Trojaner-Board - MS removal Tool vollständig entfernen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - MS removal Tool vollständig entfernen (https://www.trojaner-board.de/100818-ms-removal-tool-vollstaendig-entfernen.html)

Hallo Deathkid,

Zitat:

Zitat von Deathkid535 (Beitrag 680541)

Naja, neu aufsetzen wäre schade, aber da lässt ich wohl nicht mehr wirklich was machen..

Noch geben wir nicht auf. :)

Downloade dir bitte dds.exe und speichere diese auf deinem Desktop.

Starte die dds.exe und klicke auf Scan.
Ändere keine Einstellungen ohne Anweisung.
Wenn der Scan beendet wurde, wird sich eine Logfile öffnen ( dds.txt )

Bitte poste diese in deiner nächsten Antwort.

Hallo M-K-D-B,

Zitat:

Noch geben wir nicht auf. :)

Danke fürs Mut machen :)
Also, dss bleibt bei genau 60 (nachgezählten;)) Rauten stecken.
Auch umbenennen half nichts. Soll ich versuchen, es über die Befehlszeile auszuführen?
MFG, Deathkid

Hallo Deathkid,

Zitat:

Zitat von Deathkid535 (Beitrag 680744)

Soll ich versuchen, es über die Befehlszeile auszuführen?

Nein. Bitte hab Geduld. Ich melde mich wieder.

Hallo Deathkid,

bei Problemen oder Komplikationen mit mbr.exe bitte genau Bericht erstatten. :)

Schritt # 1: Scan mit mbr.exe
Downloade dir mbr.exe auf deinen Desktop.

Starte die mbr.exe
Benutzer von Windows Vista und 7 mit Rechtsklick -> Als Administrator ausführen
Das Tool startet automatisch seine Suche. Dabei erscheint ein schwarzes Fenster.
Nach Beendigung des Suchlaufs findest du auf deinem Desktop eine Datei mbr.txt.
Poste mir den Inhalt des Logfiles mit deiner nächsten Antwort.

Schritt # 2: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile von mbr.exe.

Hallo M-K-D-B,
Ich habe MBR wie beschrieben ausgeführt, aber es bleibt hängen. Im schwarzen Fenster steht:
Stealth....

device: opened succesfully
user: MBR read succesfully
kernel: MBR read succesfully
user&kernerl MBR ok
error: Read Die Anforderung kann wegen eines E/A-Gerötefehlers nicht ausgef³hrt werden

Ausserdem habe ich gerade eine Meldung von WIndows Defender bekommen, SS´s im Anhang, und wenn ich es über die Systemsteuerung öffnen will, kommt ganz kurz ein popup fenster, zu schnell um einen SS zu machen, ich versuch es grade.
MFG,
Deathkid

So, habs geschafft das zu Screenshotten, sollte im Anhang sein

Hallo Deathkid,

Starte die dds.exe.
Entferne unter Options for dds.txt den Haken vor Check MBR.
Klicke auf Scan
Wenn der Scan beendet wurde, wird sich eine Logfile öffnen ( dds.txt )

Bitte poste diese in deiner nächsten Antwort.

Hallo M-K-D-B,
juhu es hat funktioniert :)

Code:

DDS (Ver_2011-06-22.01) - NTFS_x86 

Internet Explorer: 8.0.7600.16385  BrowserJavaVersion: 1.6.0_23

Run by Administrator at 14:39:51 on 2011-07-08

#Option MBR scan  is disabled.

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.43.1031.18.1788.939 [GMT 2:00]

.

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Google\Update\1.3.21.57\GoogleCrashHandler.exe

C:\Windows\Explorer.EXE

C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe

C:\Program Files\Lenovo\Energy Management\utility.exe

C:\Program Files\Lenovo\Energy Management\Energy Management.exe

C:\Program Files\Real\RealPlayer\Update\realsched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Users\Administrator\AppData\Local\Apps\2.0\W55HJDXV.742\KR5R0CNL.RO1\curs..tion_eee711038731a406_0004.0000_0d453ed5fea2fe48\CurseClient.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe

C:\Program Files\Real\RealUpgrade\RealUpgrade.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\svchost.exe -k SDRSVC

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: DivX HiQ: {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Babylon IE plugin: {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll

BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: @c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Speech Recognition] "c:\windows\speech\common\sapisvr.exe" -SpeechUX -Startup

uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [EnergyUtility] c:\program files\lenovo\energy management\utility.exe

mRun: [Energy Management] c:\program files\lenovo\energy management\Energy Management.exe

mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe"  -osboot

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe"  /autorun

StartupFolder: c:\users\administrator\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

.

INFO: HKLM has more than 50 listed domains.

   If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 212.186.211.21 195.34.133.21 192.168.0.1

TCP: Interfaces\{F1585E0E-A783-49E6-89FF-B6AEC53252AA} : DHCPNameServer = 212.186.211.21 195.34.133.21 192.168.0.1

TCP: Interfaces\{F1585E0E-A783-49E6-89FF-B6AEC53252AA}\350756564645F6573686246344832444 : DHCPNameServer = 10.0.0.138

TCP: Interfaces\{F1585E0E-A783-49E6-89FF-B6AEC53252AA}\4586F6D637F6E6831493632473 : DHCPNameServer = 10.0.0.138 10.0.0.138

TCP: Interfaces\{F1585E0E-A783-49E6-89FF-B6AEC53252AA}\D4967686479702D4F6573756 : DHCPNameServer = 10.0.0.138 10.0.0.138

TCP: Interfaces\{F1585E0E-A783-49E6-89FF-B6AEC53252AA}\E4574756C6C616 : DHCPNameServer = 192.168.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

LSA: Notification Packages =  scecli ACGina

LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg pku2u livessp

mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\windows mail\WinMail.exe" OCInstallUserConfigOE

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\0q27vfov.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=

FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\google updater\2.4.2166.3772\npCIDetect14.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\users\administrator\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll

FF - plugin: c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\0q27vfov.default\extensions\{1bc9ba34-1eed-42ca-a505-6d2f1a935bbb}\plugins\npietab2.dll

FF - plugin: c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\0q27vfov.default\extensions\battlefieldplay4free@ea.com\plugins\npBP4FUpdater.dll

.

---- FIREFOX POLICIES ----

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 750000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 750000

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 0

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-11 366640]

R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2011-5-30 9472]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2010-7-1 58368]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-11 22712]

R3 SaiK0728;SaiK0728;c:\windows\system32\drivers\SaiK0728.sys [2008-1-21 104960]

R3 SRS_AudioFusion_Service;AudioFusion Edition;c:\windows\system32\drivers\SRS_AudioFusion_i386.sys [2011-3-13 390944]

R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2010-7-1 31288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-3-13 135664]

S2 PEVSystemStart;PEVSystemStart;c:\cofi25381c\pev.cfxxe [2011-6-26 256000]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-6-7 1153368]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-5-16 39272]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]

S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-4-28 30192]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-3-13 135664]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2010-7-1 174592]

S3 SaiK0CFA;SaiK0CFA;c:\windows\system32\drivers\SaiK0CFA.sys [2011-3-22 141832]

S3 SaiU0CFA;SaiU0CFA;c:\windows\system32\drivers\SaiU0CFA.sys [2011-3-22 35208]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2010-7-2 1343400]

S3 wsvd;wsvd;c:\windows\system32\drivers\wsvd.sys [2009-7-21 81704]

S4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-25 172032]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

.

=============== Created Last 30 ================

.

