| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Antimalware DoctorWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.09.2010, 00:01
| #1 |
| |  Antimalware Doctor Hallo, Ich hatte mir vorhin den Antimalware Doctor eingefangen, schaute anscheinend auf nicht so sichere Seiten wo auf einmal das Antimalware Doctor Fenster aufging, konnte es nicht Beenden blieb dauerhaft, und mein AVG schlug die ganze Zeit an. Durch das Googeln bin Ich auf eure Seite gestossen, habe wie beschrieben das rkill Tool benutzt, womit jetzt endlich der Antimalware Doctor beendet war. Habe mit Malwarebytes Anti Malware mein System gescannt, und die befallen Daten gelöscht, wie beschrieben. Hier die Log File aus der Aktion: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4517 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 31.08.2010 23:43:09 mbam-log-2010-08-31 (23-43-09).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 133728 Laufzeit: 2 Minute(n), 1 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 2 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 7 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amxrsecwno.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mediafix70700en02.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Users\XXX\AppData\Local\Temp\amxrsecwno.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Roaming\8B0718836E8CC71BB407EE2BAAE077FE\mediafix70700en02.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Local\Temp\mwesacnxor.exe (Adware.BHO) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Local\Temp\wsocxanmer.exe (Rootkit.Dropper) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully. Hatte auch im Forum gelesen das ein kompletter Scan Log von Malwarebytes gebraucht wird, und die zwei Logs von dem OTL Tool. Hier der komplette Scan Log von Malwarebytes: kiMalwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4517 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 01.09.2010 00:33:14 mbam-log-2010-09-01 (00-33-14).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 203883 Laufzeit: 14 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Und hier die erste Log von OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.09.2010 00:39:09 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Patrick\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 25,30 Gb Total Space | 6,24 Gb Free Space | 24,68% Space Free | Partition Type: NTFS Drive D: | 245,04 Gb Total Space | 203,35 Gb Free Space | 82,99% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 195,31 Gb Total Space | 159,44 Gb Free Space | 81,63% Space Free | Partition Type: NTFS H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: XXX-PC Current User Name: XXX Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\XXX\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\SysWOW64\PnkBstrB.exe () PRC - D:\-Progs-\Mozilla\firefox.exe (Mozilla Corporation) PRC - D:\-Progs-\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - D:\-Progs-\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - D:\-Progs-\Razer_Mamba\RazerTray.exe (Razer USA Ltd) ========== Modules (SafeList) ========== MOD - C:\Users\Patrick\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (PnkBstrB) -- C:\Windows\SysNative\PnkBstrB.exe File not found SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found SRV - (PnkBstrB) -- C:\Windows\SysWOW64\PnkBstrB.exe () SRV - (avg9emc) -- D:\-Progs-\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.) SRV - (avg9wd) -- D:\-Progs-\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (TeamViewer5) -- D:\-Progs-\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (AvgTdiA) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AvgLdx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AvgMfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH) DRV:64bit: - (Lycosa) -- C:\Windows\SysNative\drivers\Lycosa.sys (Razer USA Ltd.) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (SaiNtBus) -- C:\Windows\SysNative\drivers\SaiBus.sys (Saitek) DRV:64bit: - (SaiMini) -- C:\Windows\SysNative\drivers\SaiMini.sys (Saitek) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (SaiK0728) -- C:\Windows\SysNative\drivers\SaiK0728.sys (Saitek) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4B 9A 6B 2A 8C FF CA 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://de.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official" FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.18.0 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5 FF - prefs.js..extensions.enabledItems: extension@virtusdesigns.com:3.6.6 FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.6 FF - prefs.js..extensions.enabledItems: {241aae70-0022-11de-87af-0800200c9a66}:3.6.30.01.10 FF - prefs.js..extensions.enabledItems: glaze_black@www.theme-oasis.org:3.3 FF - prefs.js..keyword.URL: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: D:\-Progs-\Mozilla\components [2010.07.26 23:04:43 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: D:\-Progs-\Mozilla\plugins [2010.07.26 23:04:43 | 000,000,000 | ---D | M] [2010.04.17 18:55:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Extensions [2010.08.31 23:01:59 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions [2010.05.12 19:34:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.17 19:02:51 | 000,000,000 | ---D | M] (Blue Fox) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{241aae70-0022-11de-87af-0800200c9a66} [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (Aero Fox XL) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66} [2010.04.17 19:02:53 | 000,000,000 | ---D | M] (PitchDark) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66} [2010.06.29 17:09:41 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\battlefieldheroespatcher@ea.com [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com [2010.04.17 19:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\glaze_black@www.theme-oasis.org [2010.04.17 19:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\martin@hoerandl.com [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\__MACOSX [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\chrome [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\defaults [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions [2010.08.28 14:04:28 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\Mozilla\FireFox\Profiles\82qdz1dx.default\searchplugins\icqplugin-1.xml [2008.07.10 14:58:44 | 000,000,944 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\Mozilla\FireFox\Profiles\82qdz1dx.default\searchplugins\icqplugin.xml O1 HOSTS File: ([2010.04.25 16:18:21 | 000,000,842 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 71i.de O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\-Progs-\AVG\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\-Progs-\AVG\avgssie.dll (AVG Technologies CZ, s.r.o.) O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\GrabPro.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\GrabPro.dll () O4:64bit: - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4:64bit: - HKLM..\Run: [SaiVolume] C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe (Saitek) O4 - HKLM..\Run: [AVG9_TRAY] D:\-Progs-\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [Razer Mamba Driver] D:\-Progs-\Razer_Mamba\RazerTray.exe (Razer USA Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: &Download by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: &Grab video by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Down&load all by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Download by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - D:\-Progs-\Icq\ICQ7.1\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - D:\-Progs-\Icq\ICQ7.1\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\-Progs-\AVG\avgppa.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\-Progs-\AVG\avgpp.dll (AVG Technologies CZ, s.r.o.) O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.) O20 - AppInit_DLLs: (avgrssta.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.09.01 00:14:15 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2010.08.31 23:32:19 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Malwarebytes [2010.08.31 23:26:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.08.31 23:26:18 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.08.31 23:26:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.08.31 23:26:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.08.31 23:15:03 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\8B0718836E8CC71BB407EE2BAAE077FE [2010.08.25 17:36:18 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll [2010.08.20 19:40:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Saitek [2010.08.20 19:39:41 | 000,000,000 | ---D | C] -- C:\Programme\Saitek [2010.08.20 19:26:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2010.08.13 17:36:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Saitek SD6 Profiles [2010.08.13 16:16:32 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2010.08.13 16:16:32 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2010.08.13 16:16:31 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2010.08.13 16:16:28 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2010.08.13 16:16:28 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2010.08.13 16:16:28 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2010.08.13 16:16:28 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2010.08.13 16:16:28 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2010.08.13 16:16:28 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2010.08.13 16:16:26 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll [2010.08.13 16:16:26 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rtutils.dll [2010.08.13 16:16:26 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rtutils.dll [2010.08.11 19:34:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx [2010.08.11 19:29:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2010.08.11 19:29:36 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation [2010.08.11 19:26:11 | 005,107,816 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2010.08.11 19:26:11 | 000,065,128 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2010.08.11 19:26:11 | 000,056,936 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2010.08.11 19:26:11 | 000,011,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvBridge.kmd [2010.08.11 19:26:10 | 019,114,088 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2010.08.11 19:26:10 | 014,092,904 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2010.08.11 19:26:10 | 000,382,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdecodemft.dll [2010.08.11 19:26:10 | 000,314,984 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvdecodemft.dll [2010.08.11 19:26:08 | 012,471,400 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2010.08.11 19:26:08 | 009,818,728 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2010.08.11 19:26:08 | 003,089,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2010.08.11 19:26:08 | 002,892,904 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2010.08.11 19:26:08 | 002,761,832 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2010.08.11 19:26:08 | 002,506,344 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2010.08.11 19:26:07 | 014,513,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2010.08.11 19:26:07 | 010,267,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2010.08.11 