| |
| |||||||
Log-Analyse und Auswertung: Systemabsturz Vista, Explorer reagiert nichtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.08.2010, 00:04
| #1 |
| |  Systemabsturz Vista, Explorer reagiert nicht Hallo liebe Leute. Seit Tagen nervt mein WLan. Heut wollt ich neuen Treiber installieren und habe mir wahrscheinlich einen Virus eingefangen. Nun stürzt das System ständig ab, reagiert nicht mehr. (Win Explorer) Auf den Verdacht kam ich als ich unter Taskmanager Prozesse etwas gefunden habe und gegooglet habe und in der Aufklärung stand Trojaner!!! Name: "irgendetwas mit Bg") Brauche dringen eure Hilfe  Bin der Anleitung gefolgt und habe nun folgende LOG Files. Außer: HJTMalwarebytes' Anti-Malware 1.46 Malwarebytes Datenbank Version: 4486 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18943 26.08.2010 23:48:24 mbam-log-2010-08-26 (23-48-24).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 129387 Laufzeit: 6 Minute(n), 1 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) defogger_disable by jpshortstuff (23.02.10.1) Log created at 23:52 on 26/08/2010 (Bandit) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- im "Gmer" kein Eintrag!!! OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.08.2010 00:31:40 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\Bandit\Desktop\MFTools Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18943) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 74,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 4,53 Gb Free Space | 9,27% Space Free | Partition Type: NTFS Drive D: | 237,46 Gb Total Space | 233,02 Gb Free Space | 98,13% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BANDIT-PC Current User Name: Bandit Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.08.26 23:34:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Bandit\Desktop\MFTools\OTL.exe PRC - [2010.08.26 17:44:33 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\Bandit\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe PRC - [2010.01.12 16:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe PRC - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.07.26 17:44:14 | 003,883,840 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe PRC - [2009.06.22 15:21:58 | 000,304,592 | ---- | M] () -- C:\Programme\XSManager\WTGService.exe PRC - [2009.06.17 12:28:46 | 000,157,968 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe PRC - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.10 23:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008.01.18 23:38:40 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.04.10 16:01:32 | 004,431,872 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2007.02.12 14:37:58 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.11.22 18:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe ========== Modules (SafeList) ========== MOD - [2010.08.26 23:34:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Bandit\Desktop\MFTools\OTL.exe MOD - [2009.09.25 04:10:10 | 000,974,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll MOD - [2009.04.10 23:28:26 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll MOD - [2009.04.10 23:28:24 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll MOD - [2009.04.10 23:28:24 | 000,228,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll MOD - [2009.04.10 23:28:20 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll MOD - [2009.04.10 23:28:20 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll MOD - [2009.04.10 23:27:48 | 000,241,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll MOD - [2009.04.10 23:21:40 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll MOD - [2008.01.18 23:36:42 | 000,080,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\thumbcache.dll MOD - [2008.01.18 23:34:08 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll MOD - [2008.01.18 23:33:44 | 000,326,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\actxprxy.dll MOD - [2008.01.18 23:33:02 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.26 22:57:00 | 003,822,544 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc) SRV - [2010.01.12 16:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.22 15:21:58 | 000,304,592 | ---- | M] () [Auto | Running] -- C:\Programme\XSManager\WTGService.exe -- (WTGService) SRV - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Running] -- C:\Windows\service4g.exe -- (XS Stick Service) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive) DRV - [2010.05.31 20:58:33 | 006,638,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2009.09.23 10:41:58 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2009.04.10 21:42:56 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB-Audiotreiber (WDM) DRV - [2008.10.31 16:19:38 | 000,103,424 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\cmnsusbser.sys -- (cmnsusbser) DRV - [2007.10.11 23:13:16 | 003,155,456 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.04.10 19:05:38 | 001,764,960 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.02.12 14:36:54 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2007.01.08 13:38:30 | 000,046,592 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2007.01.05 22:59:34 | 000,086,096 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce(tm) DRV - [2006.11.22 18:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.02 11:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2006.11.02 11:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2006.11.02 11:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2006.11.02 11:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2006.11.02 11:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2006.11.02 11:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2006.11.02 11:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2006.11.02 11:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006.11.02 11:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006.11.02 11:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2006.11.02 11:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2006.11.02 11:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2) DRV - [2006.11.02 11:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2006.11.02 11:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006.11.02 11:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006.11.02 11:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006.11.02 11:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2006.11.02 11:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2006.11.02 11:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2006.11.02 11:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006.11.02 09:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2006.11.02 09:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R) DRV - [2006.11.02 09:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2005.05.26 11:01:18 | 000,021,344 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://internetbanking.gad.de/ptlweb/WebPortal?bankid=2624 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.08.04 19:15:18 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.27 09:19:27 | 000,000,000 | ---D | M] [2010.07.23 15:34:52 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\mozilla\Extensions [2010.08.26 16:19:11 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions [2010.08.04 19:15:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.08.16 18:17:32 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.08.16 16:38:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.07.23 15:36:05 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.07.23 15:33:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.07.23 15:36:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.06.22 04:36:30 | 000,423,656 | ---- | M] (Oracle) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.07.14 00:04:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.07.14 00:04:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.07.14 00:04:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.07.14 00:04:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.07.14 00:04:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Oracle) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Bandit\Documents\871_album_1251454322.jpg O24 - Desktop BackupWallPaper: C:\Users\Bandit\Documents\871_album_1251454322.