2011-07-07 08:24:53        --------        d-s---w-        C:\cofi25381c

2011-07-07 08:20:10        --------        d-----w-        c:\program files\CCleaner

2011-07-07 07:56:17        --------        d-s---w-        C:\cofi26567c

2011-07-07 07:49:47        --------        d-s---w-        C:\cofi

2011-07-06 20:19:36        --------        d-s---w-        C:\w2of455n

2011-07-06 15:43:37        --------        d-s---w-        C:\ComboFix

2011-07-06 15:22:13        98816        ----a-w-        c:\windows\sed.exe

2011-07-06 15:22:13        256000        ----a-w-        c:\windows\PEV.exe

2011-07-06 15:22:13        208896        ----a-w-        c:\windows\MBR.exe

2011-07-05 15:08:23        --------        d-----w-        c:\windows\system32\wbem\repository

2011-07-02 14:23:44        --------        d-----w-        c:\programdata\AVAST Software

2011-07-02 14:23:44        --------        d-----w-        c:\program files\AVAST Software

2011-07-01 15:51:29        --------        d-----w-        c:\users\administrator\appdata\roaming\SUPERAntiSpyware.com

2011-07-01 15:51:29        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2011-07-01 15:50:14        --------        d-----w-        c:\program files\SUPERAntiSpyware

2011-06-30 07:05:29        100736        ----a-w-        C:\pwdirpog.sys

2011-06-29 10:25:47        294912        ----a-w-        c:\windows\system32\umpnpmgr.dll

2011-06-29 10:25:32        1401856        ----a-w-        c:\windows\system32\mssrch.dll

2011-06-29 10:25:31        428032        ----a-w-        c:\windows\system32\SearchIndexer.exe

2011-06-29 10:25:31        1553920        ----a-w-        c:\windows\system32\tquery.dll

2011-06-29 10:25:30        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe

2011-06-29 10:25:30        666624        ----a-w-        c:\windows\system32\mssvp.dll

2011-06-29 10:25:30        59392        ----a-w-        c:\windows\system32\msscntrs.dll

2011-06-29 10:25:30        337408        ----a-w-        c:\windows\system32\mssph.dll

2011-06-29 10:25:30        197120        ----a-w-        c:\windows\system32\mssphtb.dll

2011-06-29 10:25:30        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe

2011-06-27 19:06:30        --------        d-----w-        C:\_OTL

2011-06-27 18:55:07        --------        d-----w-        c:\program files\VS Revo Group

2011-06-26 20:50:35        --------        d--h--w-        c:\windows\PIF

2011-06-22 17:34:53        --------        d-----w-        c:\users\administrator\appdata\roaming\RIFT

2011-06-22 17:34:45        --------        d-----w-        c:\program files\RIFT Game

2011-06-18 07:43:48        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2011-06-17 12:38:41        311296        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-06-17 12:38:41        309760        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-06-17 12:38:41        114176        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-06-17 12:38:39        338944        ----a-w-        c:\windows\system32\drivers\afd.sys

2011-06-17 12:38:39        1286016        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2011-06-17 12:38:02        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2011-06-17 12:38:00        78336        ----a-w-        c:\windows\system32\drivers\dfsc.sys

2011-06-16 11:23:54        --------        d-----w-        c:\users\administrator\dwhelper

2011-06-11 20:47:19        --------        d-----w-        c:\users\administrator\appdata\roaming\Malwarebytes

2011-06-11 20:46:37        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-11 20:46:35        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-11 20:46:31        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-06-11 20:46:31        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-06-11 08:49:21        166400        --sha-r-        c:\windows\system32\KBDINMALV.dll

2011-06-10 19:16:36        152        ----a-w-        c:\windows\system32\sysplog2.dll

2011-06-10 19:16:28        152        ----a-w-        c:\windows\system32\sysplog.dll

2011-06-10 19:15:36        67376        ------w-        c:\windows\system32\SYSINFO.OCX

2011-06-10 19:15:36        260096        ------w-        c:\windows\system32\RICHTX32.OCX

2011-06-10 19:15:36        244416        ------w-        c:\windows\system32\MSFLXGRD.OCX

2011-06-10 19:15:36        152848        ------w-        c:\windows\system32\COMDLG32.OCX

2011-06-10 19:15:36        132880        ------w-        c:\windows\system32\MSINET.OCX

2011-06-10 19:15:26        --------        d-----w-        c:\users\administrator\appdata\roaming\8 x 8 Media AG

2011-06-10 19:15:26        --------        d-----w-        c:\program files\chessimo

2011-06-10 19:15:25        --------        d-----w-        c:\programdata\InstallMate

2011-06-10 12:18:51        6962000        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{0a6561fe-8b0a-444f-8d2a-3a61d1ccafb7}\mpengine.dll

.

==================== Find3M  ====================

.

2011-05-28 03:00:02        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2011-05-22 06:17:12        138264        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2011-05-22 06:16:07        234768        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2011-05-22 06:16:07        234768        ----a-w-        c:\windows\system32\PnkBstrB.exe

2011-05-07 10:12:24        138056        ----a-w-        c:\users\administrator\appdata\roaming\PnkBstrK.sys

2011-05-07 10:11:19        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2011-05-04 02:43:59        222720        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-05-04 02:43:48        96256        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-05-04 02:43:41        123392        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-05-03 04:50:29        740864        ----a-w-        c:\windows\system32\inetcomm.dll

2011-04-28 18:55:22        499712        ----a-w-        c:\windows\system32\msvcp71.dll

2011-04-28 18:55:22        348160        ----a-w-        c:\windows\system32\msvcr71.dll

2011-04-24 21:08:00        4303928        ----a-w-        c:\windows\system32\GameMon.des

2011-04-22 19:36:05        26496        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-04-22 19:31:50        981504        ----a-w-        c:\windows\system32\wininet.dll

2011-04-22 19:31:26        44544        ----a-w-        c:\windows\system32\licmgr10.dll

2011-04-22 18:23:59        386048        ----a-w-        c:\windows\system32\html.iec

.

============= FINISH: 14:40:07,13 ===============

Gruß,
Deathkid

Hallo Deathkid,

Schritt # 1: ComboFix über Befehlszeile ausführen
Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:

BleepingComputer.com - ForoSpyware.com

und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste und kopiere folgendes in die Ausführen Zeile

Code:

Combofix /nombr

Poste bitte die Combofix.txt hier in dein Thema

Schritt # 2: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile von ComboFix und

berichte ob es noch Probleme gibt.

Hallo M-K-D-B,
Du bist der genialste :DDD
Naja, hab bei der ausführen-Zeile ein bisschen improvisiert, da es bei deiner Version nicht funktioniert hat. *pfeif* also ich hab reingeschrieben:

Code:

"%userprofile%\Desktop\Combofix.exe" /nombr

So, jetzt aber das Logfile:

Code:

ComboFix 11-07-08.01 - Administrator 08.07.2011  20:36:03.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.43.1031.18.1788.940 [GMT 2:00]

ausgeführt von:: c:\users\Administrator\Desktop\Combofix.exe

Benutzte Befehlsschalter :: /nombr

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\users\Administrator\AppData\Roaming\Adobe\plugs

c:\users\Administrator\AppData\Roaming\Adobe\shed

c:\users\Administrator\AppData\Roaming\MICROSOFT\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

c:\users\Dennis\AppData\Roaming\MICROSOFT\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

c:\users\Dennis\WowMatrix.exe

c:\windows\system32\sysplog.dll

c:\windows\system32\sysplog2.dll

c:\windows\XSxS

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-06-08 bis 2011-07-08  ))))))))))))))))))))))))))))))

.

.

