| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Problem / Echelon RATWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.10.2010, 14:17
| #16 |
 |  Problem / Echelon RAT OTL.TXT: OTL Logfile: Code:
ATTFilter OTL logfile created on: 16.10.2010 15:10:51 - Run 4 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Admin.PC\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 69,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 455,04 Gb Total Space | 214,07 Gb Free Space | 47,04% Space Free | Partition Type: NTFS Drive D: | 10,72 Gb Total Space | 0,00 Gb Free Space | 0,01% Space Free | Partition Type: NTFS Drive E: | 3,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: PC | User Name: Admin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Admin.PC\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Javascript\MixerAudio.exe () PRC - C:\Windows\Installer\MSI8332.tmp () PRC - C:\Program Files\NetLimiter 3\nlsvc.exe (Locktime Software) PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Users\Admin.PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousometer.exe () PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe () PRC - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe (Infowatch) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Windows\System32\atieclxx.exe (AMD) PRC - C:\Windows\System32\atiesrxx.exe (AMD) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation) PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.) PRC - C:\xampp\apache\bin\apache.exe (Apache Software Foundation) PRC - c:\xampp\apache\bin\apache.exe (Apache Software Foundation) PRC - C:\Windows\System32\mmrtkrnl.exe (AlcaTech) PRC - c:\xampp\mysql\bin\mysqld.exe () PRC - C:\Program Files\RocketDock\RocketDock.exe () ========== Modules (SafeList) ========== MOD - C:\Users\Admin.PC\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation) MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation) MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation) MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation) MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation) MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) MOD - C:\Program Files\RocketDock\RocketDock.dll () ========== Win32 Services (SafeList) ========== SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (HyperDeskCustomThemeEnabler) -- C:\Windows\Installer\MSI8332.tmp () SRV - (Akamai) -- c:\program files\common files\akamai\netsession_win_062a651.dll () SRV - (nlsvc) -- C:\Program Files\NetLimiter 3\nlsvc.exe (Locktime Software) SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.) SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (aspnet_state) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (NetTcpPortSharing) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetTcpActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetPipeActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetMsmqActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NMSAccess) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe () SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe (Kaspersky Lab) SRV - (CSObjectsSrv) -- C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe (Infowatch) SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD) SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation) SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation) SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation) SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation) SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation) SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation) SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation) SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation) SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation) SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation) SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation) SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation) SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation) SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.) SRV - (Apache2.2) -- c:\xampp\apache\bin\apache.exe (Apache Software Foundation) SRV - (mysql) -- c:\xampp\mysql\bin\mysqld.exe () SRV - (FileZilla Server) -- c:\xampp\FileZillaFTP\FileZillaServer.exe (FileZilla Project) SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV - (XDva363) -- C:\Windows\System32\XDva363.sys File not found DRV - (XDva362) -- C:\Windows\System32\XDva362.sys File not found DRV - (XDva352) -- C:\Windows\System32\XDva352.sys File not found DRV - (XDva347) -- C:\Windows\System32\XDva347.sys File not found DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys () DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys () DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab) DRV - (nltdi) -- C:\Program Files\NetLimiter 3\nltdi.sys (Locktime Software) DRV - (NLNdisPT) -- C:\Windows\System32\drivers\nlndis.sys (Locktime Software) DRV - (NLNdisMP) -- C:\Windows\System32\drivers\nlndis.sys (Locktime Software) DRV - (VBoxNetFlt) -- C:\Windows\System32\drivers\VBoxNetFlt.sys (Oracle Corporation) DRV - (VBoxNetAdp) -- C:\Windows\System32\drivers\VBoxNetAdp.sys (Oracle Corporation) DRV - (VBoxUSBMon) -- C:\Windows\System32\drivers\VBoxUSBMon.sys (Oracle Corporation) DRV - (VBoxDrv) -- C:\Windows\System32\drivers\VBoxDrv.sys (Oracle Corporation) DRV - (VBoxUSB) -- C:\Windows\System32\drivers\VBoxUSB.sys (Oracle Corporation) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (fssfltr) -- C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (pspdisp) -- C:\Windows\System32\drivers\pspdisp.sys (JJS) DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (CSCrySec) -- C:\Windows\system32\DRIVERS\CSCrySec.sys (Infowatch) DRV - (CSVirtualDiskDrv) -- C:\Windows\System32\drivers\CSVirtualDiskDrv.sys (Infowatch) DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation) DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.) DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys () DRV - (KLBG) -- C:\Windows\system32\DRIVERS\klbg.sys (Kaspersky Lab) DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab) DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab) DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (BthAvrcp) -- C:\Windows\System32\drivers\BthAvrcp.sys (CSR, plc) DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.) DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.) DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.) DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.) DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices) DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.) DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices) DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation) DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation) DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation) DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation) DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation) DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex) DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.) DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company) DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.) DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation) DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation) DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems) DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation) DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.) DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology) DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.) DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation) DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation) DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation) DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation) DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation) DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation) DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation) DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation) DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation) DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation) DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation) DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation) DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation) DRV - (AmdPPM) -- C:\Windows\System32\drivers\amdppm.sys (Microsoft Corporation) DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation) DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation) DRV - (MMRTKRNL) -- C:\Windows\system32\drivers\mmrtkrnl.sys (AlcaTech) DRV - (vmm) -- C:\Windows\System32\drivers\VMM.sys (Microsoft Corporation) DRV - (VPCNetS2) -- C:\Windows\System32\drivers\VMNetSrv.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 1C FC 02 86 2B CB 01 [binary data] IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: lockerzplayextended@flies:2.5.0 FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0 FF - prefs.js..extensions.enabledItems: {99a0337c-6303-4879-b72e-500fd9aaca8c}:3.0.8 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.2.0 FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.192 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 5 FF - prefs.js..extensions.enabledItems: 3 FF - prefs.js..extensions.enabledItems: 1 FF - prefs.js..extensions.enabledItems: {00352F14-3F76-4e4d-ACFF-9972D7E4B3B9}:0.7.2 FF - prefs.js..extensions.enabledItems: {0471d3b0-a403-11df-981c-0800200c9a66}:0.921 FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=UTR&o=15467&locale=en_US&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.15 11:33:49 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.04 11:57:25 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky PURE\THBExt [2010.09.25 11:26:10 | 000,000,000 | ---D | M] [2010.06.13 08:44:12 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Extensions [2010.10.15 19:41:50 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions [2010.07.24 11:32:45 | 000,000,000 | ---D | M] (MacOSX Theme) -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\{00352F14-3F76-4e4d-ACFF-9972D7E4B3B9} [2010.10.14 19:59:40 | 000,000,000 | ---D | M] (SmallringFX DARKBlue) -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\{0471d3b0-a403-11df-981c-0800200c9a66} [2010.10.15 19:21:01 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.10.03 10:47:50 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\battlefieldheroespatcher@ea.com [2010.06.26 23:08:48 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\firebug@software.joehewitt.com [2010.09.26 00:24:19 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\firefox@tvunetworks.com [2010.07.24 18:40:47 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\lockerzplayextended@flies [2010.10.15 19:21:38 | 000,000,000 | ---D | M] -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\toolbar@ask.com [2010.10.14 19:59:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin.PC\AppData\Roaming\mozilla\Firefox\Profiles\njotktnk.default\extensions\{0471d3b0-a403-11df-981c-0800200c9a66}\chrome\mozapps\extensions [2010.10.14 15:38:08 | 000,002,424 | ---- | M] () -- C:\Users\Admin.PC\AppData\Roaming\Mozilla\FireFox\Profiles\njotktnk.default\searchplugins\askcom.xml [2010.09.22 13:43:46 | 000,000,927 | ---- | M] () -- C:\Users\Admin.PC\AppData\Roaming\Mozilla\FireFox\Profiles\njotktnk.default\searchplugins\conduit.xml [2010.07.10 20:59:57 | 000,002,059 | ---- | M] () -- C:\Users\Admin.PC\AppData\Roaming\Mozilla\FireFox\Profiles\njotktnk.default\searchplugins\daemon-search.xml [2010.10.15 19:41:50 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2010.09.12 07:03:15 | 000,000,000 | ---D | M] (TextAloud 3 Toolbar) -- C:\Program Files\mozilla firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c} [2010.06.30 22:25:22 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.09.25 11:27:11 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\linkfilter@kaspersky.ru [2010.07.27 16:13:46 | 000,027,136 | ---- | M] (NHN USA Inc.) -- C:\Program Files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll [2007.03.10 01:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll [2010.09.24 14:08:51 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.09.24 14:08:51 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2010.09.24 14:08:52 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.09.24 14:08:52 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2010.09.24 14:08:52 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Tonec Inc.) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll (Kaspersky Lab) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab) O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\System32\mmrtkrnl.exe (AlcaTech) O4 - HKLM..\Run: [Risorse di Windows] C:\Program Files\Javascript\MixerAudio.exe () O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found O4 - HKCU..\Run: [{2C0852D4-5874-B4ED-0853-09FBCB7E94E2}] C:\Users\Admin.PC\AppData\Roaming\winsc\2s.exe File not found O4 - HKCU..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe () O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [Windows] C:\Users\Public\Public Documents\Windows Movie Player\player.exe File not found O4 - HKCU..\Run: [WindowsEssentials] C:\Users\Admin.PC\AppData\Local\Temp\Svchost.bat File not found O4 - Startup: C:\Users\Admin.PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousometer.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 1 = Aegis.exe O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 2 = Aegis64.