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{71183a3f-5b77-11df-99cf-00030d8767d8}\Shell\AutoRun\command - "" = H:\setupSNK.exe -- File not found O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\AutoRun\command - "" = ba.exe O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\open\Command - "" = ba.exe O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = F:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = F:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = G:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = G:\mb9x.exe -- File not found O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell - "" = AutoRun O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - State: "startup" - 0 MsConfig - State: "bootini" - 2 Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 90 Days ========== [2010.08.27 00:27:43 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2010.08.26 23:39:45 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\Malwarebytes [2010.08.26 23:39:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.08.26 23:39:29 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.08.26 23:39:29 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.08.26 23:39:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.08.26 23:37:27 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT [2010.08.26 23:34:07 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\MFTools [2010.08.26 22:22:02 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.08.26 16:20:17 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET [2010.08.26 16:02:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices [2010.08.22 02:33:06 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\Sneid [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES [2010.08.21 15:55:24 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2010.08.20 16:51:09 | 000,000,000 | ---D | C] -- C:\PerfLogs [2010.08.20 15:38:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2010.08.19 18:50:33 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Local\Google [2010.08.18 20:50:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.08.18 20:49:41 | 000,000,000 | ---D | C] -- C:\Programme\MSECache [2010.08.18 19:03:27 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\PC [2010.08.16 16:38:21 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers [2010.08.16 16:38:12 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Documents\DVDVideoSoft [2010.08.16 16:37:59 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft [2010.08.16 16:37:59 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DVDVideoSoft [2010.07.23 15:47:47 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0 [2010.07.23 15:36:13 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.07.23 15:36:04 | 000,153,376 | ---- | C] (Oracle) -- C:\Windows\System32\javaws.exe [2010.07.23 15:36:04 | 000,145,184 | ---- | C] (Oracle) -- C:\Windows\System32\javaw.exe [2010.07.23 15:36:04 | 000,145,184 | ---- | C] (Oracle) -- C:\Windows\System32\java.exe [2010.07.23 15:34:27 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.07.23 15:34:15 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Local\Mozilla [2010.07.23 15:33:49 | 000,423,656 | ---- | C] (Oracle) -- C:\Windows\System32\deployJava1.dll [2010.07.23 15:33:09 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2010.06.25 23:39:52 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\XSManager [2010.06.25 23:39:41 | 000,157,968 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe [2010.06.25 23:39:41 | 000,125,200 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe [2010.06.25 23:35:41 | 000,103,424 | ---- | C] (Mobile Connector) -- C:\Windows\System32\drivers\cmnsusbser.sys [2010.06.25 23:35:40 | 000,000,000 | ---D | C] -- C:\Programme\XSManager [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 90 Days ========== [2010.08.27 00:31:37 | 001,835,008 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat [2010.08.27 00:31:37 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job [2010.08.27 00:27:50 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.27 00:27:50 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.27 00:27:45 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.27 00:27:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.27 00:27:37 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys [2010.08.27 00:27:29 | 437,644,091 | ---- | M] () -- C:\Windows\MEMORY.DMP [2010.08.26 23:52:25 | 000,000,000 | ---- | M] () -- C:\Users\Bandit\defogger_reenable [2010.08.26 23:49:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000UA.job [2010.08.26 23:39:32 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.26 23:37:27 | 000,000,733 | ---- | M] () -- C:\Users\Bandit\Desktop\NTREGOPT.lnk [2010.08.26 23:37:27 | 000,000,714 | ---- | M] () -- C:\Users\Bandit\Desktop\ERUNT.lnk [2010.08.26 23:36:42 | 001,472,290 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.08.26 23:36:42 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.08.26 23:36:42 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.08.26 23:36:42 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.08.26 23:36:42 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.08.26 23:34:36 | 000,050,477 | ---- | M] () -- C:\Users\Bandit\Desktop\defogger.exe [2010.08.26 23:34:16 | 000,284,915 | ---- | M] () -- C:\Users\Bandit\Desktop\Gmer.zip [2010.08.26 23:30:10 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:30:10 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TM.blf [2010.08.26 23:25:51 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 23:10:07 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:10:07 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TM.blf [2010.08.26 22:33:19 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 22:22:09 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 22:22:09 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.08.26 19:15:08 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.08.26 17:49:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000Core.job [2010.08.26 17:45:57 | 000,002,047 | ---- | M] () -- C:\Users\Bandit\Desktop\Google Chrome.lnk [2010.08.26 16:01:57 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2010.08.26 16:01:46 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2010.08.21 16:02:39 | 000,232,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.08.21 15:57:40 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf [2010.08.21 14:27:00 | 000,032,897 | ---- | M] () -- C:\Users\Bandit\Documents\871_album_1251454322.jpg [2010.08.21 13:21:22 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2010.08.20 16:58:19 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest [2010.08.20 16:43:43 | 000,101,888 | ---- | M] (Infineon Technologies AG) -- C:\Windows\System32\ifxcardm.dll [2010.08.20 16:43:37 | 000,082,432 | ---- | M] (Gemalto, Inc.) -- C:\Windows\System32\axaltocm.dll [2010.08.20 16:35:23 | 000,196,608 | ---- | M] () -- C:\Windows\SPInstall.etl [2010.08.19 13:34:28 | 000,018,944 | ---- | M] () -- C:\Users\Bandit\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.08.16 16:38:19 | 000,001,032 | ---- | M] () -- C:\Users\Bandit\Desktop\DVDVideoSoft Free Studio.lnk [2010.07.23 18:11:30 | 000,001,820 | ---- | M] () -- C:\Windows\System32\rasctrnm.h [2010.07.23 16:01:14 | 000,051,040 | ---- | M] () -- C:\Users\Bandit\AppData\Local\GDIPFONTCACHEV1.DAT [2010.07.23 15:54:16 | 034,668,544 | ---- | M] () -- C:\Windows\ocsetup_install_NetFx3.etl [2010.07.23 15:54:16 | 000,327,680 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.perf [2010.07.23 15:54:16 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.dpx [2010.07.23 15:33:20 | 000,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.06.25 23:35:44 | 000,001,712 | ---- | M] () -- C:\Users\Public\Desktop\XSManager.lnk [2010.06.22 04:36:38 | 000,153,376 | ---- | M] (Oracle) -- C:\Windows\System32\javaws.exe [2010.06.22 04:36:37 | 000,145,184 | ---- | M] (Oracle) -- C:\Windows\System32\javaw.exe [2010.06.22 04:36:36 | 000,145,184 | ---- | M] (Oracle) -- C:\Windows\System32\java.exe [2010.06.22 04:36:29 | 000,423,656 | ---- | M] (Oracle) -- C:\Windows\System32\deployJava1.dll [2010.06.03 15:16:32 | 000,000,680 | ---- | M] () -- C:\Users\Bandit\AppData\Local\d3d9caps.dat [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.08.27 00:27:29 | 437,644,091 | ---- | C] () -- C:\Windows\MEMORY.DMP [2010.08.26 23:58:15 | 000,293,376 | ---- | C] () -- C:\Users\Bandit\Desktop\gmer.exe [2010.08.26 23:52:25 | 000,000,000 | ---- | C] () -- C:\Users\Bandit\defogger_reenable [2010.08.26 23:39:32 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.26 23:37:27 | 000,000,733 | ---- | C] () -- C:\Users\Bandit\Desktop\NTREGOPT.lnk [2010.08.26 23:37:27 | 000,000,714 | ---- | C] () -- C:\Users\Bandit\Desktop\ERUNT.lnk [2010.08.26 23:34:36 | 000,050,477 | ---- | C] () -- C:\Users\Bandit\Desktop\defogger.exe [2010.08.26 23:34:15 | 000,284,915 | ---- | C] () -- C:\Users\Bandit\Desktop\Gmer.zip [2010.08.26 23:30:41 | 3219,578,880 | -HS- | C] () -- C:\hiberfil.sys [2010.08.26 23:20:54 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 23:20:54 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:20:54 | 000,065,536 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TM.blf [2010.08.26 22:33:19 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 22:33:19 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 22:33:19 | 000,065,536 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TM.blf [2010.08.26 17:45:57 | 000,002,047 | ---- | C] () -- C:\Users\Bandit\Desktop\Google Chrome.lnk [2010.08.26 17:44:36 | 000,001,122 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000UA.job [2010.08.26 17:44:35 | 000,001,070 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000Core.job [2010.08.26 16:08:26 | 000,000,428 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job [2010.08.26 16:01:57 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2010.08.26 16:01:46 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2010.08.21 15:57:40 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf [2010.08.21 15:42:56 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf [2010.08.21 15:42:55 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml [2010.08.21 15:42:55 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml [2010.08.21 15:42:46 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf [2010.08.21 15:42:46 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.08.21 15:42:45 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf [2010.08.21 15:42:19 | 003,662,128 | ---- | C] () -- C:\Windows\System32\locale.nls [2010.08.21 15:42:10 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF [2010.08.21 15:41:32 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.08.21 15:41:29 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs [2010.08.21 15:41:27 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man [2010.08.21 15:41:26 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd [2010.08.21 14:27:00 | 000,032,897 | ---- | C] () -- C:\Users\Bandit\Documents\871_album_1251454322.jpg [2010.08.21 13:21:22 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2010.08.21 11:51:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.08.21 