2011-07-08 18:58 . 2011-07-08 18:58        --------        d-----w-        c:\users\Dennis\AppData\Local\temp

2011-07-08 18:58 . 2011-07-08 18:58        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-07-07 08:20 . 2011-07-07 08:20        --------        d-----w-        c:\program files\CCleaner

2011-07-07 07:49 . 2011-07-07 07:50        --------        d-----w-        C:\cofi

2011-07-06 20:19 . 2011-07-06 20:20        --------        d-----w-        C:\w2of455n

2011-07-05 15:08 . 2011-07-08 19:00        --------        d-----w-        c:\windows\system32\wbem\repository

2011-07-02 14:23 . 2011-07-04 14:53        --------        d-----w-        c:\programdata\AVAST Software

2011-07-02 14:23 . 2011-07-02 14:23        --------        d-----w-        c:\program files\AVAST Software

2011-07-01 15:51 . 2011-07-01 15:51        --------        d-----w-        c:\users\Administrator\AppData\Roaming\SUPERAntiSpyware.com

2011-07-01 15:51 . 2011-07-01 15:51        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2011-07-01 15:50 . 2011-07-01 15:51        --------        d-----w-        c:\program files\SUPERAntiSpyware

2011-06-30 07:05 . 2011-06-30 07:05        100736        ----a-w-        C:\pwdirpog.sys

2011-06-29 10:25 . 2011-05-24 10:35        294912        ----a-w-        c:\windows\system32\umpnpmgr.dll

2011-06-29 10:25 . 2011-05-04 04:52        1401856        ----a-w-        c:\windows\system32\mssrch.dll

2011-06-29 10:25 . 2011-05-04 04:53        1553920        ----a-w-        c:\windows\system32\tquery.dll

2011-06-29 10:25 . 2011-05-04 04:52        428032        ----a-w-        c:\windows\system32\SearchIndexer.exe

2011-06-29 10:25 . 2011-05-04 04:52        666624        ----a-w-        c:\windows\system32\mssvp.dll

2011-06-29 10:25 . 2011-05-04 04:52        59392        ----a-w-        c:\windows\system32\msscntrs.dll

2011-06-29 10:25 . 2011-05-04 04:52        337408        ----a-w-        c:\windows\system32\mssph.dll

2011-06-29 10:25 . 2011-05-04 04:52        197120        ----a-w-        c:\windows\system32\mssphtb.dll

2011-06-29 10:25 . 2011-05-04 04:52        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe

2011-06-29 10:25 . 2011-05-04 04:52        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe

2011-06-27 19:06 . 2011-06-27 19:06        --------        d-----w-        C:\_OTL

2011-06-27 18:55 . 2011-06-27 18:55        --------        d-----w-        c:\program files\VS Revo Group

2011-06-26 20:50 . 2011-06-26 20:50        --------        d--h--w-        c:\windows\PIF

2011-06-22 17:34 . 2011-06-22 17:36        --------        d-----w-        c:\users\Administrator\AppData\Roaming\RIFT

2011-06-22 17:34 . 2011-06-22 17:37        --------        d-----w-        c:\program files\RIFT Game

2011-06-18 07:43 . 2011-06-18 07:43        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2011-06-17 12:38 . 2011-04-29 02:57        311296        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-06-17 12:38 . 2011-04-29 02:57        309760        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-06-17 12:38 . 2011-04-29 02:57        114176        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-06-17 12:38 . 2011-04-25 04:56        1286016        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2011-06-17 12:38 . 2011-04-25 02:35        338944        ----a-w-        c:\windows\system32\drivers\afd.sys

2011-06-17 12:38 . 2010-12-18 05:31        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2011-06-17 12:38 . 2011-04-27 02:33        78336        ----a-w-        c:\windows\system32\drivers\dfsc.sys

2011-06-16 11:23 . 2011-07-06 13:15        --------        d-----w-        c:\users\Administrator\dwhelper

2011-06-11 20:47 . 2011-06-11 20:47        --------        d-----w-        c:\users\Administrator\AppData\Roaming\Malwarebytes

2011-06-11 20:46 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-11 20:46 . 2011-06-11 20:46        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-11 20:46 . 2011-06-11 20:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-06-11 20:46 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-06-11 08:49 . 2011-06-11 08:49        166400        --sha-r-        c:\windows\system32\KBDINMALV.dll

2011-06-10 19:15 . 2011-02-15 22:00        260096        ------w-        c:\windows\system32\RICHTX32.OCX

2011-06-10 19:15 . 2011-02-15 22:00        244416        ------w-        c:\windows\system32\MSFLXGRD.OCX

2011-06-10 19:15 . 2011-02-15 22:00        132880        ------w-        c:\windows\system32\MSINET.OCX

2011-06-10 19:15 . 2011-02-15 22:00        67376        ------w-        c:\windows\system32\SYSINFO.OCX

2011-06-10 19:15 . 2011-02-15 22:00        152848        ------w-        c:\windows\system32\COMDLG32.OCX

2011-06-10 19:15 . 2011-06-10 19:15        --------        d-----w-        c:\program files\chessimo

2011-06-10 19:15 . 2011-06-10 19:15        --------        d-----w-        c:\users\Administrator\AppData\Roaming\8 x 8 Media AG

2011-06-10 19:15 . 2011-06-10 19:15        --------        d-----w-        c:\programdata\InstallMate

2011-06-10 12:18 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0A6561FE-8B0A-444F-8D2A-3A61D1CCAFB7}\mpengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-22 06:17 . 2011-05-07 10:12        138264        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2011-05-22 06:16 . 2011-05-09 13:37        234768        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2011-05-22 06:16 . 2011-05-07 10:11        234768        ----a-w-        c:\windows\system32\PnkBstrB.exe

2011-05-15 22:09 . 2010-06-24 09:33        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-05-07 10:12 . 2011-05-07 10:12        138056        ----a-w-        c:\users\Administrator\AppData\Roaming\PnkBstrK.sys

2011-05-07 10:11 . 2011-05-07 10:11        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2011-04-28 18:55 . 2009-06-18 11:58        499712        ----a-w-        c:\windows\system32\msvcp71.dll

2011-04-28 18:55 . 2009-06-18 11:58        348160        ----a-w-        c:\windows\system32\msvcr71.dll

2011-04-28 12:23 . 2011-04-16 11:39        750912        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2011-04-24 21:08 . 2011-05-22 18:53        4303928        ----a-w-        c:\windows\system32\GameMon.des

2011-04-24 09:46 . 2011-03-17 12:38        794944        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-04-22 19:36 . 2011-05-25 08:35        26496        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-04-16 11:39 . 2011-03-17 12:38        48648        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-03-18 17:56 . 2011-03-31 17:44        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2011-04-28 18:48 . 2011-04-28 18:48        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-30 2424192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-01-04 4462464]

"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2008-12-26 1277952]

"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-04-28 273544]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-06-16 126976]

.

c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2011-4-6 0]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SRS AudioFusion.lnk]

backup=c:\windows\pss\SRS AudioFusion.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^Administrator^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip]

path=c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip

backup=c:\windows\pss\CurseClientStartup.ccip.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Dennis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^RocketDock (2).lnk]

backup=c:\windows\pss\RocketDock (2).lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Dennis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]

backup=c:\windows\pss\Xfire.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcWin7Hlpr]

2010-09-17 15:53        31592        ----a-w-        c:\program files\Lenovo\Access Connections\AcTBenabler.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-20 21:07        932288        ----a-r-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-01-31 08:44        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

2010-12-14 16:17        47904        ----a-w-        c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cAudioFilterAgent]

2009-11-29 13:49        487992        ------w-        c:\program files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-02-15 01:32        1230704        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 09:44        31072        ----a-w-        c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-12-13 16:16        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProfilerU]

2010-07-29 10:53        227840        ----a-w-        c:\program files\Saitek\SD6\Software\ProfilerU.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]

2010-04-12 08:40        180224        ----a-w-        c:\program files\PowerISO\PWRISOVM.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaiMfd]

2010-07-29 10:54        123392        ----a-w-        c:\program files\Saitek\SD6\Software\SaiMfd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaiVolume]

2008-01-18 15:37        126976        ----a-w-        c:\program files\Saitek\CyborgKeyboard\SaiVolume.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]

2009-11-19 05:45        307768        ------w-        c:\program files\CONEXANT\SAII\SAIICpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2009-11-24 19:24        98304        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 09:44        248552        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 135664]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2011-04-28 30192]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 135664]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-04-24 4303928]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-22 174592]

R3 SaiK0CFA;SaiK0CFA;c:\windows\system32\DRIVERS\SaiK0CFA.sys [2010-08-10 141832]

R3 SaiU0CFA;SaiU0CFA;c:\windows\system32\DRIVERS\SaiU0CFA.sys [2010-08-10 35208]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-02 1343400]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]

R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-25 172032]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-20 697328]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2008-01-11 9472]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

S3 SaiK0728;SaiK0728;c:\windows\system32\DRIVERS\SaiK0728.sys [2008-01-21 104960]

S3 SRS_AudioFusion_Service;AudioFusion Edition;c:\windows\system32\drivers\SRS_AudioFusion_i386.sys [2010-11-15 390944]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-10-19 31288]

.