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldde-de.cab (Windows Live Hotmail Photo Upload Tool) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {F791A188-699D-4FD4-955A-EB59E89B1907} - Ave's 7StartButton Changer - C:\Program Files\The Skins Factory\Hyperdesk\Common\AveStartButtonChangerInProc.dll (AveApps, Andreas Verhoeven) O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.09.11 17:45:09 | 000,000,051 | -H-- | M] () - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009.06.11 08:44:56 | 000,000,043 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{69955d00-9e79-11df-8017-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{69955d00-9e79-11df-8017-806e6f6e6963}\Shell\AutoRun\command - "" = J:\Autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.10.16 00:12:42 | 000,000,000 | ---D | C] -- C:\Windows\IC [2010.10.15 22:39:31 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\Malwarebytes [2010.10.15 22:39:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.10.15 22:39:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.10.15 22:39:20 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.10.15 22:39:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010.10.15 22:34:46 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Admin.PC\Desktop\OTL.exe [2010.10.15 18:35:36 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Desktop\Hyperdesk [2010.10.15 17:26:34 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Desktop\Resistance [2010.10.15 15:29:01 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\Output [2010.10.15 11:50:47 | 000,000,000 | ---D | C] -- C:\Program Files\Roblox [2010.10.15 11:31:28 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\Adobe [2010.10.15 03:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe [2010.10.15 02:15:43 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader [2010.10.15 00:39:21 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Desktop\Echelon RAT [2010.10.14 23:50:47 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Desktop\PS CS5 [2010.10.14 16:55:04 | 179,863,803 | ---- | C] (The Skins Factory, Inc. ) -- C:\Users\Admin.PC\Desktop\Hyperdesk Subspace Win7 32bit.exe [2010.10.14 14:57:59 | 000,000,000 | ---D | C] -- C:\Program Files\Gimp Themes v1.0 [2010.10.14 14:53:58 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0 [2010.10.14 14:16:49 | 000,000,000 | ---D | C] -- C:\Program Files\Javascript [2010.10.13 06:39:55 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.10.13 06:39:55 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.10.13 06:39:55 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.10.13 06:39:55 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.10.13 06:39:55 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.10.13 06:39:55 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.10.13 06:39:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.10.13 06:39:55 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.10.13 06:39:55 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.10.13 06:39:55 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.10.13 06:39:55 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.10.13 06:39:54 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010.10.13 06:39:52 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll [2010.10.13 06:39:52 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll [2010.10.13 06:39:48 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2010.10.13 06:39:46 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.10.13 06:39:45 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2010.10.13 06:39:35 | 000,363,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\StructuredQuery.dll [2010.10.12 23:49:15 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\My Games [2010.10.12 22:36:30 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2010.10.12 18:41:47 | 000,000,000 | ---D | C] -- C:\Youtube Tutorials [2010.10.12 12:47:10 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\BioWare [2010.10.12 12:36:44 | 000,000,000 | ---D | C] -- C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP [2010.10.12 12:32:17 | 000,000,000 | ---D | C] -- C:\Program Files\Mass Effect 2 Demo [2010.10.12 12:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\BioWare [2010.10.12 00:19:36 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\Alte Desktop Datein [2010.10.10 23:28:57 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\Locktime [2010.10.10 23:27:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Locktime [2010.10.10 23:27:24 | 000,000,000 | ---D | C] -- C:\Program Files\NetLimiter 3 [2010.10.10 23:26:09 | 000,109,568 | ---- | C] (-I.Paradise-) -- C:\Windows\System32\kadyxhukoedj.exe [2010.10.10 22:51:07 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\Sony Media Software and Services Inc [2010.10.10 16:19:59 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2010.10.10 16:18:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2010.10.10 16:17:46 | 000,000,000 | ---D | C] -- C:\Program Files\MicroVolts [2010.10.09 17:29:49 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\_ [2010.10.09 09:27:37 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\Activision [2010.10.09 09:19:38 | 000,000,000 | ---D | C] -- C:\Program Files\Activision [2010.10.09 09:16:50 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache [2010.10.08 20:06:06 | 000,000,000 | ---D | C] -- C:\Program Files\Midnight Club 2 [2010.10.08 16:22:17 | 000,197,120 | ---- | C] (ScreenTime Media) -- C:\Windows\System32\MidnightClub3-Lancer&300C-1600.scr [2010.10.08 16:22:17 | 000,000,000 | ---D | C] -- C:\Windows\System32\MidnightClub3-Lancer&300C-1600 dir [2010.10.07 16:09:06 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2010.10.07 16:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Woobies 2 Deluxe [2010.10.07 16:08:23 | 000,000,000 | ---D | C] -- C:\Program Files\bfgclient [2010.10.04 16:34:56 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\makehuman [2010.10.04 16:33:59 | 000,000,000 | ---D | C] -- C:\Program Files\Makehuman [2010.10.04 12:00:54 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2010.10.03 22:32:43 | 000,000,000 | ---D | C] -- C:\Program Files\Sweet Home 3D [2010.10.03 21:57:39 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonUS [2010.10.03 20:57:12 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\PMB Files [2010.10.03 20:57:11 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2010.10.03 20:56:58 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks [2010.10.03 20:20:09 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2010.10.03 20:08:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared [2010.10.03 20:06:02 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\Autodesk [2010.10.03 19:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Autodesk Shared [2010.10.03 19:59:35 | 000,000,000 | ---D | C] -- C:\Program Files\Autodesk [2010.10.03 19:53:21 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\Autodesk [2010.10.03 19:53:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Autodesk [2010.10.03 18:34:02 | 000,180,224 | ---- | C] (Intel Corporation) -- C:\Windows\System32\ijl11.dll [2010.10.03 18:34:02 | 000,067,072 | ---- | C] (AS·CON Software GmbH 2000 ) -- C:\Windows\System32\as_tif32.dll [2010.10.03 18:34:02 | 000,047,616 | ---- | C] (AS·CON Software GmbH 2000 ) -- C:\Windows\System32\asdib32.dll [2010.10.03 18:32:28 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Startmenü [2010.10.03 18:32:26 | 000,000,000 | ---D | C] -- C:\Program Files\SBS-Bausoftware [2010.10.03 18:30:22 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sfx32.dll [2010.10.03 18:30:21 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\ASCON Installer [2010.10.03 10:58:30 | 000,000,000 | ---D | C] -- C:\Program Files\SEGA [2010.10.03 10:56:44 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\InstallShield [2010.09.30 20:38:15 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\OneNote-Notizbücher [2010.09.29 22:32:53 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys [2010.09.29 16:42:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2010.09.29 16:42:18 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Application Virtualization Client [2010.09.29 16:05:42 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.09.28 14:49:47 | 000,000,000 | ---D | C] -- C:\Program Files\gPotato.eu [2010.09.28 14:37:19 | 000,000,000 | ---D | C] -- C:\Program Files\Neffy [2010.09.26 23:26:03 | 000,258,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unicows.dll [2010.09.26 22:13:45 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\GetRightToGo [2010.09.26 22:09:34 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Jade Dynasty [2010.09.26 18:11:55 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\Apple [2010.09.26 14:51:54 | 000,180,224 | ---- | C] (fCoder Group International) -- C:\Windows\System32\cnvshell.dll [2010.09.26 14:51:41 | 000,000,000 | ---D | C] -- C:\Program Files\ImageConverter Plus [2010.09.26 14:47:53 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_edit_w7sbc.exe [2010.09.26 14:47:53 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer_backup_w7sbc.exe [2010.09.26 14:47:53 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2010.09.26 14:47:53 | 000,000,000 | ---D | C] -- C:\Windows\W7SBC [2010.09.26 11:48:47 | 179,520,919 | ---- | C] (The Skins Factory, Inc. ) -- C:\Users\Admin.PC\Desktop\Hyperdesk GammaRay Win7 32bit.exe [2010.09.26 01:00:04 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\Documents\My Widgets [2010.09.26 00:59:57 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\Yahoo [2010.09.26 00:59:53 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo! [2010.09.26 00:25:29 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Local\TVU Networks [2010.09.26 00:25:29 | 000,000,000 | ---D | C] -- C:\ProgramData\TVU Networks [2010.09.26 00:24:14 | 000,000,000 | ---D | C] -- C:\Program Files\TVUPlayer [2010.09.26 00:07:38 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\Skinux [2010.09.26 00:07:01 | 000,000,000 | ---D | C] -- C:\Program Files\The Skins Factory [2010.09.25 11:26:19 | 000,088,632 | ---- | C] (Infowatch) -- C:\Windows\System32\drivers\CSCrySec.sys [2010.09.25 11:26:19 | 000,039,352 | ---- | C] (Infowatch) -- C:\Windows\System32\drivers\CSVirtualDiskDrv.sys [2010.09.25 11:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InfoWatch [2010.09.25 11:25:36 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab [2010.09.25 11:25:24 | 000,311,312 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys [2010.09.25 11:24:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files [2010.09.25 10:07:16 | 000,000,000 | --SD | C] -- C:\Users\Admin.PC\Documents\Passwords Database [2010.09.25 09:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2010.09.21 15:01:33 | 000,000,000 | -H-D | C] -- C:\Users\Admin.PC\AppData\Roaming\ijjigame [2010.09.20 19:13:22 | 000,713,312 | ---- | C] (NHN USA) -- C:\Windows\System32\ijjiSetup.exe [2010.09.20 19:13:22 | 000,062,048 | ---- | C] (NHN USA Inc.) -- C:\Windows\System32\ijjiProcessRestarter.exe [2010.09.20 19:13:11 | 000,000,000 | ---D | C] -- C:\Program Files\REACTOR [2010.09.20 18:48:22 | 000,000,000 | ---D | C] -- C:\Program Files\A.V.A [2010.09.19 22:01:42 | 003,549,224 | ---- | C] (INCA Internet Co., Ltd.) -- C:\Windows\System32\GameMon.des [2010.09.19 22:00:47 | 000,004,682 | ---- | C] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npptNT2.sys [2010.09.19 22:00:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\INCA Shared [2010.09.19 12:14:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\Keylogger [2010.09.19 12:12:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\BPK [2010.09.19 12:10:00 | 000,000,000 | -H-D | C] -- C:\ProgramData\PerfectKeylogger [2010.09.19 11:47:49 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\AppData\Roaming\BPK [2010.09.18 22:42:39 | 000,000,000 | ---D | C] -- C:\Users\Admin.PC\.VirtualBox [2010.09.18 22:41:42 | 000,143,184 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\drivers\VBoxDrv.sys [2010.09.18 22:41:23 | 000,041,936 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\drivers\VBoxUSBMon.sys [2010.09.18 22:41:15 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle [2008.04.01 19:39:09 | 003,306,496 | ---- | C] (YoYo Games Ltd) -- C:\Program Files\Game_Maker.exe [3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Admin.PC\AppData\Local\*.tmp files -> C:\Users\Admin.PC\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.10.16 15:13:12 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.16 15:13:12 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.16 15:10:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.10.16 15:08:45 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1004UA.job [2010.10.16 15:07:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.16 15:07:45 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys [2010.10.16 15:06:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1006UA.job [2010.10.16 14:58:05 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.10.16 00:24:52 | 000,140,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\COMDLG32.OCX [2010.10.16 00:23:00 | 000,035,213 | ---- | M] () -- C:\Users\Admin.PC\Desktop\emo Icon.jpg [2010.10.15 22:39:25 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.15 22:34:53 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Admin.PC\Desktop\OTL.exe [2010.10.15 20:04:45 | 000,005,120 | ---- | M] () -- C:\Users\Admin.PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.14 19:57:06 | 000,002,739 | ---- | M] () -- C:\Users\Admin.PC\.recently-used.xbel [2010.10.14 19:00:18 | 000,000,937 | ---- | M] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk [2010.10.14 17:24:55 | 023,227,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imageres.dll [2010.10.14 17:06:01 | 179,863,803 | ---- | M] (The Skins Factory, Inc. ) -- C:\Users\Admin.PC\Desktop\Hyperdesk Subspace Win7 32bit.exe [2010.10.14 16:12:08 | 000,025,616 | ---- | M] () -- C:\Users\Admin.PC\Desktop\emo-2333.jpg [2010.10.14 16:06:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1006Core.job [2010.10.14 15:06:06 | 000,000,163 | ---- | M] () -- C:\Users\Admin.PC\.gtkrc-2.0 [2010.10.13 22:48:04 | 000,281,760 | ---- | M] () -- C:\Windows\System32\drivers\atksgt.sys [2010.10.13 22:48:02 | 000,025,888 | ---- | M] () -- C:\Windows\System32\drivers\lirsgt.sys [2010.10.13 17:43:01 | 000,000,474 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Admin.job [2010.10.13 10:46:25 | 000,599,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.10.12 15:08:32 | 000,762,778 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.10.12 15:08:32 | 000,707,558 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.10.12 15:08:32 | 000,170,692 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.10.12 15:08:32 | 000,139,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.10.12 10:08:02 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1004Core.job [2010.10.09 19:34:09 | 000,138,464 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.10.09 09:25:50 | 000,022,328 | ---- | M] () -- C:\Users\Admin.PC\AppData\Roaming\PnkBstrK.sys [2010.10.09 09:25:32 | 000,682,280 | ---- | M] () -- C:\Windows\System32\pbsvc.exe [2010.10.08 17:32:10 | 000,109,568 | ---- | M] (-I.Paradise-) -- C:\Windows\System32\kadyxhukoedj.exe [2010.10.08 16:22:17 | 000,197,120 | ---- | M] (ScreenTime Media) -- C:\Windows\System32\MidnightClub3-Lancer&300C-1600.scr [2010.10.04 16:43:02 | 002,308,386 | ---- | M] () -- C:\Users\Admin.PC\Desktop.obj [2010.10.04 16:43:02 | 000,069,743 | ---- | M] () -- C:\Users\Admin.PC\Desktop-proxy.obj [2010.10.04 16:43:02 | 000,000,281 | ---- | M] () -- C:\Users\Admin.PC\Desktop-proxy.mtl [2010.10.04 16:43:02 | 000,000,174 | ---- | M] () -- C:\Users\Admin.PC\Desktop.obj.mtl [2010.10.03 18:41:04 | 000,083,596 | ---- | M] () -- C:\Windows\System32\button.wav [2010.10.03 18:35:39 | 000,000,512 | ---- | M] () -- C:\Windows\System32\as_tom32.mul [2010.10.03 18:34:02 | 000,180,224 | ---- | M] (Intel Corporation) -- C:\Windows\System32\ijl11.dll [2010.10.03 18:34:02 | 000,067,072 | ---- | M] (AS·CON Software GmbH 2000 ) -- C:\Windows\System32\as_tif32.dll [2010.10.03 18:34:02 | 000,047,616 | ---- | M] (AS·CON Software GmbH 2000 ) -- C:\Windows\System32\asdib32.dll [2010.10.03 18:30:22 | 000,120,320 | ---- | M] () -- C:\Windows\System32\czip.ocx [2010.10.03 18:30:22 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sfx32.dll [2010.10.03 10:50:40 | 000,215,016 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2010.10.03 09:45:25 | 002,427,248 | ---- | M] () -- C:\Windows\System32\pbsvc_heroes.exe [2010.09.30 20:38:14 | 000,001,322 | ---- | M] () -- C:\Users\Admin.PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2010.09.26 23:25:59 | 000,258,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\unicows.dll [2010.09.26 14:51:56 | 000,000,973 | ---- | M] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\ImageConverter Plus.lnk [2010.09.25 11:53:31 | 000,113,933 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat [2010.09.25 11:53:31 | 000,097,549 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat [2010.09.25 11:25:24 | 000,311,312 | ---- | M] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys [2010.09.20 19:14:39 | 000,001,875 | ---- | M] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\ijji REACTOR.lnk [2010.09.19 18:53:35 | 000,000,046 | ---- | M] () -- C:\Windows\Speed.INI [2010.09.18 22:41:43 | 000,001,058 | ---- | M] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\Oracle VM VirtualBox.lnk [3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Admin.PC\AppData\Local\*.tmp files -> C:\Users\Admin.PC\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.10.16 00:22:49 | 000,035,213 | ---- | C] () -- C:\Users\Admin.PC\Desktop\emo Icon.jpg [2010.10.15 22:39:25 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.14 19:57:06 | 000,002,739 | ---- | C] () -- C:\Users\Admin.PC\.recently-used.xbel [2010.10.14 15:06:06 | 000,000,163 | ---- | C] () -- C:\Users\Admin.PC\.gtkrc-2.0 [2010.10.14 12:23:00 | 000,025,616 | ---- | C] () -- C:\Users\Admin.PC\Desktop\emo-2333.jpg [2010.10.13 22:48:04 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2010.10.13 22:48:02 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2010.10.09 09:25:32 | 000,682,280 | ---- | C] () -- C:\Windows\System32\pbsvc.exe [2010.10.04 16:43:02 | 000,069,743 | ---- | C] () -- C:\Users\Admin.PC\Desktop-proxy.obj [2010.10.04 16:43:02 | 000,000,281 | ---- | C] () -- C:\Users\Admin.PC\Desktop-proxy.mtl [2010.10.04 16:43:02 | 000,000,174 | ---- | C] () -- C:\Users\Admin.PC\Desktop.obj.mtl [2010.10.04 16:43:01 | 002,308,386 | ---- | C] () -- C:\Users\Admin.PC\Desktop.obj [2010.10.03 18:34:19 | 000,000,512 | ---- | C] () -- C:\Windows\System32\as_tom32.mul [2010.10.03 18:30:22 | 000,120,320 | ---- | C] () -- C:\Windows\System32\czip.ocx [2010.09.30 20:38:14 | 000,001,322 | ---- | C] () -- C:\Users\Admin.PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2010.09.30 16:01:08 | 000,001,118 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1006UA.job [2010.09.30 16:01:07 | 000,001,066 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-198695047-1083433052-2540863539-1006Core.job [2010.09.26 14:51:56 | 000,000,973 | ---- | C] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\ImageConverter Plus.lnk [2010.09.26 01:08:36 | 000,083,596 | ---- | C] () -- C:\Windows\System32\button.wav [2010.09.25 11:27:06 | 000,113,933 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat [2010.09.25 11:27:06 | 000,097,549 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat [2010.09.20 19:14:39 | 000,001,875 | ---- | C] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\ijji REACTOR.lnk [2010.09.19 22:00:46 | 000,005,174 | ---- | C] () -- C:\Windows\System32\nppt9x.vxd [2010.09.19 18:52:54 | 000,000,046 | ---- | C] () -- C:\Windows\Speed.INI [2010.09.18 22:41:43 | 000,001,058 | ---- | C] () -- C:\Users\Admin.PC\Application Data\Microsoft\Internet Explorer\Quick Launch\Oracle VM VirtualBox.lnk [2010.08.29 10:49:27 | 000,000,096 | ---- | C] () -- C:\Users\Admin.PC\AppData\Local\fusioncache.dat [2010.08.29 10:48:29 | 000,030,279 | -H-- | C] () -- C:\Users\Admin.PC\AppData\Local\digital-prodigy USERID.php [2010.08.22 17:42:01 | 000,000,028 | ---- | C] () -- C:\Windows\Robota.INI [2010.08.16 16:31:36 | 000,000,359 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2010.07.23 21:20:24 | 000,138,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.07.23 21:20:23 | 000,022,328 | ---- | C] () -- C:\Users\Admin.PC\AppData\Roaming\PnkBstrK.sys [2010.07.16 21:08:20 | 001,806,336 | ---- | C] () -- C:\Windows\SpeedTreeRT.dll [2010.07.16 21:08:20 | 000,349,696 | ---- | C] () -- C:\Windows\MSS32.DLL [2010.07.16 21:08:20 | 000,053,248 | ---- | C] () -- C:\Windows\mc.dll [2010.07.10 20:56:17 | 000,697,328 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2010.07.09 23:23:20 | 000,000,600 | ---- | C] () -- C:\Users\Admin.PC\AppData\Local\PUTTY.RND [2010.07.04 01:15:36 | 001,589,248 | ---- | C] () -- C:\Windows\System32\libmysql_d.dll [2010.06.25 11:26:55 | 000,001,890 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2010.06.25 11:26:55 | 000,000,088 | RHS- | C] () -- C:\ProgramData\49F8EECA92.sys [2010.06.24 23:31:29 | 000,005,120 | ---- | C] () -- C:\Users\Admin.PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.20 