11:51:39 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex [2010.08.20 16:21:15 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf [2010.08.20 16:20:30 | 000,145,455 | ---- | C] () -- C:\Windows\System32\perfmon.msc [2010.08.20 16:19:50 | 000,144,909 | ---- | C] () -- C:\Windows\System32\fsmgmt.msc [2010.08.20 16:19:49 | 000,012,198 | ---- | C] () -- C:\Windows\System32\gatherWiredInfo.vbs [2010.08.20 16:19:47 | 000,195,122 | ---- | C] () -- C:\Windows\System32\winrm.vbs [2010.08.20 16:17:36 | 000,196,608 | ---- | C] () -- C:\Windows\SPInstall.etl [2010.08.16 16:38:13 | 000,001,032 | ---- | C] () -- C:\Users\Bandit\Desktop\DVDVideoSoft Free Studio.lnk [2010.08.03 16:41:17 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2010.07.24 20:24:28 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.07.23 18:11:30 | 000,001,820 | ---- | C] () -- C:\Windows\System32\rasctrnm.h [2010.07.23 15:33:20 | 000,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.06.25 23:35:44 | 000,001,712 | ---- | C] () -- C:\Users\Public\Desktop\XSManager.lnk [2010.05.15 20:33:58 | 000,000,094 | ---- | C] () -- C:\Users\Bandit\AppData\Local\fusioncache.dat [2010.02.28 15:55:14 | 000,000,128 | ---- | C] () -- C:\Users\Bandit\AppData\Roaming\default.rss [2010.02.12 01:18:18 | 000,018,944 | ---- | C] () -- C:\Users\Bandit\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.02.08 23:03:30 | 000,000,552 | ---- | C] () -- C:\Users\Bandit\AppData\Local\d3d8caps.dat [2010.02.08 23:02:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.02.08 22:43:32 | 000,000,680 | ---- | C] () -- C:\Users\Bandit\AppData\Local\d3d9caps.dat [2007.10.11 23:02:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== LOP Check ========== [2010.08.16 16:38:21 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers [2010.07.25 18:15:08 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\Farm Mania 2 [2010.03.31 07:58:51 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\MastersOfMystery2 [2010.02.09 19:24:19 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\TeamViewer [2010.03.03 12:15:17 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\uTorrent [2010.06.26 00:55:29 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\XSManager [2010.04.23 10:27:43 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\Zylom [2010.08.26 19:24:22 | 000,032,642 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.08.27 00:31:37 | 000,000,428 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.10 23:36:38 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2010.02.09 07:29:08 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2010.08.27 00:27:37 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys [2010.04.06 08:49:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2010.04.06 08:49:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.08.27 00:27:36 | 3533,381,632 | -HS- | M] () -- C:\pagefile.sys [2010.02.08 23:09:37 | 000,000,420 | ---- | M] () -- C:\RHDSetup.log [1 C:\*.tmp files -> C:\*.tmp -> ] < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2010.08.21 15:52:36 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2010.08.20 16:58:19 | 000,000,174 | -HS- | M] () -- C:\Programme\desktop.ini < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2007.10.11 23:02:10 | 000,356,352 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll [2009.04.10 23:27:48 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.10 23:28:24 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\user32.dll /md5 > [2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.01.18 23:37:10 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-26 15:45:36 < End of report > OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.08.2010 00:31:40 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\Bandit\Desktop\MFTools Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18943) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 74,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 4,53 Gb Free Space | 9,27% Space Free | Partition Type: NTFS Drive D: | 237,46 Gb Total Space | 233,02 Gb Free Space | 98,13% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BANDIT-PC Current User Name: Bandit Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.08.26 23:34:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Bandit\Desktop\MFTools\OTL.exe PRC - [2010.08.26 17:44:33 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\Bandit\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe PRC - [2010.01.12 16:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe PRC - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.07.26 17:44:14 | 003,883,840 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe PRC - [2009.06.22 15:21:58 | 000,304,592 | ---- | M] () -- C:\Programme\XSManager\WTGService.exe PRC - [2009.06.17 12:28:46 | 000,157,968 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe PRC - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.10 23:27:30 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008.01.18 23:38:40 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.04.10 16:01:32 | 004,431,872 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2007.02.12 14:37:58 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.11.22 18:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe ========== Modules (SafeList) ========== MOD - [2010.08.26 23:34:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Bandit\Desktop\MFTools\OTL.exe MOD - [2009.09.25 04:10:10 | 000,974,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll MOD - [2009.04.10 23:28:26 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll MOD - [2009.04.10 23:28:24 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll MOD - [2009.04.10 23:28:24 | 000,228,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll MOD - [2009.04.10 23:28:20 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll MOD - [2009.04.10 23:28:20 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll MOD - [2009.04.10 23:27:48 | 000,241,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll MOD - [2009.04.10 23:21:40 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll MOD - [2008.01.18 23:36:42 | 000,080,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\thumbcache.dll MOD - [2008.01.18 23:34:08 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll MOD - [2008.01.18 23:33:44 | 000,326,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\actxprxy.dll MOD - [2008.01.18 23:33:02 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.26 22:57:00 | 003,822,544 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc) SRV - [2010.01.12 16:57:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009.09.23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.22 15:21:58 | 000,304,592 | ---- | M] () [Auto | Running] -- C:\Programme\XSManager\WTGService.exe -- (WTGService) SRV - [2009.06.17 12:28:08 | 000,125,200 | R--- | M] (4G Systems GmbH & Co. KG) [Auto | Running] -- C:\Windows\service4g.exe -- (XS Stick Service) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive) DRV - [2010.05.31 20:58:33 | 006,638,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2009.09.23 10:41:58 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2009.04.10 21:42:56 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB-Audiotreiber (WDM) DRV - [2008.10.31 16:19:38 | 000,103,424 | ---- | M] (Mobile Connector) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\cmnsusbser.sys -- (cmnsusbser) DRV - [2007.10.11 23:13:16 | 003,155,456 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.04.10 19:05:38 | 001,764,960 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.02.12 14:36:54 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2007.01.08 13:38:30 | 000,046,592 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2007.01.05 22:59:34 | 000,086,096 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) NVIDIA nForce(tm) DRV - [2006.11.22 18:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.02 11:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2006.11.02 11:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2006.11.02 11:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2006.11.02 11:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2006.11.02 11:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2006.11.02 11:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2006.11.02 11:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2006.11.02 11:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006.11.02 11:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006.11.02 11:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2006.11.02 11:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2006.11.02 11:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2) DRV - [2006.11.02 11:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2006.11.02 11:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006.11.02 11:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006.11.02 11:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006.11.02 11:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2006.11.02 11:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2006.11.02 11:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2006.11.02 11:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006.11.02 09:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2006.11.02 09:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R) DRV - [2006.11.02 09:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2005.05.26 11:01:18 | 000,021,344 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://internetbanking.gad.de/ptlweb/WebPortal?bankid=2624 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.08.04 19:15:18 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.27 09:19:27 | 000,000,000 | ---D | M] [2010.07.23 15:34:52 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\mozilla\Extensions [2010.08.26 16:19:11 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions [2010.08.04 19:15:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.08.16 18:17:32 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.08.16 16:38:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bandit\AppData\Roaming\mozilla\Firefox\Profiles\50k6sye7.