.

Inhalt des "geplante Tasks" Ordners

.

2011-07-08 c:\windows\Tasks\AutoSmartDefrag.job

- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2011-01-13 17:08]

.

2011-07-08 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-04-28 18:47]

.

2011-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 17:25]

.

2011-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 17:25]

.

2011-07-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000Core.job

- c:\users\Dennis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-18 21:57]

.

2011-07-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000UA.job

- c:\users\Dennis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-18 21:57]

.

2011-07-03 c:\windows\Tasks\SmartDefrag.job

- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2011-01-13 17:08]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

TCP: DhcpNameServer = 212.186.211.21 195.34.133.21 192.168.0.1

FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0q27vfov.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 750000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 750000

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 0

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-SSDMonitor - c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,27,ab,e0,bd,86,28,a5,4e,9d,53,b5,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,82,25,47,39,7f,13,6a,4a,a4,1c,f9,\

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.3G2"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.3GP"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.3G2"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.3GP"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ADTS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ADTS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ADTS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.AIFF"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.AIFF"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.AIFF"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ASF"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ASX"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.AU"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]

@Denied: (2) (Administrator)

"Progid"="divx_avi_file"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.CDA"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.div\UserChoice]

@Denied: (2) (Administrator)

"Progid"="divx_div_file"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.divx\UserChoice]

@Denied: (2) (Administrator)

"Progid"="divx_divx_file"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (Administrator)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (Administrator)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.M2TS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.M2TS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.m3u"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.M4A"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MP4"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]

@Denied: (2) (Administrator)

"Progid"="IE.AssocFile.MHT"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]

@Denied: (2) (Administrator)

"Progid"="IE.AssocFile.MHT"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MIDI"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MIDI"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\UserChoice]

@Denied: (2) (Administrator)

"Progid"="divx_mkv_file"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MOV"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MP3"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MP3"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MP4"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MP4"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MPEG"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.M2TS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.MIDI"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SC2Map\UserChoice]

@Denied: (2) (Administrator)

"Progid"="SC2.Map"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sc2replay\UserChoice]

@Denied: (2) (Administrator)

"Progid"="Blizzard.SC2Replay"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (Administrator)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.AU"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tix\UserChoice]

@Denied: (2) (Administrator)

"Progid"="divx_tix_file"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\UserChoice]

@Denied: (2) (Administrator)

"Progid"="uTorrent"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.TTS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tts\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.TTS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]

@Denied: (2) (Administrator)

"Progid"="IE.AssocFile.URL"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WAV"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WAX"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ASF"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WMA"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WMD"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WMS"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WMV"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.ASX"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WMZ"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WPL"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]

@Denied: (2) (Administrator)

"Progid"="WMP11.AssocFile.WVX"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (Administrator)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-1140944107-3424129360-3757389648-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (Administrator)

"Progid"="FirefoxHTML"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(5376)

c:\program files\Lenovo\Access Connections\ACDeskBand.dll

c:\program files\Lenovo\Access Connections\AcLocSettings.dll

c:\program files\Lenovo\Access Connections\AcCryptHlpr.dll

c:\program files\Lenovo\Access Connections\ACHelper.dll

c:\program files\Lenovo\Access Connections\AcSvcStub.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\WLANExt.exe

c:\windows\system32\conhost.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\taskhost.exe

c:\program files\Google\Update\1.3.21.57\GoogleCrashHandler.exe

c:\windows\system32\conhost.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe

c:\windows\system32\DllHost.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\taskhost.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-07-08  21:09:42 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-07-08 19:09

.

Vor Suchlauf: 16 Verzeichnis(se), 74.978.734.080 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 80.710.074.368 Bytes frei

.

- - End Of File - - 7331B6F676463A8E6BEE228B6245733E

Und nach dem starten von Firefox, war es nicht mehr mein Standardbrowser und es hat mich gefragt, ob ich es zu dem machen will. Ich habe mal Ja gedrückt. Ich hoffe das ist normal.
Und Google funktioniert jetzt auch wieder wie eh und je.

So, ich hoffe, ich darf jetzt mal einige Fragen stellen ;)
Also was hatte ich da genau? würde mich echt interressieren..
Wodurch habe ich das bekommen? Um sowas künftig zu vermeiden..
Darf ich wieder mit DEFOGGER die Treiber aktivieren.
Darf ich den Tea Timer wieder anstellen?
Darf ich wieder Avast installieren?
Was ist ein dchp Server?

Falls mir noch Fragen einfallen, schriebe ich sie noch :)
MFG,
Deathkid

Hallo Deathkid,

Zitat:

Zitat von Deathkid535 (Beitrag 681033)

Du bist der genialste :D

Ich hatte eine super Unterstützung im Team. :)

Zitat:

Zitat von Deathkid535 (Beitrag 681033)

Naja, hab bei der ausführen-Zeile ein bisschen improvisiert, da es bei deiner Version nicht funktioniert hat. *pfeif* also ich hab reingeschrieben:

Code:

"%userprofile%\Desktop\Combofix.exe" /nombr

Danke für die Information; werde ich mir für die Zukunft merken.

Zitat:

Zitat von Deathkid535 (Beitrag 681033)

So, ich hoffe, ich darf jetzt mal einige Fragen stellen ;)

Ja, darfst du. ;)

Schritt # 1: Beantwortung deiner Fragen

Zitat:

Also was hatte ich da genau? würde mich echt interressieren..

Ich kann dir leider nicht den Namen der Schadsoftware nennen, da ich sie nicht beim Namen kenne.
Ursache für die Umleitungen war u.a. diese Infektion:

Zitat:

c:\windows\XSxS

Es handelt sich hierbei nicht um ein Rootkit, wie ich zuerst vermutet habe.

Zitat:

Wodurch habe ich das bekommen? Um sowas künftig zu vermeiden..

Das ist schwer zu sagen. Ich weiß ja nicht, auf welchen Seiten du dich bewegst. Du solltest für dich aber nochmal überlegen, auf welchen Seiten du warst, als du dich mit MS Removal Tool infiziert hast und die entsprechenden Seiten meiden. Zurückverfolgen lässt sich das aber nicht mehr.

Zitat:

Was ist ein dchp Server?

Dynamic Host Configuration Protocol (dhcp)

Zitat:

Darf ich wieder mit DEFOGGER die Treiber aktivieren.
Darf ich den Tea Timer wieder anstellen?

Ich bitte noch um etwas Geduld. Ein paar abschließende Schritte sind noch zu erledigen. Wenn hierbei nichts mehr gefunden wird, entfernen wir noch die verwendeten Tools und ich gebe dir zum Abschluss noch ein paar Tipps mit auf den Weg. :) Und dann kümmern wir uns auch um TeaTimer und Defogger. Du hast bisher sehr gut durchgehalten, die letzten Schritte schaffen wir auch noch gemeinsam! :abklatsch:

Zitat:

Darf ich wieder Avast installieren?

