2010 14:27:16 AEOFFICE.DLL : 8.1.1.0 201081 Bytes 14.05.2010 11:00:11 AEHEUR.DLL : 8.1.1.38 2724214 Bytes 24.06.2010 14:27:16 AEHELP.DLL : 8.1.11.6 242038 Bytes 24.06.2010 14:27:15 AEGEN.DLL : 8.1.3.12 377204 Bytes 24.06.2010 14:27:15 AEEMU.DLL : 8.1.2.0 393588 Bytes 25.04.2010 12:20:35 AECORE.DLL : 8.1.15.3 192886 Bytes 14.05.2010 11:00:11 AEBB.DLL : 8.1.1.0 53618 Bytes 25.04.2010 12:20:35 AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 10:59:10 AVPREF.DLL : 10.0.0.0 44904 Bytes 14.01.2010 10:59:07 AVREP.DLL : 10.0.0.8 62209 Bytes 18.02.2010 15:47:40 AVREG.DLL : 10.0.3.0 53096 Bytes 19.04.2010 11:56:59 AVSCPLR.DLL : 10.0.3.0 83816 Bytes 19.04.2010 11:56:59 AVARKT.DLL : 10.0.0.14 227176 Bytes 19.04.2010 11:56:58 AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 26.01.2010 08:53:25 SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:57:53 AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 14:38:54 NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 13:40:55 RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 12:10:08 RCTEXT.DLL : 10.0.53.0 98152 Bytes 19.04.2010 11:56:58 Konfiguration für den aktuellen Suchlauf: Job Name..............................: Lokale Laufwerke Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp Protokollierung.......................: niedrig Primäre Aktion........................: interaktiv Sekundäre Aktion......................: ignorieren Durchsuche Masterbootsektoren.........: ein Durchsuche Bootsektoren...............: ein Bootsektoren..........................: C:, D:, E:, I:, J:, K:, F:, G:, Durchsuche aktive Programme...........: ein Durchsuche Registrierung..............: ein Suche nach Rootkits...................: aus Integritätsprüfung von Systemdateien..: ein Optimierter Suchlauf..................: ein Datei Suchmodus.......................: Intelligente Dateiauswahl Durchsuche Archive....................: ein Rekursionstiefe einschränken..........: 20 Archiv Smart Extensions...............: ein Makrovirenheuristik...................: ein Dateiheuristik........................: hoch Beginn des Suchlaufs: Donnerstag, 24. Juni 2010 16:38 Der Suchlauf über gestartete Prozesse wird begonnen: Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'DllHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'DllHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wmplayer.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'GameOverlayUI.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'hl2.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WMPNSCFG.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'OUTLOOK.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PresentationFontCache.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'skypePM.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SteamService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'KHALMNPR.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SetpointII.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'steam.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'TeamViewer_Service.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'IoctlSvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'NBService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht Untersuchung der Systemdateien wird begonnen: Signiert -> 'C:\Windows\system32\svchost.exe' Signiert -> 'C:\Windows\system32\winlogon.exe' Signiert -> 'C:\Windows\explorer.exe' Signiert -> 'C:\Windows\system32\smss.exe' Signiert -> 'C:\Windows\system32\wininet.DLL' Signiert -> 'C:\Windows\system32\wsock32.DLL' Signiert -> 'C:\Windows\system32\ws2_32.DLL' Signiert -> 'C:\Windows\system32\services.exe' Signiert -> 'C:\Windows\system32\lsass.exe' Signiert -> 'C:\Windows\system32\csrss.exe' Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys' Signiert -> 'C:\Windows\system32\spoolsv.exe' Signiert -> 'C:\Windows\system32\alg.exe' Signiert -> 'C:\Windows\system32\wuauclt.exe' Signiert -> 'C:\Windows\system32\advapi32.DLL' Signiert -> 'C:\Windows\system32\user32.DLL' Signiert -> 'C:\Windows\system32\gdi32.DLL' Signiert -> 'C:\Windows\system32\kernel32.DLL' Signiert -> 'C:\Windows\system32\ntdll.DLL' Signiert -> 'C:\Windows\system32\ntoskrnl.exe' Signiert -> 'C:\Windows\system32\ctfmon.exe' Die Systemdateien wurden durchsucht ('21' Dateien) Der Suchlauf über die Masterbootsektoren wird begonnen: Masterbootsektor HD0 [INFO] Es wurde kein Virus gefunden! Masterbootsektor HD1 [INFO] Es wurde kein Virus gefunden! Masterbootsektor HD2 [INFO] Es wurde kein Virus gefunden! Masterbootsektor HD3 [INFO] Es wurde kein Virus gefunden! Masterbootsektor HD4 [INFO] Es wurde kein Virus gefunden! Der Suchlauf über die Bootsektoren wird begonnen: Bootsektor 'C:\' [INFO] Es wurde kein Virus gefunden! Bootsektor 'D:\' [INFO] Es wurde kein Virus gefunden! Bootsektor 'E:\' [INFO] Es wurde kein Virus gefunden! Bootsektor 'I:\' [INFO] Im Laufwerk 'I:\' ist kein Datenträger eingelegt! Bootsektor 'J:\' [INFO] Im Laufwerk 'J:\' ist kein Datenträger eingelegt! Bootsektor 'K:\' [INFO] Im Laufwerk 'K:\' ist kein Datenträger eingelegt! Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen: Die Registry wurde durchsucht ( '1797' Dateien ). Der Suchlauf über die ausgewählten Dateien wird begonnen: Beginne mit der Suche in 'C:\' <BOOT> C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RDWLG3X.rar [0] Archivtyp: RAR [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 --> _OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RM90UWG.exe [WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht! C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RKNNNE3\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RN9FTMG\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RTMDN3J\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 C:\Program Files\7-Zip\Uninstall.exe [WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht! C:\Users\Paul\AppData\Local\Mozilla\Firefox\Profiles\l7sed1fr.default\Cache\02F716A9d01 [WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht! C:\Users\Paul\AppData\Local\Mozilla\Firefox\Profiles\l7sed1fr.default\Cache\C3ED8F3Bd01 [WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht! C:\Users\Paul\Desktop\Verschiedenes\_OTL.rar [0] Archivtyp: RAR [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 --> _OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 Beginne mit der Suche in 'D:\' <RECOVER> C:\_OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 Beginne mit der Suche in 'E:\' <DATA> Beginne mit der Suche in 'I:\' Der zu durchsuchende Pfad I:\ konnte nicht geöffnet werden! Systemfehler [21]: Das Gerät ist nicht bereit. Beginne mit der Suche in 'J:\' Der zu durchsuchende Pfad J:\ konnte nicht geöffnet werden! Systemfehler [21]: Das Gerät ist nicht bereit. Beginne mit der Suche in 'K:\' Der zu durchsuchende Pfad K:\ konnte nicht geöffnet werden! Systemfehler [21]: Das Gerät ist nicht bereit. Beginne mit der Suche in 'F:\' Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden! Systemfehler [21]: Das Gerät ist nicht bereit. Beginne mit der Suche in 'G:\' <CSS> Beginne mit der Desinfektion: C:\_OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ab1dbbc.qua' verschoben! C:\Users\Paul\Desktop\Verschiedenes\_OTL.rar [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52dcf40e.qua' verschoben! C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RTMDN3J\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0079aef3.qua' verschoben! C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RN9FTMG\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '664ee131.qua' verschoben! C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RKNNNE3\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '23cacc0f.qua' verschoben! C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RDWLG3X.rar [FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c3bfe7c.qua' verschoben! Ende des Suchlaufs: Donnerstag, 24. Juni 2010 17:50 Benötigte Zeit: 1:11:02 Stunde(n) Der Suchlauf wurde vollständig durchgeführt. 25150 Verzeichnisse wurden überprüft 462866 Dateien wurden geprüft 6 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 6 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 0 Dateien konnten nicht durchsucht werden 462860 Dateien ohne Befall 5127 Archive wurden durchsucht 4 Warnungen 6 Hinweise |
|
24.06.2010, 17:07
| #14 |
| /// Malware-holic | Internet Explorer öffnet von selbst und ungefragt leere mal den papierkorb. berichte, wie der pc läuft. |
|
24.06.2010, 17:27
| #15 |
| | Internet Explorer öffnet von selbst und ungefragt Papierkorb geleert. Soll ich die 6 in Quarantäne verschobene Dateien löschen? Ansonsten hat mein Internet Explorer bisher keinen Laut mehr von sich gegeben. Ich glaube du hast meinen PC geheilt.  Du hast bisher sonst nicht viel zu dem gesagt was passiert ist. Weißt du was nun der Übeltäter war? |
|
| Themen zu Internet Explorer öffnet von selbst und ungefragt |
| adobe, antivir, antivir guard, avg, avira, bho, defender, desktop, ebay, explorer, firefox, google, hijack, internet, internet explorer, local\temp, mein log, mozilla, nvidia, plug-in, problem, rundll, software, system, temp, vista, von selbst, windows, öffnet |
Linear-Darstellung