19:26:07 | 006,116,968 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2010.08.11 19:26:07 | 004,553,832 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2010.08.11 19:26:07 | 002,037,864 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll [2010.08.11 19:26:07 | 001,625,192 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll [2010.08.11 19:26:07 | 000,260,712 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcod1922.dll [2010.08.11 19:26:07 | 000,260,712 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcod.dll [2010.08.11 19:26:03 | 000,000,000 | ---D | C] -- C:\NVIDIA [2010.08.10 19:44:05 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Ashampoo [2010.08.10 19:41:13 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Local\ashampoo [2010.08.10 19:41:13 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo ========== Files - Modified Within 30 Days ========== [2010.09.01 00:37:43 | 001,048,576 | -HS- | M] () -- C:\Users\Patrick\NTUSER.DAT [2010.09.01 00:14:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2010.08.31 23:52:59 | 000,015,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.31 23:52:59 | 000,015,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.31 23:49:56 | 001,527,504 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.08.31 23:49:56 | 000,664,396 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.08.31 23:49:56 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.08.31 23:49:56 | 000,134,564 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.08.31 23:49:56 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.08.31 23:45:47 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.31 23:45:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.31 23:45:42 | 3217,674,240 | -HS- | M] () -- C:\hiberfil.sys [2010.08.31 23:44:44 | 002,546,072 | -H-- | M] () -- C:\Users\Patrick\AppData\Local\IconCache.db [2010.08.31 20:10:51 | 064,128,344 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm [2010.08.31 05:22:16 | 000,218,464 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2010.08.31 05:21:03 | 000,218,464 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.08.13 17:35:39 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0728_01005.Wdf [2010.08.13 16:21:21 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2010.08.28 00:48:40 | 000,218,464 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.08.13 17:35:39 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0728_01005.Wdf [2010.07.09 21:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll [2010.04.25 21:58:26 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.04.18 02:35:31 | 000,003,936 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile2.dat [2010.04.18 02:35:31 | 000,003,934 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile1.dat [2010.04.18 02:35:31 | 000,002,652 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile0.dat [2010.04.17 21:59:17 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini [2009.11.06 10:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2007.07.19 12:50:12 | 000,104,520 | ---- | C] () -- C:\Windows\SysWow64\OSD.dll < End of report > Hier die Zweite Log von OTL:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 01.09.2010 00:39:09 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Patrick\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 25,30 Gb Total Space | 6,24 Gb Free Space | 24,68% Space Free | Partition Type: NTFS
Drive D: | 245,04 Gb Total Space | 203,35 Gb Free Space | 82,99% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 195,31 Gb Total Space | 159,44 Gb Free Space | 81,63% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: XXX-PC
Current User Name: XXX
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\-Progs-\Mozilla\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitdm.exe" = D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitnet.exe" = D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitdm.exe" = D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitnet.exe" = D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{34280DB1-8558-4709-AB7E-62A572C03355}" = Saitek Cyborg Keyboard Volume 6.2.1.3
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{899FCA36-ADAF-4612-8579-B37DDB0C092F}" = Saitek SD6 Programming Software 6.6.6.9
"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.1 Build #2096 Banner Remover 1.0
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{4E25C468-7745-4051-8B37-4A2C6635BA8B}" = Update Manager B09.0908.1
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{5454083B-1308-4485-BF17-111000028702}" = Grand Theft Auto: Episodes from Liberty City
"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City
"{6C6ED584-9F75-4235-8718-1F35B59814E8}" = Mamba Firmware Updater 1.13
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7BE49DA7-EDA4-4C63-AA06-DCDF6858C3F3}" = Razer Mamba
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"APB Europe" = APB Europe
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced
"AVG9Uninstall" = AVG Free 9.0
"CCleaner" = CCleaner
"InstallShield_{4E25C468-7745-4051-8B37-4A2C6635BA8B}" = Update Manager B09.0908.1
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MozBackup" = MozBackup 1.4.10
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Orbit_is1" = Orbit Downloader
"PokerStars" = PokerStars
"PunkBusterSvc" = PunkBuster Services
"TeamViewer 5" = TeamViewer 5
"VLC media player" = VLC media player 1.0.5
"Xfire" = Xfire (remove only)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
Ich hoffe habe alles richtig befolgt und konnte weiterhelfen. Würde mich sehr über eine Antwort freuen Mit grossen Dank verbunden Gruss Patrick |
|
01.09.2010, 18:57