22:14:58 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll [2010.06.15 13:52:21 | 000,100,790 | ---- | C] () -- C:\Program Files\Uninstal.exe [2010.05.27 16:16:08 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys [2010.05.26 20:59:51 | 000,024,738 | -H-- | C] () -- C:\Users\Admin.PC\AppData\Roaming\addons2.dat [2009.12.18 12:39:35 | 000,007,093 | ---- | C] () -- C:\Program Files\Game_Maker.sw2 [2009.11.16 18:33:38 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll [2009.07.14 02:55:09 | 000,587,776 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.07.01 23:19:26 | 001,406,987 | ---- | C] () -- C:\Program Files\Game_Maker.chm [2009.06.28 18:27:16 | 000,013,839 | ---- | C] () -- C:\Program Files\gm_license.html [2009.06.28 18:27:16 | 000,011,219 | ---- | C] () -- C:\Program Files\gm_changes.html [2009.06.28 18:27:16 | 000,003,243 | ---- | C] () -- C:\Program Files\gm_readme.html [2009.06.28 08:42:09 | 000,000,761 | ---- | C] () -- C:\Program Files\snippets.txt [2009.06.07 13:27:20 | 000,073,728 | ---- | C] () -- C:\Windows\System32\vbzlib1.dll [2008.10.22 05:29:06 | 000,173,550 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2008.04.01 19:39:39 | 000,041,548 | ---- | C] () -- C:\Program Files\fnames [2008.04.01 19:39:09 | 000,913,903 | ---- | C] () -- C:\Program Files\rundata [2008.04.01 19:39:08 | 000,267,328 | ---- | C] () -- C:\Program Files\dxdata [2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2006.10.16 08:58:14 | 000,086,016 | ---- | C] () -- C:\Windows\System32\aspolyzt.dll [2005.07.06 12:59:58 | 000,028,672 | ---- | C] () -- C:\Windows\System32\asdrawli.dll [2005.07.04 15:17:30 | 000,069,632 | ---- | C] () -- C:\Windows\System32\ASDRAWMA.DLL [2004.08.17 17:34:52 | 000,036,864 | ---- | C] () -- C:\Windows\System32\AS_SORT.DLL [2003.05.22 12:31:44 | 000,033,792 | ---- | C] () -- C:\Windows\System32\ASDRAW32.DLL [2002.07.12 16:29:28 | 000,073,728 | ---- | C] () -- C:\Windows\System32\AS_MDB32.DLL [2002.06.06 02:01:58 | 000,029,696 | ---- | C] () -- C:\Windows\System32\asutl8.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:3C6860C5 < End of report > Extras.txt: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 16.10.2010 15:10:51 - Run 4
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Admin.PC\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 69,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,04 Gb Total Space | 214,07 Gb Free Space | 47,04% Space Free | Partition Type: NTFS
Drive D: | 10,72 Gb Total Space | 0,00 Gb Free Space | 0,01% Space Free | Partition Type: NTFS
Drive E: | 3,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MIF5BA~1\Office12\ONENOTE.EXE "%L" File not found
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}" = Medieval II Total War : Kingdoms : Crusades
"{0524D62A-72D6-4D01-B4E8-546BA5B0B9EC}_is1" = eDgMt2 Client 1.0
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}" = SimCity™ Societies
"{0D078A7E-79B7-4835-B1B0-F9471C68DAA2}" = Windows Movie Maker
"{0DEE907D-C36B-40F8-A205-DB86B6BFB5DA}" = MAGIX Web Designer 6 Download-Version
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{13550D11-1C3B-4585-A27B-9880BB1DA05D}" = Hyperdesk - DarkMatter Gamma Ray
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A59064A-12A9-469F-99F6-04BF118DBCFF}" = Kaspersky PURE
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F100395-11BC-4E2C-9C5D-E1AFB9459892}_is1" = MicroVolts
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20AFAB5E-0631-4A3F-934F-EFC59479A26E}" = Hyperdesk - DarkMatter Subspace
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{22FDB053-8616-4EC8-BCAD-82AA6EC6CDA1}_is1" = 1.02
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{42AF51C0-4028-46CF-B616-FB1F75286457}" = A.V.A
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{5454083B-1308-4485-BF17-1110000D8302}" = Grand Theft Auto IV
"{5783F2D7-9001-0407-0002-0060B0CE6BBA}" = AutoCAD 2011 - Deutsch
"{5783F2D7-9001-0407-1002-0060B0CE6BBA}" = AutoCAD 2011 Language Pack - Deutsch
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{620CAD2D-0757-43A9-AA5F-C8D48A1E4D85}_is1" = BigMacroTool 1.5
"{6609A4EB-CB71-422C-AA43-BBE75705D049}" = MAGIX Web Designer 6 Content
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{71CDB1EF-B047-4EF7-B7CE-6D5E15714D2D}_is1" = Lwmt2 Version 1.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{75983B66-804C-40D1-BA13-64DAF652A6F1}" = Medieval II Total War : Kingdoms : Americas
"{764DC542-D3D1-49D4-9BA5-8C7DAD18DE8E}" = Oracle VM VirtualBox 3.2.8
"{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}" = Medieval II Total War : Kingdoms : Teutonic
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8066D20E-F036-48FB-8030-9ACA64F0230B}" = S4 League_EU
"{833D97B9-AC16-45C1-AD44-0A32198956F8}" = Gimp Themes v1.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8ACE3311-7E11-4D68-BFC8-FC5E2692627B}" = Mass Effect 2 Demo
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D20B4D7-3422-4099-9332-39F27E617A6F}" = Autodesk Design Review 2011
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8FB91814-FE42-4B62-9B54-4B677A420715}_is1" = CLEO v3.0.950
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-006D-0407-0000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{901DC58A-5C1B-4315-BA40-5AD3D3A463B9}" = REACTOR
"{913923AB-3AAB-4870-8910-627C4CD82789}" = NetLimiter 3
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{975951E7-14D0-49AF-A630-89680D12D7F6}" = Autodesk Material Library 2011 Medium Image library
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{98B178F2-5112-4AD9-B108-95B248FACE41}_is1" = LwMt2 Version 1.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup
"{9B0F9788-3141-4009-846E-52E59843E963}" = SimCity™ Societies
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9DEABCB6-B759-4D52-92F8-51B34A2B4D40}" = Autodesk Material Library 2011
"{9EC63FE1-D017-460D-90B1-CCC97239AF73}" = Media Go
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B89EAEC9-62FF-4ECA-BBEB-F9B10A13D1E8}" = MAGIX Music Maker 16 Download Version
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C09F1573-6262-47F2-8B90-5B2290A58B12}" = MAGIX Speed 2 (MSI)
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CD1E078C-A6B9-47DA-B035-6365C85C7832}" = Autodesk Material Library 2011 Base Image library
"{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}" = Medieval II Total War : Kingdoms : Britannia
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0E00594-73C0-4640-A54C-2201268844BB}_is1" = DS Game Maker 4.9
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1C7BB12-BE01-11DC-AAC9-EEBA55D89593}" = SimCity™ Societies Reisewelten
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
"{DA5BCC75-DCC6-4492-8DD6-FC5A6E6FCC4A}_is1" = LwMt2 Version 1.0
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DE6E4530-4AB0-482E-91DE-7FE6309C6EF1}" = Camtasia Studio 7
"{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU
"{DF181652-D4F9-7D64-AED8-57D31E8D0410}" = Media Go Video Playback Engine 1.32.111.05170
