| |
| |||||||
Log-Analyse und Auswertung: Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.08.2010, 12:18
| #1 |
| |  Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Wie der Kollege am 16.08. habe ich genau das selbe Problem und hoffe das es sich ganuso lösen lässt. HijackThis, CCCleaner, Combofix etc. alles ist vorbereitet. Was als errstes ? HJT Logfile ? Sobald er ans Internet geht direkt alles geblockt und automatischer Neustart. Gestern noch Antimalware Doctor, den habe ich wegbekommen. Trotzdem noch AV Security Suite etc... Vielen Dank schon mal.... Greetz Sashinho OTL LOGFILEOTL Logfile: Code:
ATTFilter OTL logfile created on: 29.08.2010 13:04:02 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Sashinho\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 298,09 Gb Total Space | 54,49 Gb Free Space | 18,28% Space Free | Partition Type: NTFS Drive D: | 298,09 Gb Total Space | 28,34 Gb Free Space | 9,51% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 981,05 Mb Total Space | 844,29 Mb Free Space | 86,06% Space Free | Partition Type: FAT32 H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SASHINHO-PC Current User Name: Sashinho Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Sashinho\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\svc2.exe () PRC - C:\Programme\Common Files\Steam\SteamService.exe (Valve Corporation) PRC - D:\Gamez\Steam\steam.exe (Valve Corporation) PRC - C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH) PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerTray.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerEvent.exe (Acer Incorporated) PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe () PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink) PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) PRC - C:\Programme\Acer Bio Protection\BASVC.exe (Egis Technology Inc.) PRC - C:\Programme\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.) PRC - C:\Programme\Acer Bio Protection\CompPtcVUI.exe (Egis Technology Inc.) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated) PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated) PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.) PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\MWLService.exe (EgisTec Inc.) PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.) PRC - C:\Windows\PLFSetI.exe () PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.) PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.) PRC - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software) PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE (SEIKO EPSON CORPORATION) ========== Modules (SafeList) ========== MOD - C:\Users\Sashinho\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Programme\Acer\Acer PowerSmart Manager\SysHook.dll (Acer Incorporated) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Akamai) -- c:\Programme\Common Files\Akamai\rswin_3745.dll () SRV - (TunngleService) -- C:\Programme\Tunngle\TnglCtrl.exe (Tunngle.net GmbH) SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.) SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH) SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (ePowerSvc) -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated) SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe () SRV - (IGBASVC) -- C:\Programme\Acer Bio Protection\BASVC.exe (Egis Technology Inc.) SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.) SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated) SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.) SRV - (MWLService) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe () SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.) SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH) SRV - (StarWindServiceAE) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found DRV - (GarenaPEngine) -- C:\Users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp File not found DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net) DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys () DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys () DRV - (FPSensor) EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) -- C:\Windows\System32\drivers\FPSensor.sys (Egistec) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation) DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.) DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.) DRV - (btusbflt) -- C:\Windows\System32\drivers\btusbflt.sys (Broadcom Corporation.) DRV - (btwl2cap) -- C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.) DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.) DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (CyberLink Corp.) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics Incorporated) DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.) DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.) DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Incorporated.) DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.) DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation) DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.) DRV - (AlfaFF) -- C:\Windows\system32\drivers\AlfaFF.sys (Alfa Corporation) DRV - (Ltn_stk7770P) -- C:\Windows\System32\drivers\Ltn_stk7770P.sys (LITEON) DRV - (int15) -- C:\Windows\System32\drivers\int15.sys () DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) DRV - (BrSerIf) -- C:\Windows\System32\drivers\BrSerIf.sys (Brother Industries Ltd.) DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\agrsm.sys (Agere Systems) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (BrUsbSer) -- C:\Windows\System32\drivers\BrUsbSer.sys (Brother Industries Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5 IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data] IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.30 12:07:13 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.07 22:21:56 | 000,000,000 | ---D | M] [2009.12.10 13:11:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Extensions [2010.08.29 11:45:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions [2010.07.01 14:03:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.16 13:40:10 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\mozilla\Firefox\Profiles\cn2dlidy.default\extensions\youtube2mp3@mondayx.de [2010.08.07 21:04:08 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.07.30 12:07:10 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.07.30 12:07:10 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.07.30 12:07:10 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.07.30 12:07:10 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.07.30 12:07:10 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated) O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (EgisTec Inc.) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mwlDaemon] C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (EgisTec Inc.) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe () O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O4 - HKLM..\Run: [VitaKeyPdtWzd] C:\Program Files\Acer Bio Protection\PdtWzd.exe (Egis Technology Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [borobororb.exe] C:\borobororb.exe\borobororb.exe () O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [cfxadpei] C:\Users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe () O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [EPSON Stylus DX6000 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [NetLog2] C:\Windows\svc2.exe () O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [ProductReg] C:\Programme\Acer\WR_PopUp\ProductReg.exe (Acer) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [Steam] D:\Gamez\Steam\Steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.) O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKU\S-1-5-21-1239136018-1507258121-1134437384-1000\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Sashinho\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Sashinho\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{9176068f-0a6d-11df-832d-00059a3c7800}\Shell - "" = AutoRun O33 - MountPoints2\{9176068f-0a6d-11df-832d-00059a3c7800}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found O33 - MountPoints2\{c3910696-e56b-11de-bf5a-00269e390614}\Shell - "" = AutoRun O33 - MountPoints2\{c3910696-e56b-11de-bf5a-00269e390614}\Shell\AutoRun\command - "" = F:\SetupLauncher.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (hxxp://www.mp3dev.org/) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll () Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll () Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.08.29 13:02:12 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Sashinho\Desktop\OTL.exe [2010.08.28 23:49:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\nujxtecya [2010.08.28 23:48:56 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Windows [2010.08.28 23:48:54 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Windows Server [2010.08.28 23:48:48 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B [2010.08.28 23:44:04 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation [2010.08.28 23:31:17 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Lite [2010.08.28 23:27:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\2K Games [2010.08.28 18:21:30 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\Diktus 2010 5 [2010.08.26 13:46:26 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\Phx_data [2010.08.25 19:08:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\76561197961688521 [2010.08.25 10:47:25 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Steam [2010.08.24 13:14:52 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119614890734724340 [2010.08.24 13:14:41 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119611678099186932 [2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Tunngle [2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\Tunngle [2010.08.24 11:59:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle [2010.08.24 11:59:11 | 000,027,136 | ---- | C] (Tunngle.net) -- C:\Windows\System32\drivers\tap0901t.sys [2010.08.24 11:59:10 | 000,000,000 | ---D | C] -- C:\Programme\Tunngle [2010.08.24 11:42:34 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Square Enix [2010.08.24 11:42:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119614890733675764 [2010.08.24 11:42:10 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\119611678098138356 [2010.08.24 11:41:05 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Alcohol 120% [2010.08.24 11:36:11 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe AIR [2010.08.22 20:01:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2010.08.22 19:16:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Electronic_Arts_Inc [2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\StarCraft II [2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Blizzard Entertainment [2010.08.17 17:13:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment [2010.08.17 12:24:32 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\id Software [2010.08.11 20:38:21 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Desktop\DSI [2010.08.07 23:01:35 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Microsoft Games [2010.08.07 21:13:40 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\DivX [2010.08.07 21:13:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PX Storage Engine [2010.08.07 21:13:08 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DivX Shared [2010.08.07 21:11:29 | 000,000,000 | ---D | C] -- C:\Programme\DivX [2010.08.07 21:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX [2010.08.05 20:09:55 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Singularity [2010.08.05 20:07:41 | 000,000,000 | ---D | C] -- C:\Windows\E10DB5DAE57640EAA7FC1CB2A7B283A6.TMP [2010.08.04 11:58:27 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations [2010.08.03 21:09:21 | 001,228,416 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.exe [2010.08.03 21:09:07 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Akamai [2010.07.31 11:21:36 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Command and Conquer 4 [2010.07.31 11:20:49 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4 [2010.07.31 10:33:20 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Cadenza [2010.07.31 10:32:54 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft XNA [2010.07.30 19:43:06 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Local\Activision [2010.07.30 19:16:18 | 000,000,000 | ---D | C] -- C:\Programme\Elaborate Bytes [2010.07.30 19:10:34 | 000,000,000 | ---D | C] -- C:\Programme\Alcohol Soft [2010.07.30 19:10:18 | 000,000,000 | ---D | C] -- C:\Programme\Franzis [2010.07.30 14:34:51 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information [2010.07.30 14:34:38 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll [2010.07.30 14:34:38 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll [2010.07.30 14:34:36 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll [2010.07.30 14:34:30 | 000,000,000 | ---D | C] -- C:\Windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP [2010.07.30 14:17:25 | 000,000,000 | ---D | C] -- C:\Users\Sashinho\Documents\Flock [2009.04.04 01:32:18 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll [6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.08.29 13:05:23 | 000,783,360 | ---- | M] () -- C:\Windows\System32\drivers\hzicoziy.sys [2010.08.29 13:03:51 | 002,883,584 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT [2010.08.29 12:52:06 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Sashinho\Desktop\OTL.exe [2010.08.29 12:46:17 | 000,232,406 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.08.29 