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.07.23 15:36:05 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.07.23 15:33:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.07.23 15:36:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.06.22 04:36:30 | 000,423,656 | ---- | M] (Oracle) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.07.14 00:04:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.07.14 00:04:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.07.14 00:04:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.07.14 00:04:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.07.14 00:04:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Oracle) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe File not found O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Bandit\Documents\871_album_1251454322.jpg O24 - Desktop BackupWallPaper: C:\Users\Bandit\Documents\871_album_1251454322.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{71183a3f-5b77-11df-99cf-00030d8767d8}\Shell\AutoRun\command - "" = H:\setupSNK.exe -- File not found O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\AutoRun\command - "" = ba.exe O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\open\Command - "" = ba.exe O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = F:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = F:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = G:\mb9x.exe -- File not found O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = G:\mb9x.exe -- File not found O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell - "" = AutoRun O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - State: "startup" - 0 MsConfig - State: "bootini" - 2 Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: aux7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave4 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave5 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave6 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave7 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 90 Days ========== [2010.08.27 00:27:43 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2010.08.26 23:39:45 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\Malwarebytes [2010.08.26 23:39:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.08.26 23:39:29 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.08.26 23:39:29 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.08.26 23:39:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.08.26 23:37:27 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT [2010.08.26 23:34:07 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\MFTools [2010.08.26 22:22:02 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.08.26 16:20:17 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET [2010.08.26 16:02:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices [2010.08.22 02:33:06 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\Sneid [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES [2010.08.21 15:59:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES [2010.08.21 15:55:24 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2010.08.20 16:51:09 | 000,000,000 | ---D | C] -- C:\PerfLogs [2010.08.20 15:38:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2010.08.19 18:50:33 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Local\Google [2010.08.18 20:50:28 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.08.18 20:49:41 | 000,000,000 | ---D | C] -- C:\Programme\MSECache [2010.08.18 19:03:27 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Desktop\PC [2010.08.16 16:38:21 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers [2010.08.16 16:38:12 | 000,000,000 | ---D | C] -- C:\Users\Bandit\Documents\DVDVideoSoft [2010.08.16 16:37:59 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft [2010.08.16 16:37:59 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DVDVideoSoft [2010.07.23 15:47:47 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0 [2010.07.23 15:36:13 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.07.23 15:36:04 | 000,153,376 | ---- | C] (Oracle) -- C:\Windows\System32\javaws.exe [2010.07.23 15:36:04 | 000,145,184 | ---- | C] (Oracle) -- C:\Windows\System32\javaw.exe [2010.07.23 15:36:04 | 000,145,184 | ---- | C] (Oracle) -- C:\Windows\System32\java.exe [2010.07.23 15:34:27 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.07.23 15:34:15 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Local\Mozilla [2010.07.23 15:33:49 | 000,423,656 | ---- | C] (Oracle) -- C:\Windows\System32\deployJava1.dll [2010.07.23 15:33:09 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2010.06.25 23:39:52 | 000,000,000 | ---D | C] -- C:\Users\Bandit\AppData\Roaming\XSManager [2010.06.25 23:39:41 | 000,157,968 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\Windows\starter4g.exe [2010.06.25 23:39:41 | 000,125,200 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\Windows\service4g.exe [2010.06.25 23:35:41 | 000,103,424 | ---- | C] (Mobile Connector) -- C:\Windows\System32\drivers\cmnsusbser.sys [2010.06.25 23:35:40 | 000,000,000 | ---D | C] -- C:\Programme\XSManager [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 90 Days ========== [2010.08.27 00:31:37 | 001,835,008 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat [2010.08.27 00:31:37 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job [2010.08.27 00:27:50 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.27 00:27:50 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.27 00:27:45 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.27 00:27:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.27 00:27:37 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys [2010.08.27 00:27:29 | 437,644,091 | ---- | M] () -- C:\Windows\MEMORY.DMP [2010.08.26 23:52:25 | 000,000,000 | ---- | M] () -- C:\Users\Bandit\defogger_reenable [2010.08.26 23:49:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000UA.job [2010.08.26 23:39:32 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.26 23:37:27 | 000,000,733 | ---- | M] () -- C:\Users\Bandit\Desktop\NTREGOPT.lnk [2010.08.26 23:37:27 | 000,000,714 | ---- | M] () -- C:\Users\Bandit\Desktop\ERUNT.lnk [2010.08.26 23:36:42 | 001,472,290 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.08.26 23:36:42 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.08.26 23:36:42 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.08.26 23:36:42 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.08.26 23:36:42 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.08.26 23:34:36 | 000,050,477 | ---- | M] () -- C:\Users\Bandit\Desktop\defogger.exe [2010.08.26 23:34:16 | 000,284,915 | ---- | M] () -- C:\Users\Bandit\Desktop\Gmer.zip [2010.08.26 23:30:10 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:30:10 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TM.blf [2010.08.26 23:25:51 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 23:10:07 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:10:07 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TM.blf [2010.08.26 22:33:19 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 22:22:09 | 000,524,288 | -HS- | M] () -- C:\Users\Bandit\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 22:22:09 | 000,065,536 | -HS- | M] () -- C:\Users\Bandit\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.08.26 19:15:08 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.08.26 17:49:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000Core.job [2010.08.26 17:45:57 | 000,002,047 | ---- | M] () -- C:\Users\Bandit\Desktop\Google Chrome.lnk [2010.08.26 16:01:57 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2010.08.26 16:01:46 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2010.08.21 16:02:39 | 000,232,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.08.21 15:57:40 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf [2010.08.21 14:27:00 | 000,032,897 | ---- | M] () -- C:\Users\Bandit\Documents\871_album_1251454322.jpg [2010.08.21 13:21:22 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2010.08.20 16:58:19 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest [2010.08.20 16:43:43 | 000,101,888 | ---- | M] (Infineon Technologies AG) -- C:\Windows\System32\ifxcardm.dll [2010.08.20 16:43:37 | 000,082,432 | ---- | M] (Gemalto, Inc.) -- C:\Windows\System32\axaltocm.dll [2010.08.20 16:35:23 | 000,196,608 | ---- | M] () -- C:\Windows\SPInstall.etl [2010.08.19 13:34:28 | 000,018,944 | ---- | M] () -- C:\Users\Bandit\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.08.16 16:38:19 | 000,001,032 | ---- | M] () -- C:\Users\Bandit\Desktop\DVDVideoSoft Free Studio.lnk [2010.07.23 18:11:30 | 000,001,820 | ---- | M] () -- C:\Windows\System32\rasctrnm.h [2010.07.23 16:01:14 | 000,051,040 | ---- | M] () -- C:\Users\Bandit\AppData\Local\GDIPFONTCACHEV1.DAT [2010.07.23 15:54:16 | 034,668,544 | ---- | M] () -- C:\Windows\ocsetup_install_NetFx3.etl [2010.07.23 15:54:16 | 000,327,680 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.perf [2010.07.23 15:54:16 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_NetFx3.dpx [2010.07.23 15:33:20 | 000,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.06.25 23:35:44 | 000,001,712 | ---- | M] () -- C:\Users\Public\Desktop\XSManager.lnk [2010.06.22 