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E463E038-3546-45E7-8DCA-244803A0C9D9}_is1" = LwMt2 Version 1.1
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8461-7759-5462-8226" = Vuze
"ACProtect_is1" = AntiCrack software Protection
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Akamai" = Akamai NetSession Interface
"Any Audio Converter_is1" = Any Audio Converter 3.0.7
"Any Video Converter_is1" = Any Video Converter 3.0.3
"AsUninst.exe" = Anvil Studio
"aTube Catcher" = aTube Catcher
"Audacity_is1" = Audacity 1.2.6
"AutoCAD 2011 - Deutsch" = AutoCAD 2011 - Deutsch
"Autodesk Design Review 2011" = Autodesk Design Review 2011
"AviSynth" = AviSynth 2.5
"BFGC" = Big Fish Games: Game Manager
"BFG-Woobies 2 Deluxe" = Woobies 2 Deluxe
"Blender" = Blender (remove only)
"Cheat Engine 5.6_is1" = Cheat Engine 5.6
"Combat Arms" = Combat Arms
"Combat Arms EU" = Combat Arms EU
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"DivX Setup.divx.com" = DivX Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FMCODEC" = FM Screen Capture Codec (Remove Only)
"Fraps" = Fraps (remove only)
"Game Maker 8.0" = Game Maker 8.0
"Grand Theft Auto San Andreas_is1" = GTA: San Andreas RIP PT-BR by TemDono - #GTABrasil - BrasNET
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"ImageConverter Plus_is1" = ImageConverter Plus 8.0
"Inno Setup 5_is1" = Inno Setup Version 5.3.10
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallWIX_{1A59064A-12A9-469F-99F6-04BF118DBCFF}" = Kaspersky PURE
"Internet Download Manager" = Internet Download Manager
"JDownloader" = JDownloader
"LogMeIn Hamachi" = LogMeIn Hamachi
"MadTracker 2" = MadTracker 2
"MAGIX Screenshare US" = MAGIX Screenshare
"MAGIX_MSI_mm16" = MAGIX Music Maker 16 Download Version
"MAGIX_MSI_Web_Designer_6" = MAGIX Web Designer 6 Download-Version
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Metin2_is1" = Metin2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft DirectX SDK (February 2010)" = Microsoft DirectX SDK (February 2010)
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU
"MidnightClub3-Lancer&300C-1600" = MidnightClub3-Lancer&300C-1600 Screen Saver
"Minibikemod" = Minibikemod
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Neffy" = Neffy 1,3,29,0
"Notepad++" = Notepad++
"NoteWorthy Composer 2" = NoteWorthy Composer 2
"NSS" = Norton Security Scan
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OPERATION7" = OPERATION7
"Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"PremiumSoft Navicat for MySQL_is1" = PremiumSoft Navicat 9.0 for MySQL
"PremiumSoft Navicat Premium_is1" = PremiumSoft Navicat Premium 9.0
"PSP Video 9" = PSP Video 9 5.04
"PSPad editor_is1" = PSPad editor
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPG Maker VX_is1" = RPG Maker VX
"ruky1024's Warblade [v1.33] +6 Trainer v1.1" = ruky1024's Warblade [v1.33] +6 Trainer v1.1
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Sweet Home 3D_is1" = Sweet Home 3D version 2.6
"TeamViewer 5" = TeamViewer 5
"TmNationsForever_is1" = TmNationsForever
"TVUPlayer" = TVUPlayer 2.5.3.1
"uTorrent" = µTorrent
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR
"WolfTeam" = WolfTeam
"WolfTeam-DE" = WolfTeam-DE
"xampp" = XAMPP 1.7.0
"XNote Stopwatch" = XNote Stopwatch
"Yahoo! Widget Engine" = Yahoo! Widgets
"YInstHelper" = Yahoo! Install Manager
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for Admin
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes (Admin)
"EuroGrand Casino" = EuroGrand Casino
"FileZilla Client" = FileZilla Client 3.3.3
"Google Chrome" = Google Chrome
"Mystere IVA" = Mystere IVA
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 15.10.2010 09:26:04 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3909 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 5f0 Startzeit:
01cb6c6bc9650360 Endzeit: 16 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID:
c15368f1-d85f-11df-b285-8a7c5653f871
Error - 15.10.2010 09:28:01 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: avp.exe, Version: 9.0.0.192, Zeitstempel:
0x4b34b6fc Name des fehlerhaften Moduls: HideExploit.kpl, Version: 0.0.0.0, Zeitstempel:
0x4b9f9993 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00001c77 ID des fehlerhaften Prozesses:
0x1570 Startzeit der fehlerhaften Anwendung: 0x01cb6c669ca0c120 Pfad der fehlerhaften
Anwendung: C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe Pfad des fehlerhaften
Moduls: C:\Program Files\Kaspersky Lab\Kaspersky PURE\KPL\HideExploit.kpl Berichtskennung:
07e12d70-d860-11df-b285-8a7c5653f871
Error - 15.10.2010 09:57:20 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Programm msnmsgr.exe, Version 14.0.8117.416 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 13c8 Startzeit: 01cb6c662d1f8700 Endzeit: 500 Anwendungspfad:
C:\Program Files\Windows Live\Messenger\msnmsgr.exe Berichts-ID: 1e65a7c1-d864-11df-b285-8a7c5653f871
Error - 15.10.2010 10:15:26 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: REACTOR.exe, Version: 1.0.0.77, Zeitstempel:
0x4c3bbf01 Name des fehlerhaften Moduls: MiracleUI.dll, Version: 1.0.3.46, Zeitstempel:
0x4c4f8b11 Ausnahmecode: 0xc000000d Fehleroffset: 0x0001d8e3 ID des fehlerhaften Prozesses:
0x131c Startzeit der fehlerhaften Anwendung: 0x01cb6c7244fdbbb0 Pfad der fehlerhaften
Anwendung: C:\Program Files\REACTOR\REACTOR.exe Pfad des fehlerhaften Moduls: C:\Program
Files\REACTOR\MiracleUI.dll Berichtskennung: a79cb0e0-d866-11df-b285-8a7c5653f871
Error - 15.10.2010 10:16:17 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: npggNT.des_unloaded, Version:
0.0.0.0, Zeitstempel: 0x4c6e019b Ausnahmecode: 0xc0000005 Fehleroffset: 0x458a8c4f
ID
des fehlerhaften Prozesses: 0x310 Startzeit der fehlerhaften Anwendung: 0x01cb6c6618223c80
Pfad
der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften
Moduls: npggNT.des Berichtskennung: c5bb4320-d866-11df-b285-8a7c5653f871
Error - 15.10.2010 18:13:35 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Icon Changer.exe, Version: 1.2.0.0,
Zeitstempel: 0x498a49b3 Name des fehlerhaften Moduls: MSVBVM60.DLL, Version: 6.0.98.15,
Zeitstempel: 0x4a5bda6c Ausnahmecode: 0xc0000005 Fehleroffset: 0x00098896 ID des fehlerhaften
Prozesses: 0x1784 Startzeit der fehlerhaften Anwendung: 0x01cb6cb61678ac70 Pfad der
fehlerhaften Anwendung: C:\Users\Admin.PC\Downloads\Icon Changer.exe Pfad des fehlerhaften
Moduls: C:\Windows\system32\MSVBVM60.DLL Berichtskennung: 73900840-d8a9-11df-bba5-94a90be13772
Error - 15.10.2010 20:16:06 | Computer Name = PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Movie
Maker\Movie Maker\MOVIEMK.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 15.10.2010 20:16:43 | Computer Name = PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Movie
Maker\Movie Maker\CaptureWizard.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 15.10.2010 20:17:07 | Computer Name = PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei
"c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.
Der
Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs
im assemblyIdentity-Element ist ungültig.