12:46:04 | 000,232,406 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.08.29 12:46:03 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.08.29 12:46:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.29 12:46:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.29 12:45:58 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.29 12:45:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.29 12:45:52 | 3209,240,576 | -HS- | M] () -- C:\hiberfil.sys [2010.08.29 12:45:07 | 000,524,288 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.08.29 12:45:07 | 000,065,536 | -HS- | M] () -- C:\Users\Sashinho\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.08.29 12:37:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.08.29 12:22:03 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.08.29 12:22:03 | 000,000,000 | ---- | M] () -- C:\Windows\System32\Access.dat [2010.08.29 11:25:09 | 002,990,566 | -H-- | M] () -- C:\Users\Sashinho\AppData\Local\IconCache.db [2010.08.29 09:56:59 | 226,463,978 | ---- | M] () -- C:\Windows\MEMORY.DMP [2010.08.29 09:52:00 | 000,000,910 | ---- | M] () -- C:\Users\Sashinho\Desktop\mbam - Verknüpfung.lnk [2010.08.29 05:08:30 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.08.29 05:08:30 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.08.29 05:08:30 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.08.29 05:08:30 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.08.29 05:08:30 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.08.28 23:49:17 | 000,212,347 | ---- | M] () -- C:\Windows\svc2.exe [2010.08.28 23:49:06 | 000,030,000 | ---- | M] () -- C:\Windows\System32\e882l9zh.dll [2010.08.28 23:48:57 | 000,030,000 | ---- | M] () -- C:\Windows\System32\l2nmqs7t.dll [2010.08.28 23:48:57 | 000,030,000 | ---- | M] () -- C:\Windows\System32\dyun6g.dll [2010.08.28 23:48:55 | 000,030,000 | ---- | M] () -- C:\Windows\System32\tmoaufm.dll [2010.08.28 01:06:48 | 000,000,396 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job [2010.08.27 19:17:49 | 000,008,484 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\d3d9caps.dat [2010.08.27 01:57:49 | 000,104,056 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\GDIPFONTCACHEV1.DAT [2010.08.27 01:57:32 | 000,382,928 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.08.26 14:00:16 | 000,000,535 | ---- | M] () -- C:\Users\Sashinho\Desktop\Phx_settings.ini [2010.08.25 14:21:41 | 000,107,520 | ---- | M] () -- C:\Users\Sashinho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.08.25 12:10:42 | 000,000,584 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2010.08.25 10:47:05 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll [2010.08.24 11:59:12 | 000,000,742 | ---- | M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk [2010.08.24 11:23:32 | 000,800,768 | ---- | M] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.doc [2010.08.24 11:13:52 | 000,000,788 | ---- | M] () -- C:\Users\Sashinho\Desktop\Kane & Lynch 2.lnk [2010.08.24 10:41:34 | 000,145,168 | ---- | M] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.docx [2010.08.23 14:39:42 | 000,024,433 | ---- | M] () -- C:\Users\Sashinho\Desktop\1.gif [2010.08.23 14:39:21 | 000,007,848 | ---- | M] () -- C:\Users\Sashinho\Desktop\porter`s 5 forces.gif [2010.08.22 19:09:22 | 000,000,719 | ---- | M] () -- C:\Users\Sashinho\Desktop\CNC4.lnk [2010.08.18 10:04:28 | 000,000,162 | -H-- | M] () -- C:\Users\Sashinho\Desktop\~$usarbeit Fitnessmarkt Sascha Mendner 415730.docx [2010.08.17 11:51:23 | 000,049,800 | ---- | M] () -- C:\Users\Sashinho\Desktop\hausprospekt_2007_shelby.pdf [2010.08.16 12:04:10 | 000,069,362 | ---- | M] () -- C:\Users\Sashinho\Desktop\Nischenmanagement Teil 2.pdf [2010.08.16 10:35:31 | 000,000,733 | ---- | M] () -- C:\Users\Sashinho\Desktop\Wolfenstein.lnk [2010.08.12 21:17:47 | 000,630,572 | ---- | M] () -- C:\Users\Sashinho\Desktop\Erfolgsfaktoren_von_Fitnessstudios_Basisreport.pdf [2010.08.12 16:18:18 | 000,009,425 | ---- | M] () -- C:\Users\Sashinho\Documents\saruschka0810.nra [2010.08.06 12:03:57 | 001,331,999 | ---- | M] () -- C:\Users\Sashinho\Desktop\DE_CBT_NL_Fit_1_2010_D.pdf [2010.08.06 10:46:08 | 000,254,946 | ---- | M] () -- C:\Users\Sashinho\Desktop\SparkStudie_FitnessBranche.pdf [2010.08.06 10:45:45 | 001,499,713 | ---- | M] () -- C:\Users\Sashinho\Desktop\BR_707_07_Fitnesscenter.pdf [2010.08.04 21:06:42 | 4096,798,902 | ---- | M] () -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.7z [2010.08.04 19:12:12 | 000,138,464 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.08.04 19:09:55 | 001,228,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.exe [2010.08.01 12:34:17 | 000,000,681 | ---- | M] () -- C:\Users\Sashinho\Desktop\AssassinsCreedIIGame.exe.lnk [2010.07.31 17:57:35 | 000,000,442 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2010.07.31 17:11:20 | 000,001,800 | ---- | M] () -- C:\WirelessDiagLog.csv [2010.07.30 21:33:25 | 000,000,619 | ---- | M] () -- C:\Users\Sashinho\Desktop\Sol Survivor.lnk [2010.07.30 19:43:03 | 000,000,677 | ---- | M] () -- C:\Users\Sashinho\Desktop\Call Of Duty - World At War.lnk [2010.07.30 18:28:42 | 000,000,776 | ---- | M] () -- C:\Users\Sashinho\Desktop\AlienBreed-Impact.exe.lnk [2010.07.30 14:55:53 | 000,001,906 | ---- | M] () -- C:\Users\Public\Desktop\FLOCK!.lnk [6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.08.29 11:57:20 | 3209,240,576 | -HS- | C] () -- C:\hiberfil.sys [2010.08.29 09:52:00 | 000,000,910 | ---- | C] () -- C:\Users\Sashinho\Desktop\mbam - Verknüpfung.lnk [2010.08.28 23:49:45 | 000,783,360 | ---- | C] () -- C:\Windows\System32\drivers\hzicoziy.sys [2010.08.28 23:49:21 | 000,212,347 | ---- | C] () -- C:\Windows\svc2.exe [2010.08.28 23:49:06 | 000,030,000 | ---- | C] () -- C:\Windows\System32\e882l9zh.dll [2010.08.28 23:48:57 | 000,030,000 | ---- | C] () -- C:\Windows\System32\l2nmqs7t.dll [2010.08.28 23:48:57 | 000,030,000 | ---- | C] () -- C:\Windows\System32\dyun6g.dll [2010.08.28 23:48:55 | 000,030,000 | ---- | C] () -- C:\Windows\System32\tmoaufm.dll [2010.08.26 13:46:26 | 000,000,535 | ---- | C] () -- C:\Users\Sashinho\Desktop\Phx_settings.ini [2010.08.26 13:41:15 | 008,578,951 | ---- | C] ($t@t!c_V()!D) -- C:\Users\Sashinho\Desktop\Phoenix.exe [2010.08.25 10:47:25 | 000,000,584 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2010.08.24 12:35:08 | 000,000,000 | ---- | C] () -- C:\Windows\System32\Access.dat [2010.08.24 11:59:12 | 000,000,742 | ---- | C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk [2010.08.24 11:13:19 | 000,000,788 | ---- | C] () -- C:\Users\Sashinho\Desktop\Kane & Lynch 2.lnk [2010.08.23 14:39:42 | 000,024,433 | ---- | C] () -- C:\Users\Sashinho\Desktop\1.gif [2010.08.23 14:39:20 | 000,007,848 | ---- | C] () -- C:\Users\Sashinho\Desktop\porter`s 5 forces.gif [2010.08.22 19:09:08 | 000,000,719 | ---- | C] () -- C:\Users\Sashinho\Desktop\CNC4.lnk [2010.08.18 10:04:28 | 000,000,162 | -H-- | C] () -- C:\Users\Sashinho\Desktop\~$usarbeit Fitnessmarkt Sascha Mendner 415730.docx [2010.08.17 12:41:58 | 000,800,768 | ---- | C] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.doc [2010.08.17 11:51:23 | 000,049,800 | ---- | C] () -- C:\Users\Sashinho\Desktop\hausprospekt_2007_shelby.pdf [2010.08.16 12:04:10 | 000,069,362 | ---- | C] () -- C:\Users\Sashinho\Desktop\Nischenmanagement Teil 2.pdf [2010.08.16 10:35:31 | 000,000,733 | ---- | C] () -- C:\Users\Sashinho\Desktop\Wolfenstein.lnk [2010.08.12 22:12:24 | 006,486,315 | ---- | C] () -- C:\Users\Sashinho\Desktop\HandbookStrategicManagement.pdf [2010.08.12 21:17:47 | 000,630,572 | ---- | C] () -- C:\Users\Sashinho\Desktop\Erfolgsfaktoren_von_Fitnessstudios_Basisreport.pdf [2010.08.12 16:18:18 | 000,009,425 | ---- | C] () -- C:\Users\Sashinho\Documents\saruschka0810.nra [2010.08.09 16:52:32 | 000,145,168 | ---- | C] () -- C:\Users\Sashinho\Desktop\Hausarbeit Fitnessmarkt Sascha Mendner 415730.docx [2010.08.06 12:03:57 | 001,331,999 | ---- | C] () -- C:\Users\Sashinho\Desktop\DE_CBT_NL_Fit_1_2010_D.pdf [2010.08.06 10:46:08 | 000,254,946 | ---- | C] () -- C:\Users\Sashinho\Desktop\SparkStudie_FitnessBranche.pdf [2010.08.06 10:45:45 | 001,499,713 | ---- | C] () -- C:\Users\Sashinho\Desktop\BR_707_07_Fitnesscenter.pdf [2010.08.03 21:09:21 | 4096,798,902 | ---- | C] () -- C:\Users\Sashinho\Desktop\MasterCollection_CS5_LS4.7z [2010.08.01 12:34:01 | 000,000,681 | ---- | C] () -- C:\Users\Sashinho\Desktop\AssassinsCreedIIGame.exe.lnk [2010.07.31 17:03:38 | 000,001,800 | ---- | C] () -- C:\WirelessDiagLog.csv [2010.07.30 21:33:07 | 000,000,619 | ---- | C] () -- C:\Users\Sashinho\Desktop\Sol Survivor.lnk [2010.07.30 19:42:36 | 000,000,677 | ---- | C] () -- C:\Users\Sashinho\Desktop\Call Of Duty - World At War.lnk [2010.07.30 18:28:09 | 000,000,776 | ---- | C] () -- C:\Users\Sashinho\Desktop\AlienBreed-Impact.exe.lnk [2010.07.30 14:55:53 | 000,001,906 | ---- | C] () -- C:\Users\Public\Desktop\FLOCK!.lnk [2010.03.29 20:15:47 | 000,232,406 | ---- | C] () -- C:\ProgramData\nvModes.001 [2010.03.29 20:15:37 | 000,232,406 | ---- | C] () -- C:\ProgramData\nvModes.dat [2010.03.16 15:17:08 | 000,010,298 | -HS- | C] () -- C:\Users\Sashinho\AppData\Local\nSVDb4q65iE [2010.02.26 12:21:29 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.02.26 12:20:34 | 000,000,212 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2010.02.26 12:20:34 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini [2010.02.26 12:18:47 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI [2010.02.26 12:18:25 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini [2010.02.26 12:18:24 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll [2010.02.26 12:17:26 | 000,031,664 | ---- | C] () -- C:\Windows\maxlink.ini [2010.02.07 21:24:29 | 000,000,809 | ---- | C] () -- C:\Windows\NTIWVEDT.INI [2010.01.23 00:12:07 | 000,000,146 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\default.pls [2010.01.23 00:11:03 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2009.12.26 03:29:31 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009.12.26 03:29:31 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2009.12.26 03:29:29 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2009.12.26 03:29:29 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009.12.26 03:29:29 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009.12.26 03:29:28 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2009.12.26 03:29:28 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest [2009.12.25 13:57:39 | 000,000,002 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\ceville_console_history.txt [2009.12.24 11:29:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2009.12.24 10:15:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.12.10 14:44:31 | 000,008,484 | ---- | C] () -- C:\Users\Sashinho\AppData\Local\d3d9caps.dat [2009.12.10 13:59:38 | 000,138,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.12.10 13:59:38 | 000,138,056 | ---- | C] () -- C:\Users\Sashinho\AppData\Roaming\PnkBstrK.sys [2009.12.10 11:08:50 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2009.12.10 11:00:01 | 000,107,520 | ---- | C] () -- C:\Users\Sashinho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2009.09.14 20:31:50 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2009.09.14 20:31:50 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2009.09.14 18:13:54 | 000,007,260 | ---- | C] () -- C:\ProgramData\ArcadeDeluxe2.log [2009.09.14 18:07:12 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll [2009.09.14 18:07:12 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini [2009.01.13 12:29:00 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll [2008.09.11 14:01:00 | 000,081,920 | ---- | C] () -- C:\Windows\System32\INT15.dll [2008.09.09 11:38:48 | 000,097,792 | ---- | C] () -- C:\Windows\System32\INT15_64.dll [2008.09.09 11:38:48 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys [2008.05.21 20:46:08 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll [2008.03.12 13:52:34 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2004.01.26 18:15:29 | 000,233,472 | R--- | C] () -- C:\Users\Sashinho\AppData\Roaming\MafiaSetup.exe ========== LOP Check ========== [2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console [2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console [2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Acer GameZone Console [2010.01.06 14:29:35 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\cmw [2010.01.06 12:28:40 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\PowerCinema [2010.08.29 02:56:13 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B [2010.01.21 15:06:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer [2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer GameZone Console [2009.12.25 14:42:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh [2009.12.25 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh - Heart of Osiris [2010.02.02 15:10:22 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Any Video Converter [2010.03.29 02:41:26 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Bioshock2 [2010.08.04 11:58:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations [2010.03.15 18:37:04 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Braid [2010.07.31 11:49:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4 [2009.12.14 11:47:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DAEMON Tools Lite [2010.06.21 14:25:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DiskAid [2010.02.04 14:11:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Leadertech [2010.08.16 10:36:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\MudTV [2009.12.24 20:00:38 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\PowerCinema [2009.12.24 19:55:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\SoftDMA [2010.06.20 