04:36:38 | 000,153,376 | ---- | M] (Oracle) -- C:\Windows\System32\javaws.exe [2010.06.22 04:36:37 | 000,145,184 | ---- | M] (Oracle) -- C:\Windows\System32\javaw.exe [2010.06.22 04:36:36 | 000,145,184 | ---- | M] (Oracle) -- C:\Windows\System32\java.exe [2010.06.22 04:36:29 | 000,423,656 | ---- | M] (Oracle) -- C:\Windows\System32\deployJava1.dll [2010.06.03 15:16:32 | 000,000,680 | ---- | M] () -- C:\Users\Bandit\AppData\Local\d3d9caps.dat [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.08.27 00:27:29 | 437,644,091 | ---- | C] () -- C:\Windows\MEMORY.DMP [2010.08.26 23:58:15 | 000,293,376 | ---- | C] () -- C:\Users\Bandit\Desktop\gmer.exe [2010.08.26 23:52:25 | 000,000,000 | ---- | C] () -- C:\Users\Bandit\defogger_reenable [2010.08.26 23:39:32 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.08.26 23:37:27 | 000,000,733 | ---- | C] () -- C:\Users\Bandit\Desktop\NTREGOPT.lnk [2010.08.26 23:37:27 | 000,000,714 | ---- | C] () -- C:\Users\Bandit\Desktop\ERUNT.lnk [2010.08.26 23:34:36 | 000,050,477 | ---- | C] () -- C:\Users\Bandit\Desktop\defogger.exe [2010.08.26 23:34:15 | 000,284,915 | ---- | C] () -- C:\Users\Bandit\Desktop\Gmer.zip [2010.08.26 23:30:41 | 3219,578,880 | -HS- | C] () -- C:\hiberfil.sys [2010.08.26 23:20:54 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 23:20:54 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 23:20:54 | 000,065,536 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{be628ad0-b157-11df-a411-001cbf5d7b06}.TM.blf [2010.08.26 22:33:19 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000002.regtrans-ms [2010.08.26 22:33:19 | 000,524,288 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TMContainer00000000000000000001.regtrans-ms [2010.08.26 22:33:19 | 000,065,536 | -HS- | C] () -- C:\Users\Bandit\ntuser.dat{18a9bbef-b151-11df-b74b-001cbf5d7b06}.TM.blf [2010.08.26 17:45:57 | 000,002,047 | ---- | C] () -- C:\Users\Bandit\Desktop\Google Chrome.lnk [2010.08.26 17:44:36 | 000,001,122 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000UA.job [2010.08.26 17:44:35 | 000,001,070 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000Core.job [2010.08.26 16:08:26 | 000,000,428 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job [2010.08.26 16:01:57 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf [2010.08.26 16:01:46 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2010.08.21 15:57:40 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf [2010.08.21 15:42:56 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf [2010.08.21 15:42:55 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml [2010.08.21 15:42:55 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml [2010.08.21 15:42:46 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf [2010.08.21 15:42:46 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.08.21 15:42:45 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf [2010.08.21 15:42:19 | 003,662,128 | ---- | C] () -- C:\Windows\System32\locale.nls [2010.08.21 15:42:10 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF [2010.08.21 15:41:32 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.08.21 15:41:29 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs [2010.08.21 15:41:27 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man [2010.08.21 15:41:26 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd [2010.08.21 14:27:00 | 000,032,897 | ---- | C] () -- C:\Users\Bandit\Documents\871_album_1251454322.jpg [2010.08.21 13:21:22 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf [2010.08.21 11:51:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.08.21 11:51:39 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex [2010.08.20 16:21:15 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf [2010.08.20 16:20:30 | 000,145,455 | ---- | C] () -- C:\Windows\System32\perfmon.msc [2010.08.20 16:19:50 | 000,144,909 | ---- | C] () -- C:\Windows\System32\fsmgmt.msc [2010.08.20 16:19:49 | 000,012,198 | ---- | C] () -- C:\Windows\System32\gatherWiredInfo.vbs [2010.08.20 16:19:47 | 000,195,122 | ---- | C] () -- C:\Windows\System32\winrm.vbs [2010.08.20 16:17:36 | 000,196,608 | ---- | C] () -- C:\Windows\SPInstall.etl [2010.08.16 16:38:13 | 000,001,032 | ---- | C] () -- C:\Users\Bandit\Desktop\DVDVideoSoft Free Studio.lnk [2010.08.03 16:41:17 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2010.07.24 20:24:28 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.07.23 18:11:30 | 000,001,820 | ---- | C] () -- C:\Windows\System32\rasctrnm.h [2010.07.23 15:33:20 | 000,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.06.25 23:35:44 | 000,001,712 | ---- | C] () -- C:\Users\Public\Desktop\XSManager.lnk [2010.05.15 20:33:58 | 000,000,094 | ---- | C] () -- C:\Users\Bandit\AppData\Local\fusioncache.dat [2010.02.28 15:55:14 | 000,000,128 | ---- | C] () -- C:\Users\Bandit\AppData\Roaming\default.rss [2010.02.12 01:18:18 | 000,018,944 | ---- | C] () -- C:\Users\Bandit\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.02.08 23:03:30 | 000,000,552 | ---- | C] () -- C:\Users\Bandit\AppData\Local\d3d8caps.dat [2010.02.08 23:02:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.02.08 22:43:32 | 000,000,680 | ---- | C] () -- C:\Users\Bandit\AppData\Local\d3d9caps.dat [2007.10.11 23:02:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== LOP Check ========== [2010.08.16 16:38:21 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers [2010.07.25 18:15:08 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\Farm Mania 2 [2010.03.31 07:58:51 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\MastersOfMystery2 [2010.02.09 19:24:19 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\TeamViewer [2010.03.03 12:15:17 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\uTorrent [2010.06.26 00:55:29 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\XSManager [2010.04.23 10:27:43 | 000,000,000 | ---D | M] -- C:\Users\Bandit\AppData\Roaming\Zylom [2010.08.26 19:24:22 | 000,032,642 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.08.27 00:31:37 | 000,000,428 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.10 23:36:38 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2010.02.09 07:29:08 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2010.08.27 00:27:37 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys [2010.04.06 08:49:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2010.04.06 08:49:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.08.27 00:27:36 | 3533,381,632 | -HS- | M] () -- C:\pagefile.sys [2010.02.08 23:09:37 | 000,000,420 | ---- | M] () -- C:\RHDSetup.log [1 C:\*.tmp files -> C:\*.tmp -> ] < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2010.08.21 15:52:36 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2010.08.20 16:58:19 | 000,000,174 | -HS- | M] () -- C:\Programme\desktop.ini < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2007.10.11 23:02:10 | 000,356,352 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll [2009.04.10 23:27:48 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.10 23:28:24 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\user32.dll /md5 > [2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.01.18 23:37:10 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-26 15:45:36 < End of report > OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 27.08.2010 00:31:40 - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\Bandit\Desktop\MFTools
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 74,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 4,53 Gb Free Space | 9,27% Space Free | Partition Type: NTFS
Drive D: | 237,46 Gb Total Space | 233,02 Gb Free Space | 98,13% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: BANDIT-PC
Current User Name: Bandit
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Users\Bandit\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B9A17BFB-8249-4F19-B5E9-173C775B80F0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{F28B6543-3E3E-4BD4-9F91-7A4C12B5AF6F}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2CAFDCAC-AD48-4FE6-9466-649FF3F28474}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{4FC6293E-B466-47F0-8EE7-1CA537664025}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{60463E2C-7F55-4415-B295-EC762E35A602}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"TCP Query User{13A38BA3-3D94-4C03-8C62-FCAC3D9223EF}C:\program files\metin2_germany\metin2client.bin" = protocol=6 | dir=in | app=c:\program files\metin2_germany\metin2client.bin |
"TCP Query User{199ECE15-2995-4E49-A349-42603F263AD9}C:\users\bandit\downloads\aeromt2\aeromt2_de.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2_de.exe |
"TCP Query User{1BE3B3E9-1F9A-4714-B656-E57CB849D462}C:\users\bandit\desktop\aeromt2\aeromt2_de.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2_de.exe |
"TCP Query User{207D7B47-5EFC-4822-A667-24CAC01B44C1}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 starter.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 starter.exe |
"TCP Query User{23DF8813-B1D7-4A09-BF09-225B75FE17DC}C:\program files\metin2_germany\metin2client.bin" = protocol=6 | dir=in | app=c:\program files\metin2_germany\metin2client.bin |
"TCP Query User{41BC6F07-3F80-4283-8800-DEAEF72B355D}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{4906FFC1-64EC-4174-BCBC-724A4B268DC9}C:\users\bandit\downloads\aeromt2\aeromt2 starter.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2 starter.exe |
"TCP Query User{4D167C8C-B843-4ADE-BEF2-FA331AC34558}C:\program files\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"TCP Query User{55A8B480-7A70-41B2-9499-D84D0F19BF70}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2_de.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2_de.exe |