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Antimalware Doctor Das OTL-Log sieht rel. unauffällig aus. Mach mal das hier:
__________________CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ |
|
01.09.2010, 19:48
| #3 |
| | Antimalware Doctor Guten Abend,
__________________ja vielen Dank erstmal für die Antwort, habe alles befolgt wie beschrieben. Habe aber nur eine Log auf dem Desktop und das ist die Normale Otl diese Extra Log habe ich nicht, diese Extra Log Datei hatte Ich aber gestern mit dem Scan auf dem Desktop. Die hatte Ich auch in dem Post von gestern kopiert. Hier also die Otl Log aus dem Scan von eben:OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.09.2010 20:32:17 - Run 2 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Patrick\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 73,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 85,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 25,30 Gb Total Space | 6,20 Gb Free Space | 24,51% Space Free | Partition Type: NTFS Drive D: | 245,04 Gb Total Space | 203,35 Gb Free Space | 82,99% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 195,31 Gb Total Space | 159,37 Gb Free Space | 81,60% Space Free | Partition Type: NTFS H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PATRICK-PC Current User Name: Patrick Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Minimal Quick Scan ========== Processes (SafeList) ========== PRC - C:\Users\Patrick\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\SysWOW64\PnkBstrB.exe () PRC - D:\-Progs-\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - D:\-Progs-\AVG\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - D:\-Progs-\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - D:\-Progs-\Razer_Mamba\RazerTray.exe (Razer USA Ltd) ========== Modules (SafeList) ========== MOD - C:\Users\Patrick\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (PnkBstrB) -- C:\Windows\SysNative\PnkBstrB.exe File not found SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found SRV - (PnkBstrB) -- C:\Windows\SysWOW64\PnkBstrB.exe () SRV - (avg9emc) -- D:\-Progs-\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.) SRV - (avg9wd) -- D:\-Progs-\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (TeamViewer5) -- D:\-Progs-\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (AvgTdiA) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AvgLdx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AvgMfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH) DRV:64bit: - (Lycosa) -- C:\Windows\SysNative\drivers\Lycosa.sys (Razer USA Ltd.) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (SaiNtBus) -- C:\Windows\SysNative\drivers\SaiBus.sys (Saitek) DRV:64bit: - (SaiMini) -- C:\Windows\SysNative\drivers\SaiMini.sys (Saitek) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (SaiK0728) -- C:\Windows\SysNative\drivers\SaiK0728.sys (Saitek) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4B 9A 6B 2A 8C FF CA 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://de.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official" FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.18.0 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5 FF - prefs.js..extensions.enabledItems: extension@virtusdesigns.com:3.6.6 FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.6 FF - prefs.js..extensions.enabledItems: {241aae70-0022-11de-87af-0800200c9a66}:3.6.30.01.10 FF - prefs.js..extensions.enabledItems: glaze_black@www.theme-oasis.org:3.3 FF - prefs.js..keyword.URL: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: D:\-Progs-\Mozilla\components [2010.07.26 23:04:43 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: D:\-Progs-\Mozilla\plugins [2010.07.26 23:04:43 | 000,000,000 | ---D | M] [2010.04.17 18:55:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Extensions [2010.08.31 23:01:59 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions [2010.05.12 19:34:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.04.17 19:02:51 | 000,000,000 | ---D | M] (Blue Fox) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{241aae70-0022-11de-87af-0800200c9a66} [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (Aero Fox XL) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66} [2010.04.17 19:02:53 | 000,000,000 | ---D | M] (PitchDark) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66} [2010.06.29 17:09:41 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\battlefieldheroespatcher@ea.com [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com [2010.04.17 19:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\glaze_black@www.theme-oasis.org [2010.04.17 19:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\martin@hoerandl.com [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\__MACOSX [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\chrome [2010.08.17 23:25:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\extension@virtusdesigns.com\defaults [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions [2010.08.17 23:24:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\82qdz1dx.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions [2010.08.28 14:04:28 | 000,000,950 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\Mozilla\FireFox\Profiles\82qdz1dx.default\searchplugins\icqplugin-1.xml [2008.07.10 14:58:44 | 000,000,944 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\Mozilla\FireFox\Profiles\82qdz1dx.default\searchplugins\icqplugin.xml O1 HOSTS File: ([2010.04.25 16:18:21 | 000,000,842 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 71i.de O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\-Progs-\AVG\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\-Progs-\AVG\avgssie.dll (AVG Technologies CZ, s.r.o.) O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\GrabPro.