Error - 16.10.2010 09:04:42 | Computer Name = PC | Source = Application Hang | ID = 1002
Description = Programm ava.exe, Version 1.0.0.1 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 14ec Startzeit:
01cb6d329e301230 Endzeit: 4 Anwendungspfad: C:\Program Files\A.V.A\Binaries\ava.exe
Berichts-ID:
eec22b21-d925-11df-bf89-c76433b00971
[ NetLimiter 3 Events ]
Error - 10.10.2010 17:29:35 | Computer Name = PC | Source = NetLimiter 3 BaseCli | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>5000</err-code> <module>NetLimiter.NLBaseClient.1147</module>
<desc>Failed
to connect to NetLimiter service.</desc> <param name='host-name' value=''/> </nl-error>
<nl-error>
<err-code>1</err-code>
<hresult
code='80080005'>Starten des Servers fehlgeschlagen</hresult> <module>NetLimiter.NLBaseClient.235</module>
</nl-error>
</nl-error-list>
Error - 10.10.2010 17:30:16 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>0</err-code> <hresult code='80070002'>The
system cannot find the file specified.</hresult> <module>NetLimiter.Main.123</module>
<param
name='last-error' value='2'/> <param name='fun-name' value='OpenDevice'/> </nl-error>
</nl-error-list>
Error - 10.10.2010 17:30:16 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>2010</err-code> <module>NetLimiter.Main.77</module>
<desc>Failed
to initialize NetLimiter service.</desc> </nl-error> <nl-error> <err-code>0</err-code>
<hresult
code='80070002'>The system cannot find the file specified.</hresult> <module>NetLimiter.Main.123</module>
<param
name='last-error' value='2'/> <param name='fun-name' value='OpenDevice'/> </nl-error>
</nl-error-list>
Error - 10.10.2010 17:30:16 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = The service failed to start
Error - 10.10.2010 17:30:46 | Computer Name = PC | Source = NetLimiter 3 BaseCli | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>1</err-code> <hresult code='80080005'>Starten
des Servers fehlgeschlagen</hresult> <module>NetLimiter.NLBaseClient.235</module>
</nl-error>
</nl-error-list>
Error - 10.10.2010 17:30:46 | Computer Name = PC | Source = NetLimiter 3 BaseCli | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>5000</err-code> <module>NetLimiter.NLBaseClient.1147</module>
<desc>Failed
to connect to NetLimiter service.</desc> <param name='host-name' value=''/> </nl-error>
<nl-error>
<err-code>1</err-code>
<hresult
code='80080005'>Starten des Servers fehlgeschlagen</hresult> <module>NetLimiter.NLBaseClient.235</module>
</nl-error>
</nl-error-list>
Error - 10.10.2010 17:31:01 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>0</err-code> <hresult code='80070002'>The
system cannot find the file specified.</hresult> <module>NetLimiter.Main.123</module>
<param
name='last-error' value='2'/> <param name='fun-name' value='OpenDevice'/> </nl-error>
</nl-error-list>
Error - 10.10.2010 17:31:01 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>2010</err-code> <module>NetLimiter.Main.77</module>
<desc>Failed
to initialize NetLimiter service.</desc> </nl-error> <nl-error> <err-code>0</err-code>
<hresult
code='80070002'>The system cannot find the file specified.</hresult> <module>NetLimiter.Main.123</module>
<param
name='last-error' value='2'/> <param name='fun-name' value='OpenDevice'/> </nl-error>
</nl-error-list>
Error - 10.10.2010 17:31:01 | Computer Name = PC | Source = NetLimiter 3 Service | ID = 1000
Description = The service failed to start
Error - 10.10.2010 18:29:10 | Computer Name = PC | Source = NetLimiter 3 BaseCli | ID = 1000
Description = <nl-error-list> <nl-error> <err-code>1</err-code> <hresult code='80010108'>Das
aufgerufene Objekt wurde von den Clients getrennt.</hresult> <module>NetLimiter.NLBaseClient.1486</module>
</nl-error>
</nl-error-list>
[ System Events ]
Error - 29.08.2010 14:55:28 | Computer Name = PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 29.08.2010 14:55:51 | Computer Name = PC | Source = W3SVC | ID = 1004
Description =
Error - 29.08.2010 14:55:51 | Computer Name = PC | Source = HTTP | ID = 15005
Description =
Error - 29.08.2010 14:59:03 | Computer Name = PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 29.08.2010 14:59:03 | Computer Name = PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 29.08.2010 14:59:31 | Computer Name = PC | Source = W3SVC | ID = 1004
Description =
Error - 29.08.2010 14:59:31 | Computer Name = PC | Source = HTTP | ID = 15005
Description =
Error - 29.08.2010 15:01:57 | Computer Name = PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
Error - 29.08.2010 15:01:57 | Computer Name = PC | Source = atikmdag | ID = 43029
Description = Display is not active
Error - 29.08.2010 15:02:28 | Computer Name = PC | Source = W3SVC | ID = 1004
Description =
< End of report >
Achso ich habe übrigens svchost.bat manuell gelöscht. |
|
16.10.2010, 21:14
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Problem / Echelon RAT Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
PRC - C:\Windows\Installer\MSI8332.tmp ()
SRV - (HyperDeskCustomThemeEnabler) -- C:\Windows\Installer\MSI8332.tmp ()
DRV - (XDva363) -- C:\Windows\System32\XDva363.sys File not found
DRV - (XDva362) -- C:\Windows\System32\XDva362.sys File not found
DRV - (XDva352) -- C:\Windows\System32\XDva352.sys File not found
DRV - (XDva347) -- C:\Windows\System32\XDva347.sys File not found
DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsof1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [Risorse di Windows] C:\Program Files\Javascript\MixerAudio.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found
O4 - HKCU..\Run: [{2C0852D4-5874-B4ED-0853-09FBCB7E94E2}] C:\Users\Admin.PC\AppData\Roaming\winsc\2s.exe File not found
O4 - HKCU..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O4 - HKCU..\Run: [Windows] C:\Users\Public\Public Documents\Windows Movie Player\player.exe File not found
O4 - HKCU..\Run: [WindowsEssentials] C:\Users\Admin.PC\AppData\Local\Temp\Svchost.bat File not found
O4 - Startup: C:\Users\Admin.PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousometer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 1 = Aegis.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 2 = Aegis64.exe
O32 - AutoRun File - [2010.09.11 17:45:09 | 000,000,051 | -H-- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.06.11 08:44:56 | 000,000,043 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{69955d00-9e79-11df-8017-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{69955d00-9e79-11df-8017-806e6f6e6963}\Shell\AutoRun\command - "" = J:\Autorun.exe -- File not found
[2010.10.16 00:12:42 | 000,000,000 | ---D | C] -- C:\Windows\IC
[2010.10.12 12:36:44 | 000,000,000 | ---D | C] -- C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP
[2010.10.10 23:26:09 | 000,109,568 | ---- | C] (-I.Paradise-) -- C:\Windows\System32\kadyxhukoedj.exe
[2010.09.21 15:01:33 | 000,000,000 | -H-D | C] -- C:\Users\Admin.PC\AppData\Roaming\ijjigame
[2010.09.20 19:13:22 | 000,713,312 | ---- | C] (NHN USA) -- C:\Windows\System32\ijjiSetup.exe
[2010.09.20 19:13:22 | 000,062,048 | ---- | C] (NHN USA Inc.) -- C:\Windows\System32\ijjiProcessRestarter.exe
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:3C6860C5
:Files
C:\Users\Public\Public Documents
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ |
|
| Themen zu Problem / Echelon RAT |
| echelon, einfach, falsche, formatiere, formatieren, ganzes, helft, installiere, installieren, kapersky, manager, neu, nötig, problem, system, system neu, tagen, task manager |
Linear-Darstellung