"TCP Query User{5C66D6FA-77EE-481A-B20A-1903AC6BC835}C:\users\bandit\downloads\aeromt2\metin2.bin" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2\metin2.bin |
"TCP Query User{6B7DDBF0-E0BE-4288-9AD7-528CA979524A}C:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe |
"TCP Query User{84199CA1-416A-43F5-B172-0E2F4EEE438F}C:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe |
"TCP Query User{8CB25526-6AE1-47D6-876D-D6E85237C08A}C:\users\bandit\desktop\aeromt2 - kopie (2)\aeromt2 reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2 - kopie (2)\aeromt2 reloaded.exe |
"TCP Query User{A321148B-C6A6-4ABF-A154-14108D0D6AC1}D:\aeromt2\metin2.bin" = protocol=6 | dir=in | app=d:\aeromt2\metin2.bin |
"TCP Query User{A32BAA99-DFFD-42CD-AFE9-3E1492D7DB3B}C:\program files\metin2_germany\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2_germany\metin2.bin |
"TCP Query User{A634D280-55B8-4E52-B4E6-CA9EFCEF1EF9}C:\program files\bittorrent++\bt++.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent++\bt++.exe |
"TCP Query User{A78975C8-97B4-4A45-9B60-4952965B8113}C:\users\bandit\downloads\aeromt2\aeromt2 reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2 reloaded.exe |
"TCP Query User{B068EA0F-AA44-4CB5-85D5-D57AA8678F51}D:\aeromt2\aeromt2_de.exe" = protocol=6 | dir=in | app=d:\aeromt2\aeromt2_de.exe |
"TCP Query User{B36E13FB-F413-4541-9DFC-F117A8535F8E}C:\users\bandit\desktop\aeromt2\aeromt2 starter.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 starter.exe |
"TCP Query User{B4A32BC1-A3AA-457E-910E-3A7197D04066}C:\users\bandit\desktop\xtrememt2\metin2client.bin" = protocol=6 | dir=in | app=c:\users\bandit\desktop\xtrememt2\metin2client.bin |
"TCP Query User{C2853A17-2B54-4E8D-852E-B4A3D639B868}C:\users\bandit\desktop\xtrememt2\xtrememt2.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\xtrememt2\xtrememt2.exe |
"TCP Query User{C876FE62-DDE7-4D06-B90E-606326035862}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 reloaded.exe |
"TCP Query User{D28E5BF9-E72B-4C41-A038-897F52DF6B5E}C:\program files\metin2_germany\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2_germany\metin2.bin |
"TCP Query User{D5F6A72C-1688-405C-B14D-3A051910D1CD}C:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe |
"TCP Query User{DDD029F7-0A3A-4B11-B34E-56C0772A7375}C:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe |
"TCP Query User{E527E868-70E1-43B9-9CA4-40821ADAEBCA}C:\users\bandit\desktop\aeromt2\metin2.bin" = protocol=6 | dir=in | app=c:\users\bandit\desktop\aeromt2\metin2.bin |
"TCP Query User{FD9BA3B5-1D40-43B9-BB40-A4D5578C0BE4}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{081590AB-717A-4F71-8A57-54BC3FECC2B8}C:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe |
"UDP Query User{1DDF5570-4C2A-484F-A663-EFF7880B821D}C:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe |
"UDP Query User{335AB5EA-AF1D-476E-ADC4-C8BD46EDFE24}C:\users\bandit\desktop\xtrememt2\metin2client.bin" = protocol=17 | dir=in | app=c:\users\bandit\desktop\xtrememt2\metin2client.bin |
"UDP Query User{3A8C3555-1680-41DF-8A97-56925E2670F1}C:\users\bandit\downloads\aeromt2\aeromt2 starter.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2 starter.exe |
"UDP Query User{46D3E55E-EB20-4A1F-8DA6-699BCF2B2DC7}D:\aeromt2\aeromt2_de.exe" = protocol=17 | dir=in | app=d:\aeromt2\aeromt2_de.exe |
"UDP Query User{48A374EF-C9AB-46E8-B483-CE17E63BBA78}C:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\godmt2-reloaded\client\godmt2-reloaded.exe |
"UDP Query User{4EC6EBCA-819A-44BA-B5A0-8633E66F3929}C:\users\bandit\desktop\xtrememt2\xtrememt2.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\xtrememt2\xtrememt2.exe |
"UDP Query User{507E4DEF-E753-4993-8E17-FF7658C843EC}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{5EA5D51B-C156-4099-9726-77124AF4E442}C:\users\bandit\desktop\aeromt2\aeromt2 starter.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 starter.exe |
"UDP Query User{5F3F63BE-7D8D-4D12-828A-C5E0BE8A9E12}C:\program files\metin2_germany\metin2client.bin" = protocol=17 | dir=in | app=c:\program files\metin2_germany\metin2client.bin |
"UDP Query User{6CCB52EA-AFB9-434E-B66F-5B8B6921CB16}C:\program files\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"UDP Query User{761F4E47-6866-49DE-9AA7-53285EF6F738}C:\users\bandit\downloads\aeromt2\metin2.bin" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2\metin2.bin |
"UDP Query User{884B3A80-FF64-42ED-839F-1467593D10A3}C:\program files\metin2_germany\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2_germany\metin2.bin |
"UDP Query User{9239C4C1-B9BE-436D-B69C-D9E943013754}C:\program files\metin2_germany\metin2client.bin" = protocol=17 | dir=in | app=c:\program files\metin2_germany\metin2client.bin |
"UDP Query User{A394E204-905A-4510-B9D2-C92F1517BB2A}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 reloaded.exe |
"UDP Query User{A53C4223-02EC-4ACF-8473-C570A45E141E}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe |
"UDP Query User{BF546AF6-4B74-4C2E-8741-0E099AC364E7}C:\users\bandit\downloads\aeromt2\aeromt2_de.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2_de.exe |
"UDP Query User{C185D6FE-A29A-4B8E-AC37-216AA0FADFFC}C:\users\bandit\desktop\aeromt2\aeromt2_de.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2_de.exe |
"UDP Query User{C48B9053-E272-4BBC-8E49-726B96B93AFF}C:\users\bandit\downloads\aeromt2\aeromt2 reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2\aeromt2 reloaded.exe |
"UDP Query User{C5A4E9EF-92C9-4E85-BBE4-440196F5CE26}C:\users\bandit\desktop\aeromt2\metin2.bin" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2\metin2.bin |
"UDP Query User{CC593B89-94F4-4138-984E-14A5F26F1168}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 starter.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2 starter.exe |
"UDP Query User{D0DBAFA7-A590-45FE-ABC7-F6E47764D287}C:\program files\metin2_germany\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2_germany\metin2.bin |
"UDP Query User{F0B7DF23-5AF9-4710-8E3E-8CDEC8AC68F0}C:\users\bandit\desktop\aeromt2 - kopie (2)\aeromt2 reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2 - kopie (2)\aeromt2 reloaded.exe |
"UDP Query User{F29686E0-5392-4C76-ADDF-39DDBBC4A3D7}C:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe" = protocol=17 | dir=in | app=c:\users\bandit\desktop\aeromt2\aeromt2 reloaded.exe |
"UDP Query User{F6DB9C99-A72E-4295-936E-CDF4FAEBCBDB}C:\program files\bittorrent++\bt++.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent++\bt++.exe |
"UDP Query User{F99922F6-414A-404C-9272-D61FC9D85E06}D:\aeromt2\metin2.bin" = protocol=17 | dir=in | app=d:\aeromt2\metin2.bin |
"UDP Query User{FE8425AA-5DC7-47BA-95A1-A0016C3215BC}C:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2_de.exe" = protocol=17 | dir=in | app=c:\users\bandit\downloads\aeromt2 - kopie (2)\aeromt2_de.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{176B3593-72F1-459C-829C-5E9671E2CB35}" = GameSpy Comrade
"{1CD220E7-1512-A5E1-327F-9607587B75AD}" = Catalyst Control Center Graphics Light
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2334993e-3b34-4f55-8ec7-91420d5d0813}" = Nero 9 Trial
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 21
"{2AAC4085-DCBF-417B-AEBD-182197839240}" = Native Instruments Traktor
"{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode
"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E5948BC-A071-3C35-7DC4-31F5F293F35B}" = Catalyst Control Center Graphics Full New
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision
"{43EA3C14-C1F7-A093-1F4D-362A09F9A63B}" = CCC Help German
"{462F002C-0A03-6C5F-3475-228396D8F2AB}" = ccc-core-static
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner
"{6BB19E5E-2AD7-B464-3B80-FB0CD8C504FB}" = Catalyst Control Center Graphics Full Existing
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{7C379BEF-4E12-3224-B2E8-513363B99181}" = ccc-utility
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8AD67572-0AE2-0CAC-CD8B-17FBAC973901}" = ATI Catalyst Install Manager
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95ED7549-7C66-A618-3100-B6999F6A79A4}" = Catalyst Control Center Localization German
"{960EED1D-8F37-9EF5-C2F2-19C19983658B}" = Catalyst Control Center Core Implementation
"{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap
"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{ABC80104-036E-6193-566F-4308420A4005}" = Catalyst Control Center Graphics Previews Vista
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM
"{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime
"{DEE7AE5E-A8D1-05CF-5383-E5DC68486A54}" = Skins
"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ERUNT_is1" = ERUNT 1.1j
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Native Instruments Service Center" = Native Instruments Service Center
"Native Instruments Traktor" = Native Instruments Traktor
"SMSERIAL" = Motorola SM56 Data Fax Modem
"TeamViewer 5" = TeamViewer 5
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"XSManager" = XSManager
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Rainforest Adventure Deluxe" = Rainforest Adventure Deluxe
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 26.08.2010 15:46:12 | Computer Name = Bandit-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 26.08.2010 15:46:13 | Computer Name = Bandit-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 26.08.2010 15:46:13 | Computer Name = Bandit-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 26.08.2010 16:18:14 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
Error - 26.08.2010 16:20:22 | Computer Name = Bandit-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung chrome.exe, Version 0.0.0.0, Zeitstempel 0x4c6b2874,
fehlerhaftes Modul chrome.dll, Version 5.0.375.127, Zeitstempel 0x4c6b2835, Ausnahmecode
0x80000003, Fehleroffset 0x0039c80d, Prozess-ID 0x71c, Anwendungsstartzeit 01cb455c1b9c8b23.