Ja, damit gehts jetzt weiter:

Schritt # 2: Fehlende Anti-Viren Software
Bitte downloade und installiere Dir eines der folgenden AVPs.

Schritt # 3: Kontrollscan mit Malwarebytes' Anti-Malware (MBAM)

Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt # 4: Java deinstallieren/neu installieren

Schließe alle Internet Browser.
Folge dem Pfad: Start -> Systemsteuerung -> Programme deinstallieren
Deinstalliere bitte Java(TM) 6 Update 23
Lade dir anschließend Java(TM) 6 Update 26 von hier auf deinen Desktop.
Installiere anschließend die neue Version mit Rechtsklick -> Als Administrator ausführen

Schritt # 5: Wichtige Updates

Deinstalliere bitte deine aktuelle Version von Adobe Reader:
Start --> Systemsteuerung --> Programme deinstallieren --> Adobe Reader
und lade dir die neue Version von Hier herunter.
Entferne den Hacken für den McAfee SecurityScan.

Schritt # 6: ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Hacken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Scan archives".
Gehe sicher das bei Remove Found Threads kein Hacken gesetzt ist.
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

"%ProgramFiles%\Eset\Eset Online Scanner\log.txt"

Poste nun den Inhalt der log.txt.

Schritt # 7: Systemscan mit OTL

Starte bitte OTL.exe.
Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Schritt # 8: Durchführung einer Sicherheitskontrolle
Downloade Dir bitte SecurityCheck

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.
Poste den Inhalt bitte hier.

Schritt # 9: Fragen beantworten
Bitte beantworte mir folgende Fragen:

Wie läuft dein Rechner derzeit?
Gibt es noch irgendwelche Probleme? Wenn ja, beschreibe diese bitte so gut es geht.

Schritt # 10: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile von MBAM,
das Logfile des ESET Online Scanners,
die beiden neuen Logfiles von OTL (OTL.txt und Extras.txt),
das Logfile von SecurityCheck und
die Beantwortung der gestellten Fragen.

Hallo M-K-D-B,

Zitat:

Ich hatte eine super Unterstützung im Team.

Dann möchte ich mich an dieser Stelle herzlich bei deinem Team bedanken :)
So, hier die Logfiles:
MBAM:

Code:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org
 

Datenbank Version: 7056
 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385
 

09.07.2011 12:54:10

mbam-log-2011-07-09 (12-54-10).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 176784

Laufzeit: 7 Minute(n), 2 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Eset:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=522d7a51e23f3f4b976cccb2c1bfe5e4

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-07-09 03:12:01

# local_time=2011-07-09 05:12:01 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1033

# osver=6.1.7600 NT 

# compatibility_mode=5893 16776574 66 94 2503976 62651050 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=211718

# found=1

# cleaned=0

# scan_time=8413

C:\Users\Administrator\AppData\Roaming\WinPump\extensions.exe        Win32/Adware.GoodMedia.C application (unable to clean)        00000000000000000000000000000000        I

OTL-Logfile:

Code:

OTL logfile created on: 09.07.2011 21:13:02 - Run 11

OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Administrator\Desktop

 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 53,46% Memory free

6,98 Gb Paging File | 5,92 Gb Available in Paging File | 84,70% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 153,68 Gb Total Space | 72,06 Gb Free Space | 46,89% Space Free | Partition Type: NTFS

Drive D: | 78,03 Gb Total Space | 36,01 Gb Free Space | 46,15% Space Free | Partition Type: NTFS

Drive F: | 1001,00 Mb Total Space | 479,45 Mb Free Space | 47,90% Space Free | Partition Type: NTFS

 

Computer Name: DENNIS-PC | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Programme\AVAST Software\Avast\AvastUI.exe (AVAST Software)

PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)

PRC - C:\Programme\Google\Update\1.3.21.57\GoogleCrashHandler.exe (Google Inc.)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)

PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)

PRC - C:\Programme\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)

PRC - C:\Programme\DAEMON Tools Pro\DTShellHlp.exe (DT Soft Ltd)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(Beijing)Limited)

PRC - C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (SUService) -- C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AcSvc) -- C:\Programme\Lenovo\Access Connections\AcSvc.exe (Lenovo)

SRV - (AcPrfMgrSvc) -- C:\Programme\Lenovo\Access Connections\AcPrfMgrSvc.exe (Lenovo)

SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)

SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (WindowBlinds) -- C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation)

SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)

DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)

DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)

DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)

DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)

DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (SRS_AudioFusion_Service) -- C:\Windows\System32\drivers\SRS_AudioFusion_i386.sys ()

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)

DRV - (SaiNtBus) -- C:\Windows\System32\drivers\SaiBus.sys (Saitek)

DRV - (SaiMini) -- C:\Windows\System32\drivers\SaiMini.sys (Saitek)

DRV - (SaiK0CFA) -- C:\Windows\System32\drivers\SaiK0CFA.sys (Saitek)

DRV - (SaiU0CFA) -- C:\Windows\System32\drivers\SaiU0CFA.sys (Saitek)

DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)

DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)

DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)

DRV - (Cam5607) -- C:\Windows\System32\drivers\BisonC07.sys (Bison Electronics. Inc. )

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)

DRV - (usbfilter) -- C:\Windows\System32\drivers\usbfilter.sys (Advanced Micro Devices)

DRV - (RSUSBSTOR) -- C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)

DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV - (wsvd) -- C:\Windows\System32\drivers\wsvd.sys (CyberLink)

DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)

DRV - (SaiK0728) -- C:\Windows\System32\drivers\SaiK0728.sys (Saitek)

DRV - (ACPIVPC) -- C:\Windows\System32\drivers\AcpiVpc.sys (Lenovo Corporation)

DRV - (psadd) -- C:\Windows\System32\drivers\psadd.sys (Lenovo (United States) Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 03 5B 60 61 79 69 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Yahoo"

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/ig"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="

 

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.03.13 19:28:40 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.03.13 19:28:40 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.04.28 20:56:01 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011.07.09 12:40:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.28 20:55:53 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.07.09 14:41:56 | 000,000,000 | ---D | M]

 

[2010.10.14 20:00:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions

[2011.07.07 20:26:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions

[2011.05.22 20:40:15 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}

[2011.06.23 13:09:09 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.05.07 08:23:55 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\battlefieldplay4free@ea.com

[2011.07.09 14:20:04 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.07.02 16:36:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.02 17:21:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2011.07.09 14:20:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2011.04.26 18:15:44 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\Programme\Mozilla Firefox\extensions\adapter@babylontc.com

File not found (No name found) -- 

[2011.07.09 12:40:51 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

[2010.07.02 16:36:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.02 17:21:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2011.07.09 14:20:04 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2011.04.26 18:15:44 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\ADAPTER@BABYLONTC.COM

[2011.04.28 20:56:01 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT

() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}.XPI

() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM.XPI

[2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2011.07.09 14:19:43 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2011.04.26 18:13:26 | 000,002,226 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\babylon.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.07.08 21:01:19 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)

O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [Energy Management] C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)

O4 - HKLM..\Run: [EnergyUtility] C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(Beijing)Limited)

O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)

O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)

O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)

O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.157

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.07.09 14:50:06 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2011.07.09 14:49:55 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Administrator\Desktop\esetsmartinstaller_enu.exe

[2011.07.09 14:41:46 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe

[2011.07.09 14:38:06 | 040,623,512 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Administrator\Desktop\AdbeRdr1010_de_DE.exe

[2011.07.09 14:20:45 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java

[2011.07.09 14:20:02 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.07.09 14:20:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.07.09 14:20:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.07.09 14:13:20 | 016,619,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Users\Administrator\Desktop\jre-6u26-windows-i586.exe