18:52:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Summer Athletics 2008 [2009.12.28 21:11:09 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\TuneUp Software [2010.08.25 14:23:24 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Tunngle [2010.03.16 15:05:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ubisoft [2010.06.21 07:35:28 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\VOWSoft [2010.08.28 01:06:48 | 000,000,396 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job [2010.08.29 12:22:03 | 000,032,544 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.08.29 02:56:13 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B [2010.01.21 15:06:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer [2009.04.03 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Acer GameZone Console [2010.08.24 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Adobe [2009.12.25 14:42:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh [2009.12.25 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ankh - Heart of Osiris [2010.02.02 15:10:22 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Any Video Converter [2009.12.27 01:28:52 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Apple Computer [2010.03.29 02:41:26 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Bioshock2 [2010.08.04 11:58:27 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\bizarre creations [2010.03.15 18:37:04 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Braid [2010.07.31 11:49:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Command and Conquer 4 [2009.12.24 19:55:41 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\CyberLink [2009.12.14 11:47:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DAEMON Tools Lite [2010.06.21 14:25:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DiskAid [2010.08.07 21:19:03 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\DivX [2010.07.07 09:39:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\dvdcss [2009.12.10 11:06:48 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Google [2009.12.09 17:08:29 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Identities [2010.07.30 14:34:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information [2010.04.01 23:41:15 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Intel [2010.02.04 14:11:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Leadertech [2009.12.09 17:08:54 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Macromedia [2010.03.16 15:40:33 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Malwarebytes [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Media Center Programs [2009.12.30 17:01:36 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Media Player Classic [2010.07.31 17:03:52 | 000,000,000 | --SD | M] -- C:\Users\Sashinho\AppData\Roaming\Microsoft [2010.01.22 02:09:05 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Microsoft Games [2009.12.10 13:11:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Mozilla [2010.08.16 10:36:37 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\MudTV [2010.01.20 22:37:08 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Nero [2009.12.24 20:00:38 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\PowerCinema [2009.12.10 14:39:35 | 000,000,000 | RH-D | M] -- C:\Users\Sashinho\AppData\Roaming\SecuROM [2009.12.24 19:55:42 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\SoftDMA [2010.06.20 18:52:34 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Summer Athletics 2008 [2009.12.28 21:11:09 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\TuneUp Software [2010.08.25 14:23:24 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Tunngle [2010.03.16 15:05:51 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\Ubisoft [2010.08.17 22:42:33 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\vlc [2010.06.21 07:35:28 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\VOWSoft [2009.12.10 13:35:46 | 000,000,000 | ---D | M] -- C:\Users\Sashinho\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2004.01.26 18:15:29 | 000,233,472 | R--- | M] () -- C:\Users\Sashinho\AppData\Roaming\MafiaSetup.exe [2010.07.30 14:30:48 | 000,331,776 | ---- | M] (Epic Games ) -- C:\Users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\setup.exe [2010.08.24 11:37:39 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Sashinho\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2010.02.26 12:17:53 | 000,010,134 | R--- | M] () -- C:\Users\Sashinho\AppData\Roaming\Microsoft\Installer\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > [1 C:\*.tmp files -> C:\*.tmp -> ] < MD5 for: AGP440.SYS > [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.11.06 15:00:11 | 000,019,720 | ---- | M] (Microsoft Corporation) MD5=23B446FC5141012161DF4C550275BCD4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_6be1d3ca\atapi.sys [2008.11.06 15:00:11 | 000,019,720 | ---- | M] (Microsoft Corporation) MD5=23B446FC5141012161DF4C550275BCD4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22303_none_ddc4c98f3aa4b4b9\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTOR.SYS > [2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys [2009.02.11 17:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_ea118ff5\iaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2010.08.29 13:18:49 | 000,783,360 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\hzicoziy.sys [2009.12.10 11:08:50 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys < %systemroot%\System32\config\*.sav > [2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll [6 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:4F636E25 < End of report > Combofix Logfile: Code:
ATTFilter ComboFix 10-08-28.02 - Sashinho 29.08.2010 13:59:05.1.8 - x86
ausgeführt von:: c:\users\Sashinho\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\borobororb.exe
c:\borobororb.exe\borobororb.exe
c:\borobororb.exe\config.bin
C:\DFR9D76.tmp
c:\users\Sashinho\AppData\Local\nujxtecya
c:\users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe
c:\users\Sashinho\AppData\Local\Windows Server
c:\users\Sashinho\AppData\Local\Windows Server\admin.txt
c:\users\Sashinho\AppData\Local\Windows Server\flags.ini
c:\users\Sashinho\AppData\Local\Windows Server\hlp.dat
c:\users\Sashinho\AppData\Local\Windows Server\server.dat
c:\users\Sashinho\AppData\Local\Windows Server\uses32.dat
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B\enemies-names.txt
c:\users\Sashinho\AppData\Roaming\8449B8C6538A9C2D177E52971C84C46B\local.ini
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
c:\users\Sashinho\AppData\Roaming\Microsoft\Windows\Templates\memory.tmp
c:\windows\svc2.exe
c:\windows\system32\dyun6g.dll
c:\windows\system32\e882l9zh.dll
c:\windows\system32\l2nmqs7t.dll
c:\windows\system32\tmoaufm.dll
D:\install.exe
.
((((((((((((((((((((((( Dateien erstellt von 2010-07-28 bis 2010-08-29 ))))))))))))))))))))))))))))))
.