Error - 26.08.2010 16:33:30 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
Error - 26.08.2010 17:06:14 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
Error - 26.08.2010 17:07:41 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
Error - 26.08.2010 17:09:10 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
Error - 26.08.2010 17:21:05 | Computer Name = Bandit-PC | Source = EventSystem | ID = 4609
Description =
[ System Events ]
Error - 26.08.2010 17:28:27 | Computer Name = Bandit-PC | Source = DCOM | ID = 10005
Description =
Error - 26.08.2010 17:28:35 | Computer Name = Bandit-PC | Source = DCOM | ID = 10005
Description =
Error - 26.08.2010 17:28:39 | Computer Name = Bandit-PC | Source = DCOM | ID = 10005
Description =
Error - 26.08.2010 17:28:40 | Computer Name = Bandit-PC | Source = DCOM | ID = 10005
Description =
Error - 26.08.2010 17:29:45 | Computer Name = Bandit-PC | Source = DCOM | ID = 10005
Description =
Error - 26.08.2010 17:29:51 | Computer Name = Bandit-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 26.08.2010 17:29:51 | Computer Name = Bandit-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 26.08.2010 17:32:25 | Computer Name = Bandit-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 26.08.2010 18:27:43 | Computer Name = Bandit-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 27.08.2010 um 00:25:54 unerwartet heruntergefahren.
Error - 26.08.2010 18:29:13 | Computer Name = Bandit-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Bitte sagt mir was weg kann und / oder ob es sinnvoll ist Neuinstallieren? Kaufe dann neu Vista da keine Sicherungs Cds oder soetwas gemacht wurden. |
|
27.08.2010, 08:32
| #2 |
  | Systemabsturz Vista, Explorer reagiert nicht Hi,
__________________neben einem Rookit (wahrscheinlich: IPINIP.SYS, Prevx) , Würmern auch Dein Freund: Code:
ATTFilter O33 - MountPoints2\{71183a3f-5b77-11df-99cf-00030d8767d8}\Shell\AutoRun\command - "" = H:\setupSNK.exe -- File not found
O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\AutoRun\command - "" = ba.exe
O33 - MountPoints2\{9f968770-3e3e-11df-bd03-00030d8767d8}\Shell\open\Command - "" = ba.exe
O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = F:\mb9x.exe -- File not found
O33 - MountPoints2\{d449a8b0-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = F:\mb9x.exe -- File not found
O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\AutoRun\command - "" = G:\mb9x.exe -- File not found
O33 - MountPoints2\{d449a8b6-2f36-11df-bdb2-00030d8767d8}\Shell\open\Command - "" = G:\mb9x.exe -- File not found
O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell - "" = AutoRun
O33 - MountPoints2\{fef7a8fc-8085-11df-9b8f-00030d8767d8}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
Combofix Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop. Antivierenlösung komplett auschalten und zwar so, dass sie sich auch nach einem Reboot NICHT einschaltet! Achtung: In einigen wenigen Fällen kann es vorkommen, das der Rechner nicht mehr booten kann und Neuaufgesetzt werden muß! Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen. Mach ein update für MAM und lasse es im komplettscan laufen (nach dem CF-Lauf)... Poste dann nochmal ein OTL-Log... chris
__________________ |
|
27.08.2010, 11:13
| #3 |
| | Systemabsturz Vista, Explorer reagiert nicht Combofix Logfile:
__________________Code:
ATTFilter ComboFix 10-08-26.02 - Bandit 27.08.2010 11:25:00.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.2316 [GMT 2:00]
ausgeführt von:: c:\users\Bandit\Downloads\ComboFix.exe
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((( Dateien erstellt von 2010-07-27 bis 2010-08-27 ))))))))))))))))))))))))))))))
.
2010-08-27 09:30 . 2010-08-27 09:30 -------- d-----w- c:\users\Bandit\AppData\Local\temp
2010-08-27 09:30 . 2010-08-27 09:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-26 21:39 . 2010-08-26 21:39 -------- d-----w- c:\users\Bandit\AppData\Roaming\Malwarebytes
2010-08-26 21:39 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-26 21:39 . 2010-08-26 21:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-26 21:39 . 2010-08-26 21:39 -------- d-----w- c:\programdata\Malwarebytes
2010-08-26 21:39 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-26 21:37 . 2010-08-26 21:37 -------- d-----w- c:\program files\ERUNT
2010-08-26 14:20 . 2010-08-26 14:20 -------- d-----w- c:\program files\Microsoft.NET
2010-08-26 14:02 . 2010-08-26 14:02 -------- d-----w- c:\program files\Windows Portable Devices
2010-08-26 14:00 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2010-08-26 14:00 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2010-08-26 14:00 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2010-08-26 13:58 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2010-08-26 13:58 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2010-08-26 13:58 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2010-08-21 13:59 . 2010-08-21 13:59 -------- d-----w- c:\windows\system32\ca-ES
2010-08-21 13:59 . 2010-08-21 13:59 -------- d-----w- c:\windows\system32\eu-ES
2010-08-21 13:59 . 2010-08-21 13:59 -------- d-----w- c:\windows\system32\vi-VN
2010-08-21 13:55 . 2010-08-21 13:55 -------- d-----w- c:\windows\system32\SPReview
2010-08-21 13:45 . 2009-04-10 21:28 928768 ----a-w- c:\windows\system32\scavenge.dll
2010-08-21 13:45 . 2009-04-10 21:27 57856 ----a-w- c:\windows\system32\compcln.exe
2010-08-21 13:42 . 2009-04-10 21:32 1083880 ----a-w- c:\windows\system32\drivers\ntfs.sys
2010-08-21 13:41 . 2009-04-10 21:28 347648 ----a-w- c:\windows\system32\wbem\wbemess.dll
2010-08-21 10:08 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-08-21 10:07 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-08-21 10:07 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll
2010-08-21 10:07 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-08-21 10:07 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-08-21 10:06 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-08-21 10:06 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-08-21 10:06 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-08-21 10:06 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-08-21 10:06 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-08-21 10:05 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-21 10:05 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-21 10:05 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-08-21 10:05 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-21 10:05 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-21 10:05 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-21 10:04 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-21 09:51 . 2008-05-27 04:59 18904 ----a-w- c:\windows\system32\StructuredQuerySchemaTrivial.bin
2010-08-21 09:50 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-08-21 09:50 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-08-21 09:50 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-08-21 09:50 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-08-21 09:50 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-08-20 14:51 . 2010-08-20 14:51 -------- d-----w- C:\PerfLogs
2010-08-20 14:22 . 2008-01-18 21:33 193024 ----a-w- c:\windows\system32\recdisc.exe
2010-08-20 14:22 . 2008-01-18 21:36 6656 ----a-w- c:\windows\system32\sdspres.dll
2010-08-20 14:22 . 2008-01-18 21:36 28160 ----a-w- c:\windows\system32\sxproxy.dll
2010-08-20 14:20 . 2008-01-18 21:36 531456 ----a-w- c:\windows\system32\objsel.dll
2010-08-20 14:19 . 2008-01-18 21:34 123392 ----a-w- c:\windows\system32\ifsutil.dll
2010-08-20 13:38 . 2010-08-20 13:38 -------- d-----w- c:\windows\system32\EventProviders
2010-08-19 16:50 . 2010-08-19 16:58 -------- d-----w- c:\users\Bandit\AppData\Local\Google
2010-08-18 18:49 . 2010-08-18 18:49 -------- d-----w- c:\program files\MSECache
2010-08-16 16:17 . 2010-08-16 16:17 52224 ----a-w- c:\users\Bandit\AppData\Roaming\Mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-08-16 16:17 . 2010-08-16 16:17 101376 ----a-w- c:\users\Bandit\AppData\Roaming\Mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-08-16 14:38 . 2010-08-16 14:38 -------- d-----w- c:\users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers
2010-08-16 14:37 . 2010-08-16 14:38 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-08-16 14:37 . 2010-08-16 14:38 -------- d-----w- c:\program files\DVDVideoSoft
2010-08-04 09:17 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-27 07:19 . 2010-02-09 05:27 638748 ----a-w- c:\windows\system32\perfh007.dat