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\-Progs-\Orbit_Downloader\Orbitdownloader\GrabPro.dll () O4:64bit: - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4:64bit: - HKLM..\Run: [SaiVolume] C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe (Saitek) O4 - HKLM..\Run: [AVG9_TRAY] D:\-Progs-\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [Razer Mamba Driver] D:\-Progs-\Razer_Mamba\RazerTray.exe (Razer USA Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: &Download by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: &Grab video by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Down&load all by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Download by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - D:\-Progs-\Orbit_Downloader\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - D:\-Progs-\Icq\ICQ7.1\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - D:\-Progs-\Icq\ICQ7.1\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\-Progs-\AVG\avgppa.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\-Progs-\AVG\avgpp.dll (AVG Technologies CZ, s.r.o.) O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.) O20 - AppInit_DLLs: (avgrssta.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - D:\-Progs-\Adobe\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: GBTUpd - hkey= - key= - C:\Program Files (x86)\GIGABYTE\GBTUpd\PreRun.exe (PreRun) MsConfig:64bit - StartUpReg: XboxStat - hkey= - key= - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) SafeBootMin:64bit: AppMgmt - Service SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - Service SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll () Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll () CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 90 Days ========== [2010.09.01 20:29:12 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2010.09.01 01:20:42 | 000,000,000 | ---D | C] -- C:\Users\Patrick\Desktop\Malware [2010.08.31 23:32:19 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Malwarebytes [2010.08.31 23:26:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.08.31 23:26:18 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.08.31 23:26:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.08.31 23:26:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.08.31 23:15:03 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\8B0718836E8CC71BB407EE2BAAE077FE [2010.08.20 19:40:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Saitek [2010.08.20 19:39:41 | 000,000,000 | ---D | C] -- C:\Programme\Saitek [2010.08.20 19:26:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2010.08.13 17:36:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Saitek SD6 Profiles [2010.08.11 19:34:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx [2010.08.11 19:29:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2010.08.11 19:29:36 | 000,000,000 | ---D | C] -- C:\Programme\NVIDIA Corporation [2010.08.11 19:26:11 | 000,065,128 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2010.08.11 19:26:11 | 000,056,936 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2010.08.11 19:26:03 | 000,000,000 | ---D | C] -- C:\NVIDIA [2010.08.10 19:44:05 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Ashampoo [2010.08.10 19:41:13 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Local\ashampoo [2010.08.10 19:41:13 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo [2010.07.18 15:39:13 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\AppLauncher [2010.07.15 15:38:57 | 000,013,048 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll [2010.07.07 16:38:54 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\NVIDIA [2010.06.17 21:23:44 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2010.06.10 17:23:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QS [2010.06.10 17:23:04 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\TeamViewer [2010.06.10 17:22:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer [2010.06.07 22:49:53 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2010.06.07 22:49:53 | 000,000,000 | ---D | C] -- C:\Programme\Realtek [2010.06.07 22:49:41 | 002,610,008 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll [2010.06.07 22:49:41 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2010.06.07 22:49:41 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2010.06.07 22:49:41 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2010.06.07 22:49:41 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2010.06.07 22:49:40 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll [2010.06.07 22:49:40 | 001,733,464 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll [2010.06.07 22:49:40 | 001,325,328 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll [2010.06.07 22:49:40 | 001,178,384 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll [2010.06.07 22:49:40 | 001,110,800 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll [2010.06.07 22:49:40 | 000,504,592 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll [2010.06.07 22:49:40 | 000,489,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll [2010.06.07 22:49:40 | 000,474,896 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll [2010.06.07 22:49:40 | 000,372,936 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2010.06.07 22:49:40 | 000,335,192 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll [2010.06.07 22:49:40 | 000,335,192 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll [2010.06.07 22:49:40 | 000,330,656 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2010.06.07 22:49:40 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2010.06.07 22:49:40 | 000,315,152 