2010-08-29 12:10 . 2010-08-29 12:13 -------- d-----w- c:\users\Sashinho\AppData\Local\temp
2010-08-29 11:26 . 2010-08-29 11:26 -------- d-----w- c:\program files\CCleaner
2010-08-28 21:48 . 2010-08-29 10:46 -------- d-----w- c:\users\Sashinho\AppData\Local\Windows
2010-08-28 21:44 . 2010-08-28 21:44 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-28 21:31 . 2010-08-28 21:31 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-28 21:27 . 2010-08-28 21:27 -------- d-----w- c:\users\Sashinho\AppData\Local\2K Games
2010-08-25 17:08 . 2010-08-25 17:08 -------- d-----w- c:\users\Sashinho\AppData\Local\76561197961688521
2010-08-25 08:47 . 2010-08-25 09:49 -------- d-----w- c:\program files\Common Files\Steam
2010-08-24 11:14 . 2010-08-24 11:14 -------- d-----w- c:\users\Sashinho\AppData\Local\119614890734724340
2010-08-24 11:14 . 2010-08-24 11:14 -------- d-----w- c:\users\Sashinho\AppData\Local\119611678099186932
2010-08-24 10:35 . 2010-08-29 12:11 0 ----a-w- c:\windows\system32\Access.dat
2010-08-24 09:59 . 2010-08-25 12:23 -------- d-----w- c:\programdata\Tunngle
2010-08-24 09:59 . 2010-08-25 12:23 -------- d-----w- c:\users\Sashinho\AppData\Roaming\Tunngle
2010-08-24 09:59 . 2009-09-16 06:02 27136 ----a-w- c:\windows\system32\drivers\tap0901t.sys
2010-08-24 09:59 . 2010-08-24 10:01 -------- d-----w- c:\program files\Tunngle
2010-08-24 09:42 . 2010-08-24 09:42 -------- d-----w- c:\users\Sashinho\AppData\Local\119614890733675764
2010-08-24 09:42 . 2010-08-24 09:42 -------- d-----w- c:\users\Sashinho\AppData\Local\119611678098138356
2010-08-24 09:36 . 2010-08-24 09:37 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-08-22 18:01 . 2010-08-24 09:37 -------- d-----w- c:\programdata\Electronic Arts
2010-08-22 17:16 . 2010-08-22 17:16 -------- d-----w- c:\users\Sashinho\AppData\Local\Electronic_Arts_Inc
2010-08-17 15:13 . 2010-08-24 18:43 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-17 15:13 . 2010-08-17 15:32 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-08-17 10:24 . 2010-08-17 10:24 -------- d-----w- c:\users\Sashinho\AppData\Local\id Software
2010-08-07 21:01 . 2010-08-07 21:02 -------- d-----w- c:\users\Sashinho\AppData\Local\Microsoft Games
2010-08-07 19:13 . 2010-08-07 19:19 -------- d-----w- c:\users\Sashinho\AppData\Roaming\DivX
2010-08-07 19:13 . 2010-08-07 19:13 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-08-07 19:13 . 2010-08-07 19:13 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-08-07 19:11 . 2010-08-07 19:13 -------- d-----w- c:\program files\DivX
2010-08-07 19:09 . 2010-08-07 19:13 -------- d-----w- c:\programdata\DivX
2010-08-05 18:07 . 2010-08-05 18:07 -------- d-----w- c:\windows\E10DB5DAE57640EAA7FC1CB2A7B283A6.TMP
2010-08-04 09:58 . 2010-08-04 09:58 -------- d-----w- c:\users\Sashinho\AppData\Roaming\bizarre creations
2010-08-03 19:09 . 2010-08-29 12:12 -------- d-----w- c:\program files\Common Files\Akamai
2010-07-31 09:20 . 2010-07-31 09:49 -------- d-----w- c:\users\Sashinho\AppData\Roaming\Command and Conquer 4
2010-07-31 08:33 . 2010-07-31 08:33 -------- d-----w- c:\users\Sashinho\AppData\Local\Cadenza
2010-07-31 08:32 . 2010-07-31 08:32 -------- d-----w- c:\program files\Microsoft XNA
2010-07-30 17:43 . 2010-07-30 17:43 -------- d-----w- c:\users\Sashinho\AppData\Local\Activision
2010-07-30 17:16 . 2010-07-30 17:16 -------- d-----w- c:\program files\Elaborate Bytes
2010-07-30 17:10 . 2010-07-30 17:10 -------- d-----w- c:\program files\Alcohol Soft
2010-07-30 17:10 . 2010-07-30 17:10 -------- d-----w- c:\program files\Franzis
2010-07-30 12:34 . 2010-07-30 12:34 -------- d-----w- c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information
2010-07-30 12:34 . 2008-07-12 06:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-07-30 12:34 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-07-30 12:34 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-07-30 12:34 . 2010-07-30 12:34 -------- d-----w- c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-29 12:12 . 2010-03-29 18:15 232406 ----a-w- c:\programdata\nvModes.dat
2010-08-29 12:11 . 2010-01-22 11:41 12 ----a-w- c:\windows\bthservsdp.dat
2010-08-29 11:28 . 2009-12-30 15:01 -------- d-----w- c:\users\Sashinho\AppData\Roaming\Media Player Classic
2010-08-29 03:08 . 2008-01-21 07:15 618442 ----a-w- c:\windows\system32\perfh007.dat
2010-08-29 03:08 . 2008-01-21 07:15 122842 ----a-w- c:\windows\system32\perfc007.dat
2010-08-28 22:44 . 2010-03-16 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-27 17:17 . 2009-12-10 12:44 8484 ----a-w- c:\users\Sashinho\AppData\Local\d3d9caps.dat
2010-08-26 23:57 . 2009-12-09 15:08 104056 ----a-w- c:\users\Sashinho\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-25 12:30 . 2009-12-24 07:51 -------- d-----w- c:\program files\JDownloader
2010-08-25 08:47 . 2010-01-10 12:49 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-08-24 14:25 . 2010-08-24 13:59 47364 ----a-w- c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-08-24 09:37 . 2009-09-14 18:24 -------- d-----w- c:\program files\Ubisoft
2010-08-24 09:37 . 2009-04-03 15:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-24 09:37 . 2010-08-24 09:47 53632 ----a-w- c:\users\Sashinho\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-24 09:37 . 2010-08-24 09:36 53632 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-17 20:42 . 2009-12-15 10:10 -------- d-----w- c:\users\Sashinho\AppData\Roaming\vlc
2010-08-16 08:36 . 2010-03-13 11:13 -------- d-----w- c:\users\Sashinho\AppData\Roaming\MudTV
2010-08-16 08:30 . 2009-04-03 15:59 -------- d-----w- c:\program files\Acer GameZone
2010-08-07 19:14 . 2010-08-07 19:14 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-08-05 18:07 . 2009-12-10 11:32 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-08-04 17:12 . 2009-12-10 11:59 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-04 17:12 . 2009-12-10 11:59 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-30 12:30 . 2010-07-30 12:34 331776 ----a-w- c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\setup.exe
2010-07-30 12:30 . 2010-07-30 12:34 2010726 ----a-w- c:\users\Sashinho\AppData\Roaming\InstallShield Installation Information\{6530FDAA-5B1F-4830-95BB-650E9804D239}\ISSetup.dll
2010-07-29 13:09 . 2010-07-29 13:09 -------- d-----w- c:\programdata\BCR
2010-07-29 13:01 . 2010-01-10 12:49 -------- d-----w- c:\program files\OpenAL
2010-07-07 07:39 . 2009-12-24 19:29 -------- d-----w- c:\users\Sashinho\AppData\Roaming\dvdcss
2010-07-05 13:02 . 2010-06-29 21:45 -------- d-----w- c:\program files\McAfee Security Scan
2010-07-01 12:04 . 2010-07-01 12:04 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb741A.tmp.exe
2010-06-18 14:22 . 2010-06-18 14:22 72504 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-06-18 14:18 . 2010-06-18 14:18 71992 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-10 18:17 . 2010-06-21 08:06 1115424 ----a-w- c:\windows\system32\libeay32.dll
2009-12-11 20:30 . 2009-12-11 20:30 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-10-27 10:05 40496 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-11-17 135168]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-12-12 1840424]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-14 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-18 205976]