[2011.07.09 12:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus

[2011.07.09 12:41:33 | 000,019,544 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.07.09 12:41:32 | 000,309,848 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.07.09 12:41:24 | 000,025,432 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.07.09 12:41:23 | 000,043,608 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.07.09 12:41:20 | 000,441,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.07.09 12:41:16 | 000,054,104 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.07.09 12:40:42 | 000,199,304 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2011.07.09 12:40:42 | 000,040,112 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr

[2011.07.08 21:09:44 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2011.07.08 20:29:36 | 004,137,435 | R--- | C] (Swearware) -- C:\Users\Administrator\Desktop\Combofix.exe

[2011.07.07 19:11:32 | 000,489,786 | R--- | C] (Swearware) -- C:\Users\Administrator\Desktop\c06dqqhb.exe

[2011.07.07 12:11:06 | 000,354,816 | ---- | C] (Zygor Guides) -- C:\Users\Administrator\Desktop\ZygorGuides_Updater.exe

[2011.07.07 10:24:53 | 000,000,000 | ---D | C] -- C:\cofi25381c

[2011.07.07 10:20:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.07.07 10:20:10 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2011.07.07 10:19:21 | 003,216,552 | ---- | C] (Piriform Ltd) -- C:\Users\Administrator\Desktop\ccsetup308.exe

[2011.07.07 09:56:17 | 000,000,000 | ---D | C] -- C:\cofi26567c

[2011.07.07 09:49:47 | 000,000,000 | ---D | C] -- C:\cofi

[2011.07.06 22:19:36 | 000,000,000 | ---D | C] -- C:\w2of455n

[2011.07.06 17:22:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2011.07.06 17:22:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2011.07.06 17:22:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2011.07.06 17:21:57 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011.07.04 20:29:28 | 001,458,992 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Administrator\Desktop\tdsskiller.exe

[2011.07.03 22:15:02 | 001,932,256 | ---- | C] (Symantec Corporation) -- C:\Users\Administrator\Desktop\FixTDSS.exe

[2011.07.02 16:23:44 | 000,000,000 | ---D | C] -- C:\Programme\AVAST Software

[2011.07.02 16:23:44 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software

[2011.07.01 19:33:53 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\!BugGrabber

[2011.07.01 17:51:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SUPERAntiSpyware.com

[2011.07.01 17:51:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2011.07.01 17:50:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2011.07.01 17:50:14 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware

[2011.06.30 09:05:29 | 000,100,736 | ---- | C] (GMER) -- C:\pwdirpog.sys

[2011.06.29 12:25:32 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll

[2011.06.29 12:25:31 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll

[2011.06.29 12:25:30 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll

[2011.06.29 12:25:30 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll

[2011.06.29 12:25:30 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll

[2011.06.29 12:25:30 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll

[2011.06.28 15:05:22 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011.06.27 21:06:30 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.06.27 20:55:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller

[2011.06.27 20:55:07 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group

[2011.06.27 19:18:41 | 001,904,128 | ---- | C] (AVAST Software) -- C:\Users\Administrator\Desktop\aswMBR.exe

[2011.06.27 13:22:09 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\RealUI 0612

[2011.06.27 12:09:11 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe

[2011.06.26 22:50:35 | 000,000,000 | -H-D | C] -- C:\Windows\PIF

[2011.06.24 10:38:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

[2011.06.22 19:34:53 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\RIFT

[2011.06.22 19:34:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RIFT

[2011.06.22 19:34:45 | 000,000,000 | ---D | C] -- C:\Programme\RIFT Game

[2011.06.22 07:50:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2011.06.20 19:16:22 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\LeilaUI 3.13

[2011.06.18 09:43:48 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%

[2011.06.17 14:37:45 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2011.06.17 14:37:45 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2011.06.17 14:37:45 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2011.06.17 14:37:45 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2011.06.17 14:37:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2011.06.17 14:37:44 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2011.06.17 14:37:44 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2011.06.17 14:37:44 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2011.06.17 14:37:44 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2011.06.17 14:37:43 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2011.06.17 14:37:43 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2011.06.16 13:23:54 | 000,000,000 | ---D | C] -- C:\Users\Administrator\dwhelper

[2011.06.11 22:47:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes

[2011.06.11 22:46:37 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.06.11 22:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.06.11 22:46:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.06.11 22:46:31 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.06.11 22:46:31 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.06.10 21:15:42 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chessimo

[2011.06.10 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\chessimo

[2011.06.10 21:15:36 | 000,260,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RICHTX32.OCX

[2011.06.10 21:15:36 | 000,244,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSFLXGRD.OCX

[2011.06.10 21:15:36 | 000,152,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\COMDLG32.OCX

[2011.06.10 21:15:36 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSINET.OCX

[2011.06.10 21:15:36 | 000,067,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SYSINFO.OCX

[2011.06.10 21:15:26 | 000,000,000 | ---D | C] -- C:\Programme\chessimo

[2011.06.10 21:15:26 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\8 x 8 Media AG

[2011.06.10 21:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.07.09 21:09:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000UA.job

[2011.07.09 20:21:47 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.07.09 20:09:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000Core.job

[2011.07.09 14:49:58 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Administrator\Desktop\esetsmartinstaller_enu.exe

[2011.07.09 14:41:57 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.07.09 14:38:50 | 040,623,512 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Administrator\Desktop\AdbeRdr1010_de_DE.exe

[2011.07.09 14:19:42 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.07.09 14:19:42 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.07.09 14:19:42 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.07.09 14:19:41 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll

[2011.07.09 14:13:40 | 016,619,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Users\Administrator\Desktop\jre-6u26-windows-i586.exe

[2011.07.09 13:01:11 | 000,001,022 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job

[2011.07.09 12:41:34 | 000,001,994 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk

[2011.07.09 12:41:16 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2011.07.09 12:32:19 | 056,167,608 | ---- | M] () -- C:\Users\Administrator\Desktop\setup_av_free.exe

[2011.07.09 12:19:02 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.07.09 11:36:12 | 000,000,398 | ---- | M] () -- C:\Windows\tasks\AutoSmartDefrag.job

[2011.07.09 11:35:54 | 000,015,008 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.07.09 11:35:54 | 000,015,008 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.07.09 11:28:40 | 000,000,400 | ---- | M] () -- C:\Windows\tasks\SmartDefrag.job

[2011.07.09 11:28:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.07.09 11:28:28 | 1406,300,160 | -HS- | M] () -- C:\hiberfil.sys

[2011.07.08 22:30:59 | 000,000,728 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk

[2011.07.08 21:01:19 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2011.07.08 20:32:28 | 004,137,435 | R--- | M] (Swearware) -- C:\Users\Administrator\Desktop\Combofix.exe

[2011.07.08 20:30:36 | 000,048,543 | ---- | M] () -- C:\Users\Administrator\Desktop\Unbenannt.PNG

[2011.07.08 15:12:49 | 000,000,932 | ---- | M] () -- C:\Users\Administrator\Desktop\Zygor Guides Updater.lnk

[2011.07.08 15:05:28 | 012,788,544 | ---- | M] () -- C:\Users\Administrator\Desktop\LeilaUI 3.14b.zip

[2011.07.08 01:22:17 | 000,027,802 | ---- | M] () -- C:\Users\Administrator\Desktop\Unbenannt.3.PNG

[2011.07.08 01:09:22 | 000,167,543 | ---- | M] () -- C:\Users\Administrator\Desktop\Unbenannt.2.PNG

[2011.07.08 01:08:42 | 000,203,603 | ---- | M] () -- C:\Users\Administrator\Desktop\Unbenannt.1.PNG

[2011.07.08 00:09:54 | 000,089,088 | ---- | M] () -- C:\Users\Administrator\Desktop\mbr.exe