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll [2010.06.07 22:49:40 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2010.06.07 22:49:40 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2010.06.07 22:49:40 | 000,268,560 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll [2010.06.07 22:49:40 | 000,265,488 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll [2010.06.07 22:49:40 | 000,201,928 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2010.06.07 22:49:40 | 000,123,664 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll [2010.06.07 22:49:40 | 000,123,152 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll [2010.06.07 22:49:40 | 000,122,128 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll [2010.06.07 22:49:40 | 000,099,016 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2010.06.07 22:49:40 | 000,076,488 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2010.06.07 22:49:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2010.06.04 23:28:27 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Xbox 360 Accessories [2010.06.04 23:23:40 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Local\ElevatedDiagnostics ========== Files - Modified Within 90 Days ========== [2010.09.01 20:29:37 | 001,048,576 | -HS- | M] () -- C:\Users\Patrick\NTUSER.DAT [2010.09.01 20:29:12 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe [2010.09.01 16:19:40 | 000,015,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.09.01 16:19:40 | 000,015,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.09.01 16:19:21 | 001,527,504 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.09.01 16:19:21 | 000,664,396 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.09.01 16:19:21 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.09.01 16:19:21 | 000,134,564 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.09.01 16:19:21 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.09.01 16:18:28 | 064,153,839 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm [2010.09.01 16:12:24 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.09.01 16:12:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.09.01 16:12:18 | 3217,674,240 | -HS- | M] () -- C:\hiberfil.sys [2010.09.01 05:50:07 | 002,548,090 | -H-- | M] () -- C:\Users\Patrick\AppData\Local\IconCache.db [2010.09.01 05:40:47 | 000,218,464 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2010.09.01 05:40:47 | 000,218,464 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.08.13 17:35:39 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0728_01005.Wdf [2010.08.13 16:21:21 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.07.18 15:38:43 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.07.18 15:38:37 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_EhStorPwdDrv_01_09_00.Wdf [2010.07.15 15:38:57 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgtdia.sys [2010.07.15 15:38:57 | 000,013,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\avgrssta.dll [2010.07.15 15:38:40 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys [2010.07.10 00:38:00 | 000,065,128 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2010.07.10 00:38:00 | 000,056,936 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2010.07.10 00:38:00 | 000,012,264 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb [2010.07.09 21:04:40 | 000,041,872 | ---- | M] () -- C:\Windows\SysWow64\xfcodec.dll [2010.07.09 21:04:40 | 000,027,536 | ---- | M] () -- C:\Windows\SysNative\xfcodec64.dll [2010.07.07 16:34:11 | 000,075,064 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010.06.09 18:20:22 | 002,444,656 | ---- | M] () -- C:\Windows\SysWow64\pbsvc_apb.exe ========== Files Created - No Company Name ========== [2010.08.28 00:48:40 | 000,218,464 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.08.13 17:35:39 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0728_01005.Wdf [2010.07.18 15:38:43 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.07.18 15:38:37 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_EhStorPwdDrv_01_09_00.Wdf [2010.07.09 21:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll [2010.07.09 21:04:40 | 000,027,536 | ---- | C] () -- C:\Windows\SysNative\xfcodec64.dll [2010.07.07 16:34:10 | 002,444,656 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_apb.exe [2010.04.25 21:58:26 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.04.18 02:35:31 | 000,003,936 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile2.dat [2010.04.18 02:35:31 | 000,003,934 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile1.dat [2010.04.18 02:35:31 | 000,002,652 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\Profile0.dat [2010.04.17 21:59:17 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini [2009.11.06 10:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2007.07.19 12:50:12 | 000,104,520 | ---- | C] () -- C:\Windows\SysWow64\OSD.dll ========== LOP Check ========== [2010.08.31 23:15:06 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\8B0718836E8CC71BB407EE2BAAE077FE [2010.07.18 15:39:13 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\AppLauncher [2010.08.10 19:50:26 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Ashampoo [2010.04.23 20:08:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\DAEMON Tools Lite [2010.04.21 16:51:11 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\GrabPro [2010.08.30 19:08:37 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\ICQ [2010.08.13 22:31:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Orbit [2010.06.03 19:14:03 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Razer [2010.06.10 17:45:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\TeamViewer [2010.05.08 16:37:34 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\The