"Steam"="d:\gamez\Steam\Steam.exe" [2010-08-25 1242448]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-06-05 253696]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-04-15 440864]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2008-10-27 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2008-10-27 346672]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-06 7227936]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-27 1434920]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-04-13 3553792]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-03-05 805384]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-04-13 156968]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-04-13 202024]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-03-05 173288]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-06 1833504]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-02-10 745472]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-26 13814376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
" Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-4-3 565248]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-4-13 791840]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
VPN Client.lnk - c:\windows\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico [2009-12-10 6144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"RGSC"=d:\gamez\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):91,d9,92,87,7b,84,ca,01
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 135664]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-04-20 43688]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-20 29472]
R3 GarenaPEngine;GarenaPEngine;c:\users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp [x]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-11 30192]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-05-18 119256]
R3 Ltn_stk7770P;PCTV LITEON based TV tuner TT1280DA device;c:\windows\system32\DRIVERS\Ltn_stk7770P.sys [2008-06-25 596096]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-12-10 691696]
S0 AlfaFF;AlfaFF;c:\windows\system32\drivers\AlfaFF.sys [2008-07-10 42608]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/09/14 18:15];c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2009-03-05 15:46 87536]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]
S2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2009-04-14 75048]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-04-15 703008]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2009-09-14 26928]
S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [2009-04-13 3441152]
S2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2008-10-09 19504]
S2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2008-10-09 16432]
S2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2008-10-09 59952]
S2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2008-10-27 306736]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-06-05 62208]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-02-05 237568]
S2 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2010-07-06 716024]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-09-03 223232]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]
--- Andere Dienste/Treiber im Speicher ---
*Deregistered* - hzicoziy
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bthsvcs REG_MULTI_SZ BthServ
Akamai REG_MULTI_SZ Akamai
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
2010-08-27 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-14 12:17]
2010-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 17:40]
2010-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-29 17:40]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0909&m=1zy9bbr0tn5
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6522
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {1E403D09-641B-4015-87DC-CE44C720E441} = 213.168.112.60,194.8.194.60
FF - ProfilePath - c:\users\Sashinho\AppData\Roaming\Mozilla\Firefox\Profiles\cn2dlidy.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKCU-Run-borobororb.exe - c:\borobororb.exe\borobororb.exe
HKCU-Run-cfxadpei - c:\users\Sashinho\AppData\Local\nujxtecya\vsyghrvshdw.exe
HKCU-Run-NetLog2 - c:\windows\svc2.exe
**************************************************************************
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien:
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\GarenaPEngine]
"ImagePath"="\??\c:\users\Sashinho\AppData\Local\Temp\YDLFAEB.tmp"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\hzicoziy]
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-1239136018-1507258121-1134437384-1000\Software\SecuROM\License information*]
"datasecu"=hex:9a,6b,ae,17,cd,c0,c9,9c,33,2c,20,bc,83,6f,c9,59,c9,a9,e5,16,68,
4b,76,d5,e6,c9,7e,4d,f2,c0,a8,04,15,95,29,7e,43,ad,c4,e2,57,b2,1a,64,2e,ee,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'Explorer.exe'(2560)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlUI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlOP.dll
c:\program files\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\program files\Common Files\Nero\Lib\MediaLibraryNSE.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\system32\nvvsvc.exe
c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Acer Bio Protection\CompPtcVUI.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conime.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmplayer.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-29 14:21:24 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-08-29 12:21
Vor Suchlauf: 10 Verzeichnis(se), 61.703.335.936 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 61.061.079.040 Bytes frei
- - End Of File - - 39F1B42C52A8111016CF9C8F6E823E5A
 Der GMAER Scan ist unterwegs, aber kann mir denn keiner helfen ??? Aus den obigen logs lässt sich doch schon bestimmt was erkennen, oder noch nicht ?!?!? Bin seit 2 Tagen mit dieser Plage dran und muss dringend für die Hausarbeit weitermachen, also bitte helft mir schnell !!! Danke Sascha So, hier noch der GMER SCAN !!! Bitte helft mir schnell...!!! GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-08-29 15:04:28
Windows 6.0.6002 Service Pack 2
Running: 1jdl0u97.exe; Driver: C:\Users\Sashinho\AppData\Local\Temp\aglyrkow.sys
---- Kernel code sections - GMER 1.0.15 ----
? System32\Drivers\hzicoziy.sys Ein an das System angeschlossenes Gerät funktioniert nicht. !
.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0xA1722300, 0x3B6D8, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0xA171B300, 0x1BEE, 0xE8000020]
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl section is writeable [0xA42FB000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl entry point in ".vmp2" section [0xA431E050]
? C:\ComboFix\catchme.sys Das System kann den angegebenen Pfad nicht finden. !
? C:\Windows\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\Windows\Explorer.exe[2560] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C9 767BB364 4 Bytes [B0, 22, 00, 10] {MOV AL, 0x22; ADD [EAX], DL}
.text C:\Program Files\Tunngle\TnglCtrl.exe[3288] ntdll.dll!DbgBreakPoint 777E8B2E 1 Byte [90]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [10002480] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [10001DA0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [100027D0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Windows\Explorer.exe[2560] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [10001290] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/EgisTec Inc.)