[2011.07.07 19:11:42 | 000,489,786 | R--- | M] (Swearware) -- C:\Users\Administrator\Desktop\c06dqqhb.exe

[2011.07.07 13:45:14 | 001,173,267 | ---- | M] () -- C:\Users\Administrator\Desktop\WoWPro v2.1.17.zip

[2011.07.07 12:11:08 | 000,354,816 | ---- | M] (Zygor Guides) -- C:\Users\Administrator\Desktop\ZygorGuides_Updater.exe

[2011.07.07 12:00:49 | 001,083,044 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.07.07 12:00:49 | 000,744,710 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.07.07 12:00:49 | 000,264,760 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.07.07 12:00:49 | 000,227,462 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.07.07 10:20:12 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.07.07 10:19:41 | 003,216,552 | ---- | M] (Piriform Ltd) -- C:\Users\Administrator\Desktop\ccsetup308.exe

[2011.07.04 21:09:31 | 000,101,910 | ---- | M] () -- C:\Users\Administrator\Desktop\Logfiles2.zip

[2011.07.04 20:30:07 | 001,458,992 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Administrator\Desktop\tdsskiller.exe

[2011.07.04 17:02:42 | 000,228,496 | ---- | M] () -- C:\Users\Administrator\Desktop\avira_registry_cleaner_de.exe

[2011.07.04 13:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

[2011.07.04 13:43:51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys

[2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys

[2011.07.04 13:32:20 | 000,054,104 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys

[2011.07.03 22:15:34 | 001,932,256 | ---- | M] (Symantec Corporation) -- C:\Users\Administrator\Desktop\FixTDSS.exe

[2011.07.03 18:22:11 | 000,000,512 | ---- | M] () -- C:\Users\Administrator\Desktop\MBR.dat

[2011.07.01 19:21:43 | 000,139,264 | ---- | M] () -- C:\Users\Administrator\Desktop\RKUnhookerLE.EXE

[2011.07.01 17:50:19 | 000,001,961 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.06.30 09:05:29 | 000,100,736 | ---- | M] (GMER) -- C:\pwdirpog.sys

[2011.06.30 09:03:59 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\drv0czgm.exe

[2011.06.29 17:08:02 | 000,449,928 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.06.27 20:55:08 | 000,001,222 | ---- | M] () -- C:\Users\Administrator\Desktop\Revo Uninstaller.lnk

[2011.06.27 19:19:02 | 001,904,128 | ---- | M] (AVAST Software) -- C:\Users\Administrator\Desktop\aswMBR.exe

[2011.06.27 13:13:38 | 000,027,484 | ---- | M] () -- C:\Users\Administrator\Desktop\Logfiles.zip

[2011.06.27 12:33:26 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\c06dgghb.exe

[2011.06.27 12:09:21 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe

[2011.06.27 12:05:08 | 000,000,020 | ---- | M] () -- C:\Users\Administrator\defogger_reenable

[2011.06.27 12:03:04 | 000,050,477 | ---- | M] () -- C:\Users\Administrator\Desktop\Defogger.exe

[2011.06.26 23:12:02 | 001,007,120 | ---- | M] () -- C:\Users\Administrator\Desktop\duadas.exe

[2011.06.26 08:45:56 | 000,256,000 | ---- | M] () -- C:\Windows\PEV.exe

[2011.06.24 10:38:56 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk

[2011.06.22 07:50:33 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2011.06.20 19:12:48 | 000,095,049 | ---- | M] () -- C:\Users\Administrator\Desktop\IceHUD_RealUI.lua

[2011.06.11 18:58:04 | 000,004,107 | ---- | M] () -- C:\Windows\wininit.ini

[2011.06.11 14:11:05 | 000,001,246 | ---- | M] () -- C:\Users\Administrator\Desktop\Spybot - Search & Destroy.lnk

[2011.06.11 10:49:21 | 000,166,400 | RHS- | M] () -- C:\Windows\System32\KBDINMALV.dll

[2011.06.10 21:15:42 | 000,000,997 | ---- | M] () -- C:\Users\Public\Desktop\chessimo.lnk

[2011.06.10 19:08:58 | 000,000,129 | ---- | M] () -- C:\Users\Administrator\jagex_runescape_preferences2.dat

[2011.06.10 19:07:59 | 000,000,034 | ---- | M] () -- C:\Users\Administrator\jagex_runescape_preferences.dat

 
 ========== Files Created - No Company Name ==========

 

[2011.07.09 14:41:57 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011.07.09 14:41:57 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.07.09 12:41:34 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk

[2011.07.09 12:27:39 | 056,167,608 | ---- | C] () -- C:\Users\Administrator\Desktop\setup_av_free.exe

[2011.07.09 00:22:59 | 000,000,400 | ---- | C] () -- C:\Windows\tasks\SmartDefrag.job

[2011.07.08 15:04:42 | 012,788,544 | ---- | C] () -- C:\Users\Administrator\Desktop\LeilaUI 3.14b.zip

[2011.07.08 01:22:17 | 000,027,802 | ---- | C] () -- C:\Users\Administrator\Desktop\Unbenannt.3.PNG

[2011.07.08 01:09:22 | 000,167,543 | ---- | C] () -- C:\Users\Administrator\Desktop\Unbenannt.2.PNG

[2011.07.08 01:08:18 | 000,203,603 | ---- | C] () -- C:\Users\Administrator\Desktop\Unbenannt.1.PNG

[2011.07.08 00:09:45 | 000,089,088 | ---- | C] () -- C:\Users\Administrator\Desktop\mbr.exe

[2011.07.07 13:44:43 | 001,173,267 | ---- | C] () -- C:\Users\Administrator\Desktop\WoWPro v2.1.17.zip

[2011.07.07 12:11:58 | 000,000,932 | ---- | C] () -- C:\Users\Administrator\Desktop\Zygor Guides Updater.lnk

[2011.07.07 10:20:12 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.07.06 17:22:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2011.07.06 17:22:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2011.07.06 17:22:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2011.07.06 17:22:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2011.07.06 17:22:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2011.07.04 21:09:31 | 000,101,910 | ---- | C] () -- C:\Users\Administrator\Desktop\Logfiles2.zip

[2011.07.04 17:02:17 | 000,228,496 | ---- | C] () -- C:\Users\Administrator\Desktop\avira_registry_cleaner_de.exe

[2011.07.03 18:22:11 | 000,000,512 | ---- | C] () -- C:\Users\Administrator\Desktop\MBR.dat

[2011.07.01 19:21:40 | 000,139,264 | ---- | C] () -- C:\Users\Administrator\Desktop\RKUnhookerLE.EXE

[2011.07.01 17:50:19 | 000,001,961 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2011.06.30 09:03:58 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\drv0czgm.exe

[2011.06.27 20:55:08 | 000,001,222 | ---- | C] () -- C:\Users\Administrator\Desktop\Revo Uninstaller.lnk

[2011.06.27 13:13:38 | 000,027,484 | ---- | C] () -- C:\Users\Administrator\Desktop\Logfiles.zip

[2011.06.27 12:33:18 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\c06dgghb.exe

[2011.06.27 12:04:42 | 000,000,020 | ---- | C] () -- C:\Users\Administrator\defogger_reenable

[2011.06.27 12:03:02 | 000,050,477 | ---- | C] () -- C:\Users\Administrator\Desktop\Defogger.exe

[2011.06.26 23:11:45 | 001,007,120 | ---- | C] () -- C:\Users\Administrator\Desktop\duadas.exe

[2011.06.26 09:56:45 | 000,095,049 | ---- | C] () -- C:\Users\Administrator\Desktop\IceHUD_RealUI.lua

[2011.06.24 10:38:56 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk

[2011.06.22 07:50:33 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track05.cda