Creative Assembly [2010.04.18 13:44:21 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\TS3Client [2010.06.30 15:24:05 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.08.31 23:15:06 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\8B0718836E8CC71BB407EE2BAAE077FE [2010.05.11 22:38:28 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Adobe [2010.07.18 15:39:13 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\AppLauncher [2010.08.10 19:50:26 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Ashampoo [2010.04.23 20:08:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\DAEMON Tools Lite [2010.04.21 16:51:11 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\GrabPro [2010.08.30 19:08:37 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\ICQ [2010.04.17 17:45:08 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Identities [2010.04.17 17:53:46 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Macromedia [2010.08.31 23:32:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Malwarebytes [2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Media Center Programs [2010.07.19 15:32:29 | 000,000,000 | --SD | M] -- C:\Users\Patrick\AppData\Roaming\Microsoft [2010.04.17 18:55:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Mozilla [2010.07.07 16:38:54 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\NVIDIA [2010.08.13 22:31:10 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Orbit [2010.06.03 19:14:03 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Razer [2010.04.20 21:18:06 | 000,000,000 | RH-D | M] -- C:\Users\Patrick\AppData\Roaming\SecuROM [2010.06.10 17:45:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\TeamViewer [2010.05.08 16:37:34 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\The Creative Assembly [2010.04.18 13:44:21 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\TS3Client [2010.08.29 18:14:36 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\vlc [2010.07.18 15:36:55 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\WinRAR [2010.09.01 03:55:14 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Xfire < %APPDATA%\*.exe /s > [2009.08.10 19:36:16 | 007,344,128 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\AppLauncher.exe [2010.07.18 15:39:13 | 000,667,648 | ---- | M] (TODO: <Company name>) -- C:\Users\Patrick\AppData\Roaming\AppLauncher\Data Recovery.exe [2010.07.18 15:39:13 | 002,695,168 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\DataSync.exe [2010.07.18 15:39:13 | 001,294,336 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\LOCK.exe [2010.07.18 15:39:13 | 000,770,048 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\MakeBootable.exe [2010.07.18 15:39:13 | 000,561,152 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\PCLock.exe [2010.07.18 15:39:13 | 000,208,896 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\Reset.exe [2010.07.18 15:39:13 | 000,462,848 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\SecretZip.exe [2010.06.24 10:15:20 | 001,328,504 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\82qdz1dx.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTORV.SYS > [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < End of report > Hoffe konnte so weiterhelfen, und würde mich über eine Antwort sehr freuen. Mit Dank verbunden Gruss Patrick |
|
02.09.2010, 09:42
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware DoctorCode:
ATTFilter [2010.07.18 15:39:13 | 000,667,648 | ---- | M] (TODO: <Company name>) -- C:\Users\Patrick\AppData\Roaming\AppLauncher\Data Recovery.exe
[2010.07.18 15:39:13 | 002,695,168 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\DataSync.exe
[2010.07.18 15:39:13 | 001,294,336 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\LOCK.exe
[2010.07.18 15:39:13 | 000,770,048 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\MakeBootable.exe
[2010.07.18 15:39:13 | 000,561,152 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\PCLock.exe
[2010.07.18 15:39:13 | 000,208,896 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\Reset.exe
[2010.07.18 15:39:13 | 000,462,848 | ---- | M] () -- C:\Users\Patrick\AppData\Roaming\AppLauncher\SecretZip.exe
Wenn eine Datei schon ausgewerte sein sollte, bitte eine weitere Auswertung starten.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
02.09.2010, 13:32
| #5 |
| | Antimalware Doctor Mahlzeit, erstmal grossen Dank für deine Hilfe  Hier der Link zum Ergebniss zu Data Recovery.exe: hxxp://www.virustotal.com/file-scan/report.html?id=75fd404b7d26f315f5f2b623188d67f154271ac626b4ca74f582c8fb26352737-1283429507 Zu DataSync.exe: hxxp://www.virustotal.com/file-scan/report.html?id=629057724a1561dddae6af71e806bb2261c7f04d05f664b59d349272723cf6a7-1283430058 Zu LOCK.exe: hxxp://www.virustotal.com/file-scan/report.html?id=a233df34ce4d19f018f3b655c1f8c11a25133295da2b9a11ae35a25af354547b-1283430194 Zu MakeBootable.exe: hxxp://www.virustotal.com/file-scan/report.html?id=e4164e87c6e6d04df07550c15df3c0a7c3547c6f90c1ee113a463424c35906fc-1283430301 Zu PCLock.exe: hxxp://www.virustotal.com/file-scan/report.html?id=6751b1390926e10fd3b9209c53cc0572eeb05f9e4b6ac9f81d14b276d94c5f42-1283430436 Zu Reset.exe: hxxp://www.virustotal.com/file-scan/report.html?id=647b10993353246ac2b05efea5f58c250884adc1f1941e2b38c097a73237e4c5-1283430546 Zu SecretZip.exe: hxxp://www.virustotal.com/file-scan/report.html?id=24035602ebab743a2101182939785749dd5cb6e0ae467f50a8cc6bdeed9912ce-1283430630 Hoffe konnte so weiterhelfen, und würde mich über eine Antwort sehr freuen. Mit Dank verbunden Gruss Patrick |
|
02.09.2010, 18:27
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor Ok, die Dateien scheinen sauber zu sein, auch wenn ich sei sehr verdächtig finde. Kannst Du sie denn zuordnen?