IAT C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2604] @ C:\Windows\system32\SHELL32.dll [USER32.dll!ExitWindowsEx] [016B1210] C:\Program Files\NewTech Infosystems\Acer Backup Manager\Pehook.dll (Backup Manager Module/NewTech Infosystems, Inc.)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 88CF7D30
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Services - GMER 1.0.15 ----
Service (*** hidden *** ) [BOOT] hzicoziy <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\0c6076aebbd1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE0 0x54 0xAF 0x72 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2C 0x22 0x9F 0x83 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x09 0x0E 0x71 0x1F ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0c6076aebbd1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\hzicoziy@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\hzicoziy@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xD8 0xF6 0x6A 0x2E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x19 0x2D 0x58 0x51 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xD7 0x35 0x1F 0x09 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCC 0x11 0x8D 0x3F ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2C 0x22 0x9F 0x83 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0C 0x25 0x4E 0x1A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0c6076aebbd1
Reg HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\hzicoziy@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xD8 0xF6 0x6A 0x2E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x19 0x2D 0x58 0x51 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xD7 0x35 0x1F 0x09 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCC 0x11 0x8D 0x3F ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2C 0x22 0x9F 0x83 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0C 0x25 0x4E 0x1A ...
---- EOF - GMER 1.0.15 ----
Liebes Forum, nachdem mir leider immer noch keiner geantwortet hat ist nun folgendes Stand der Dinge ! Habe alles auf eigene Faust wegbekommen, bis auf die Tatsache dass er neu startet und alles blockiert sobald das Internet aktiviert wird (das Problem hatten ja schon sehr viele hier im Board!). Habe von OTL, Combofix und GMER die Logfiles gepostet und da müsste der Fehler doch zu entdecken sein!!! Also gebt euch bitte 2 Minuten Mühe und sagt mir was ich noch löschen muss denn ich verzweifele und die zeit rennt !!! Vielen Dank schonmal... Lg Sascha |
|
29.08.2010, 18:06
| #2 |
| /// Malwareteam   | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 Lade den Avenger herunter und entzippe ihn auf den Desktop. Nicht gezippt direkt als EXE ist der Avenger hier erhältlich. Starte die avenger.exe durch Doppelklick und akzeptiere mit OK die Nutzungsbedingungen. Füge den Inhalt der folgenden Codebox vollständig und unverändert bei "Input script here" ein und klicke auf "Execute". Beantworte die Frage, ob Du sicher bist, dass das Skript ausgeführt werden soll mit "Ja". Code:
ATTFilter Drivers to disable:
hzicoziy
Drivers to delete:
hzicoziy
Files to delete:
C:\Windows\System32\drivers\hzicoziy.sys
Schritt 2 Gehe in den abgesicherten Modus (Link bitte unbedingt anklicken & lesen!) von windows Drücke beim Hochfahren des rechners [F8] (bei win xp) solange, bis du eine auswahlmöglichkeit hast. Wähle hier:Abgesicherter Modus mit Netzwerktreibern Schritt 3 Proxy deaktivieren IE => Extras => Internetoptionen => Verbindungen => Lan-Einstellungen Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen Firefox => Extras => Einstellungen => Erweitert => Netzwerk => Einstellungen. Dort unter Verbindungs-Einstellungen => Kein Proxy anhaken. Schritt 4
Nun wechsle wieder in den Normalmodus. Schritt 5 Downloade Malwarebytes Anti-Malware (ca. 2 MB) von diesen Downloadspiegel: Malwarebytes
Schritt 6 Erneuter Systemscan mit OTL
|
|
29.08.2010, 18:17
| #3 |
| | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Logfile of The Avenger Version 2.0, (c) by Swandog46
__________________hxxp://swandog46.geekstogo.com Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Driver "hzicoziy" disabled successfully. Driver "hzicoziy" deleted successfully. File "C:\Windows\System32\drivers\hzicoziy.sys" deleted successfully. Completed script processing. ******************* Finished! Terminate. |
|
29.08.2010, 18:27
| #4 |
| | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet This log file is located at C:\rkill.log. Please post this only if requested to by the person helping you. Otherwise you can close this log when you wish. Ran as Sashinho on 29.08.2010 at 19:26:09. Processes terminated by Rkill or while it was running: Rkill completed on 29.08.2010 at 19:26:14. |
|
29.08.2010, 18:40
| #5 |
| | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Erst mal Danke dass sich doch noch einer meinem Probklem annimmt ! Der vollständige Malwarebytes scan scheint im moment durchzulaufen und internet verbindung besteht und er ist noch nicht runter gefahren...sobald der scan durch ist poste ich ihn direkt. danke sascha |
|
29.08.2010, 20:26
| #6 |
| | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4503 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 29.08.2010 21:24:15 mbam-log-2010-08-29 (21-24-15).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|) Durchsuchte Objekte: 510432 Laufzeit: 1 Stunde(n), 52 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Läuft bis jetzt stabil der Laptop trotz Internet-Verbindung  Noch was ? Geändert von Sashinho (29.08.2010 um 20:28 Uhr) Grund: Ergänzung |
|
29.08.2010, 20:59
| #7 |
| /// Malwareteam | Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet Schritt 6 fehlt noch. |
|
| Themen zu Ein kritischer Fehler ist aufgetreten, Windows wird in einer Minute neu gestartet |
| 0 bytes, 32 bit, 4d36e972-e325-11ce-bfc1-08002be10318, agere systems, alles blockiert, alternate, battle.net, c:\windows\system32\rundll32.exe, call of duty, combofix, components, controlset002, corp./icp, excel.exe, fehler, fontcache, gestartet, hijack, hijackthis, hoffe, home premium, iastor.sys, intranet, kollege, kritischer, kritischer fehler, launch, local\temp, location, locker, logfile, lösen, media center, minute, mywinlocker, neu, neustart., ntdll.dll, nvlddmkm.sys, nvstor.sys, oldtimer, otl.exe, plug-in, problem, procexp113.sys, programdata, richtlinie, searchplugins, security scan, sptd.sys, start menu, vista 32, vista 32 bit, windows, windows wird in einer minute neu gestartet, wrapper |
Linear-Darstellung