2010-08-27 07:19 . 2010-02-09 05:27 130668 ----a-w- c:\windows\system32\perfc007.dat
2010-08-26 14:02 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-08-26 14:01 . 2010-08-26 14:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-08-26 14:01 . 2010-08-26 14:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-08-21 13:59 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-08-21 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-08-21 13:57 . 2010-08-21 13:57 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-08-21 11:21 . 2010-08-21 11:21 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-08-20 14:43 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-08-20 14:43 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-08-18 17:20 . 2010-02-11 23:20 -------- d-----w- c:\users\Bandit\AppData\Roaming\vlc
2010-08-18 15:25 . 2010-04-06 06:49 -------- d-----w- c:\program files\Ja2
2010-07-25 16:15 . 2010-04-23 08:27 -------- d-----w- c:\users\Bandit\AppData\Roaming\Farm Mania 2
2010-07-23 16:13 . 2010-07-23 16:13 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-07-23 16:13 . 2010-07-23 16:13 23552 ----a-w- c:\windows\system32\lpk.dll
2010-07-23 16:13 . 2010-07-23 16:13 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-07-23 16:13 . 2010-07-23 16:13 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-07-23 16:11 . 2010-07-23 16:11 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-07-23 16:11 . 2010-07-23 16:11 272896 ----a-w- c:\windows\system32\polstore.dll
2010-07-23 16:11 . 2010-07-23 16:11 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-07-23 16:11 . 2010-07-23 16:11 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-07-23 16:11 . 2010-07-23 16:11 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-07-23 16:08 . 2010-07-23 16:08 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-07-23 16:08 . 2010-07-23 16:08 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-07-23 14:01 . 2010-02-08 20:44 51040 ----a-w- c:\users\Bandit\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-23 13:48 . 2010-07-23 13:48 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-07-23 13:48 . 2010-07-23 13:48 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-07-23 13:48 . 2010-07-23 13:48 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-07-23 13:47 . 2010-07-23 13:47 -------- d-----w- c:\program files\MSXML 4.0
2010-07-23 13:36 . 2010-07-23 13:36 -------- d-----w- c:\program files\Common Files\Java
2010-07-23 13:36 . 2010-02-08 23:33 -------- d-----w- c:\program files\Java
2010-06-26 06:05 . 2010-08-21 10:08 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-21 10:08 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-21 10:08 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-21 10:08 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-22 02:36 . 2010-07-23 13:33 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-03 13:16 . 2010-02-08 20:43 680 ----a-w- c:\users\Bandit\AppData\Local\d3d9caps.dat
2010-05-31 18:58 . 2010-06-15 08:44 6638080 ----a-w- c:\windows\system32\drivers\NETw5v32.sys
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-01-20 09:34 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-01-20 1197448]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"Google Update"="c:\users\Bandit\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-08-26 136176]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-10 4431872]
"Skytel"="Skytel.exe" [2007-04-04 1822720]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"starter4g"="c:\windows\starter4g.exe" [2009-06-17 157968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):65,5f,ff,11,3a,41,cb,01
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys [2008-10-31 103424]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-26 3822544]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]
S2 WTGService;WTGService;c:\program files\XSManager\WTGService.exe [2009-06-22 304592]
S2 XS Stick Service;XS Stick Service;c:\windows\service4g.exe [2009-06-17 125200]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-01-08 46592]
S3 NETw5v32;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2010-05-31 6638080]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
2010-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000Core.job
- c:\users\Bandit\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 15:44]
2010-08-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2342590103-847124558-3851468966-1000UA.job
- c:\users\Bandit\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 15:44]
2010-08-27 c:\windows\Tasks\User_Feed_Synchronization-{F5316CD8-A3B6-4220-933E-2A6A3157153B}.job
- c:\windows\system32\msfeedssync.exe [2010-08-21 04:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://internetbanking.gad.de/ptlweb/WebPortal?bankid=2624
IE: Free YouTube to Mp3 Converter - c:\users\Bandit\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\Bandit\AppData\Roaming\Mozilla\Firefox\Profiles\50k6sye7.default\
FF - prefs.js: browser.startup.homepage - Google
FF - component: c:\users\Bandit\AppData\Roaming\Mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\Bandit\AppData\Roaming\Mozilla\Firefox\Profiles\50k6sye7.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\users\Bandit\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-27 11:30
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-08-27 11:32:41
ComboFix-quarantined-files.txt 2010-08-27 09:32
Vor Suchlauf: 4.649.222.144 Bytes frei
Nach Suchlauf: 7.899.516.928 Bytes frei
- - End Of File - - 47A9CFD9A90350AA50C6241DB3155E65
|
|
27.08.2010, 11:52
| #4 |
| | Systemabsturz Vista, Explorer reagiert nicht MAM akualisiert aber nach spätestens 7 min. reagiert es nicht mehr? Was soll ich tuen? Noch einmal Quickscan? Ich versuche es jetzt mal in dem ich die WLan Verbindung deaktiviere. |
|
27.08.2010, 12:34
| #5 |
| | Systemabsturz Vista, Explorer reagiert nicht Auch nach dem ich es jetzt wieder erneut probiert habe reagierte nichts mehr. 3 mal probiert. 1. Komplett 2. Ohne Wlan 3. Ohne Sidebar (mein Verdacht wegen Virus) Starte nochmal Quickscan. Edit// immer bei 7 min ..... C\Program Files\Common Files\Nero\Nero ProductInstaller 4\unit_app_50\UnitRes.dll Geändert von Deprimiert (27.08.2010 um 12:35 Uhr) Grund: Nachtrag |
|
27.08.2010, 13:09
| #6 |
| | Systemabsturz Vista, Explorer reagiert nicht Hi, setze das System per Systemwiederherstellung auf den vorherigen Stand zurück... Alternativ deinstalliere den neuen Treiber und installiere den alten... Dann bitte ein neues OTL-Log... Stürzt der Rechner komplett ab (dann bitte die Bluescreenmeldung), oder bleibt er hängen und reagiert nicht mehr? Dann bitte die Kühlung (Ventilatoren etc.) prüfen... Lass das File "C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\unit_app_50\UnitRes.dll" bei virustotal prüfen (denke aber nicht das dass damit was zu tun hat...)... chris
__________________ --> Systemabsturz Vista, Explorer reagiert nicht |
|
27.08.2010, 17:00
| #7 |
| | Systemabsturz Vista, Explorer reagiert nicht Also habe mir jetzt die Vista CD raussuchen lassen und bin gerade dabei Vista neu aufzuspielen. Hoffe damit hat sich alles erledigt. Dennoch vielen vielen Dank für eure (deine) Bemühungen. Ich melde mich dann später nochmal ob es beseitigt ist. Grüße. |
|
28.08.2010, 12:40
| #8 |
| | Systemabsturz Vista, Explorer reagiert nicht Betriebssystem neu aufgesetzt uns upgedatet. Funzt wieder prima. Zu dem auch gleich MS Virenprogramm drauf. Müsste jetzt gut gerüstet sein. Danke nochmal an dir! Grüße |
|
28.08.2010, 18:13
| #9 |
| | Systemabsturz Vista, Explorer reagiert nicht Hi, installiere noch Antimalewarebytes (1x wöchentlich updaten und scannen) sowie zusätzlich einen Verhaltensscanner (Freie Version: ThreatFire-AntiVirus - Verhaltensorientierter Schutz gegen Viren und Spyware)... chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
| Themen zu Systemabsturz Vista, Explorer reagiert nicht |
| anleitung, ask toolbar, ask.com, aufklärung, brauche, components, corp./icp, explorer, explorer reagiert nicht, folge, folgende, home premium, iastor.sys, install.exe, installieren, location, log, metin2, nervt, neue, neuen, nvstor.sys, oldtimer, plug-in, programdata, prozesse, reagiert, reagiert nicht, saver, searchplugins, shell32.dll, stürzt, system, systemabsturz, taskmanager, torrent.exe, treiber, trojaner, verdacht, virus, vista, vlc media player, wahrscheinlich, win, win explorer, wlan. |
Linear-Darstellung