__________________ --> Antimalware Doctor |
|
02.09.2010, 22:02
| #7 |
| | Antimalware Doctor Hallo, Ich kann die Dateien leider nicht zuordnen, wüsste auch nicht ob Ich irgendwas von diesen AppLauncher installiert hätte. Habe nach diesen Dateien über Google gesucht aber nichts brauchbares gefunden. Ich weiss also selber nicht woher die kommen und was die da verloren haben. Wobei die Dateien sich sehr verdächtig anhören. Wie sollen wir jetzt weiter vorgehen? Soll Ich die Dateien löschen? Vielen Dank Gruss Patrick |
|
03.09.2010, 10:11
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor Verschieb die Dateien erstmal nach C:\Backup oder so was.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.09.2010, 16:52
| #9 |
| | Antimalware Doctor Hallo, Ich kann die Dateien ja verschieben, aber ob mein System jetzt sauber ist oder nicht wissen wir auch nicht. Virustotal meint ja alles ist sauber, aber dir kommen die Dateien verdächtig vor mir auch. Ich weiss selber nicht woher die Dateien kommen. Ob es da jetzt richtig Dateien hin und her zu schieben, möchte halt gerne wissen ob mein System sauber ist oder nicht, aber das scheint ja nicht sicher zu sein. Vielleicht soll Ich meine System Partition neu machen? Vielen Dank Gruss Patrick |
|
03.09.2010, 17:17
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware DoctorZitat:
Wie verhält sich Dein System denn? Noch andere Funde in der Zwischenzeit?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2010, 12:34
| #11 |
| | Antimalware Doctor Hallo, soweit verhält sich mein System normal, hatte noch eine grosse Update Aktion gestartet, mit Malwarebytes und meinem AVG alles untersucht, aber nichts verdächtiges mehr bis jetzt gefunden. Gruss Patrick |
|
06.09.2010, 13:42
| #12 |
| /// Malware-holic | Antimalware Doctor ok dann sollten wir durch sein. |
|
06.09.2010, 13:45
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Antimalware Doctor *markuszustimm*  Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.09.2010, 14:52
| #14 |
| /// Malware-holic | Antimalware Doctor sorry ich bin im thread verrutscht. wollte mich da nicht einmischen |
|
06.09.2010, 16:19
| #15 |
| | Antimalware Doctor Hallo, habe noch alle Updates durchgeführt, den Adobe Reader runter geschmissen und diesen Foxit Reader installiert mal testen. Ja denke das war es soweit, ganz grossen Dank für die entgegengebrachte Arbeit und Tips. Werde euch weiter empfehlen, und falls Ich irgendwelche Probleme mit meinem System habe, werde Ich gerne auf dieses Forum zurück kommen. Gruss Patrick |
|
| Themen zu Antimalware Doctor |
| .dll, adobe, adware.bho, autorun, avg, avg free, black, c:\windows\system32\rundll32.exe, components, downloader, error, explorer, firefox.exe, flash player, format, gebraucht, google, grand theft auto, home, home premium, install.exe, jdownloader, langs, launch, local\temp, location, log file, logfile, mozilla, object, oldtimer, otl logfile, otl.exe, plug-in, programdata, realtek, registry, rkill, rogue.antimalwaredoctor, rootkit.dropper, rundll, saver, searchplugins, security, seiten, shell32.dll, shortcut, software, sptd.sys, start menu, studio, system, syswow64, teamspeak, temp, vlc media player, webcheck |
Textbox.
.
Linear-Darstellung