[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track04.cda

[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track03.cda

[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track02.cda

[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track01.cda

[2011.06.11 14:33:23 | 000,004,107 | ---- | C] () -- C:\Windows\wininit.ini

[2011.06.11 10:49:21 | 000,166,400 | RHS- | C] () -- C:\Windows\System32\KBDINMALV.dll

[2011.06.10 21:15:42 | 000,000,997 | ---- | C] () -- C:\Users\Public\Desktop\chessimo.lnk

[2011.05.07 12:12:25 | 000,138,264 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2011.05.07 12:12:24 | 000,138,056 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\PnkBstrK.sys

[2011.05.07 12:11:54 | 000,234,768 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2011.05.07 12:11:18 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2011.03.13 20:14:06 | 000,390,944 | ---- | C] () -- C:\Windows\System32\drivers\SRS_AudioFusion_i386.sys

[2010.12.01 10:06:58 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini

[2010.10.14 20:58:05 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2010.10.14 20:00:49 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2010.07.09 21:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll

[2010.07.01 20:16:11 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.07.01 20:10:06 | 000,015,190 | ---- | C] () -- C:\Windows\M3000Twn.ini

[2010.07.01 20:02:18 | 000,006,088 | ---- | C] () -- C:\Windows\System32\drivers\CDConfig.bin

[2009.10.22 17:59:00 | 000,196,565 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2009.07.14 10:47:43 | 001,083,044 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 10:47:43 | 000,264,760 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 06:33:53 | 000,449,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 04:05:48 | 000,744,710 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 04:05:48 | 000,227,462 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.06.09 10:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll

[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
 

< End of report >

OTL-Extrafile:

Code:

OTL Extras logfile created on: 09.07.2011 21:13:02 - Run 11

OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Administrator\Desktop

 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 53,46% Memory free

6,98 Gb Paging File | 5,92 Gb Available in Paging File | 84,70% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 153,68 Gb Total Space | 72,06 Gb Free Space | 46,89% Space Free | Partition Type: NTFS

Drive D: | 78,03 Gb Total Space | 36,01 Gb Free Space | 46,15% Space Free | Partition Type: NTFS

Drive F: | 1001,00 Mb Total Space | 479,45 Mb Free Space | 47,90% Space Free | Partition Type: NTFS

 

Computer Name: DENNIS-PC | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00ACD183-EAEC-82C8-F71E-8FF0B6143D7B}" = CCC Help Portuguese

"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources

"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{063BBC11-7F75-3BBA-02AA-A1B5FC0E17AC}" = CCC Help Polish

"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{11C39430-2BC0-4C47-4541-B6C8150D4A65}" = Catalyst Control Center InstallProxy

"{1375616C-B818-9FC7-0BE3-AE9AC45F1188}" = CCC Help Chinese Standard

"{14AEA387-7A94-575A-4328-07BE82BD7F32}" = ATI Catalyst Install Manager

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client

"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{25C64847-B900-48AD-A164-1B4F9B774650}" = System Update

"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26

"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{2B4E24A0-A06F-488D-87D8-16738E5E1104}" = Windows Live Family Safety

"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver

"{3253AC2A-EC76-DC6C-6ED1-EBA5E67A79A1}" = ccc-utility

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{36B38C30-94C1-2B9C-B973-59B2FB37CCB0}" = CCC Help Dutch

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3931705A-D653-44A8-9BB5-759B7965BE99}_is1" = YABOT Build Order Editor version 1.0

"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3D1FB742-A73A-2403-639F-C8CD64A70449}" = CCC Help Chinese Traditional

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{417CE154-54E7-3655-0C24-34FBFCA5163C}" = CCC Help Finnish

"{420F882E-36E5-9C3B-BF07-B0C1911F4739}" = CCC Help Italian

"{460495AF-988E-CDD4-591D-7E75AC1CAF4A}" = Catalyst Control Center Core Implementation

"{46E8BDC8-F7BD-3F44-8DA1-9B26DAB62205}" = CCC Help Swedish

"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery

"{4761EB82-E8BD-45A4-B19B-586FA9D1D7E6}" = Camtasia Studio 6

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Lenovo EasyCamera

"{4E0BEC25-51C6-30AE-348D-AA208ABA3400}" = CCC Help Japanese

"{55718B4B90B54F7EADC5621C750A14E6}" = DivX Author 1.5

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{6128B845-A2F4-283F-92B8-C02B393373A4}" = CCC Help Hungarian

"{613B9AA5-33A3-B2BB-D87D-BF7B1C02315E}" = Catalyst Control Center Localization All

"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant

"{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform

"{65C743AF-D881-B71D-A753-A95C5219E78B}" = Catalyst Control Center Graphics Full Existing

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari

"{6F7614CC-F33A-4877-8814-49856F441F3C}" = Stardock MyColors

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime

"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client

"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core

"{836180C6-4998-B1EE-782A-EF196850A98F}" = CCC Help Turkish

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{84738B59-F709-5737-524D-CAC71D74C23F}" = CCC Help English

"{848249FC-EA31-81CC-914B-7401C37B03CE}" = CCC Help Russian

"{8518ECC0-0DE4-4475-D0C1-C8114A8F0C0B}" = CCC Help French

"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger

"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free

"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8AA1963A-5234-BECC-B5E7-7469ABBC6514}" = Catalyst Control Center Graphics Light

"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime

"{8D540B8F-1325-CF57-0C84-B59B03B153FB}" = CCC Help Spanish

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E537894-A559-4D60-B3CB-F4485E3D24E3}" = ThinkVantage Access Connections

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{90140000-0015-0416-0000-0000000FF1CE}" = Microsoft Office Access MUI (Portuguese (Brazil)) 2010

"{90140000-0016-0416-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Portuguese (Brazil)) 2010

"{90140000-0018-0416-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010

"{90140000-0019-0416-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010

"{90140000-001A-0416-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010

"{90140000-001B-0416-0000-0000000FF1CE}" = Microsoft Office Word MUI (Portuguese (Brazil)) 2010

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2010

"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

"{90140000-002C-0416-0000-0000000FF1CE}" = Microsoft Office Proofing (Portuguese (Brazil)) 2010

"{90140000-0044-0416-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010

"{90140000-006E-0416-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Portuguese (Brazil)) 2010

"{90140000-00A1-0416-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010

"{90140000-00BA-0416-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Portuguese (Brazil)) 2010

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{93ABEBEB-EEE0-4AB9-A925-2F2EC791A4CE}" = Smart Technology Programming Software 7.0.2.7

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader

"{96CC86A2-997F-46BF-9ADF-3857DB648765}" = chessimo 3.42

"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A3D7DCF8-A79C-882D-1B6F-2A5106053F9B}" = CCC Help Danish

"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel

"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A96BFADF-A159-4395-8E9C-A9E2F059A3BB}" = Camtasia Studio 7

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AA1AF34D-9056-4B72-A588-D9A7B8CB305B}" = Saitek Cyborg Keyboard Volume 6.2.1.3

"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh

"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management

"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail

"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B569783D-389B-BA36-6A8E-1457C12E77F1}" = CCC Help Thai

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars

"{BDAFF03F-3E7D-427B-A658-3807C4C58B0C}" = Goldfinger 8

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections

"{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}" = Google Apps

"{C9A3120D-C729-875A-AD54-C3AE3F9C826B}" = CCC Help Korean

"{CA050D8C-770A-41A7-B966-0056456EA27E}" = Razer StarCraft II

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{CF051DB4-9E13-0A5B-314D-B0AC3B3BF9D9}" = CCC Help German

"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT

"{D8EDD457-B59B-FFC6-7E6B-749734E71D03}" = Catalyst Control Center Graphics Previews Common

"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0

"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E28FD821-1863-4BC0-8B8C-959EEE805FDE}" = SRS AudioFusion

"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{EEAADF6C-CB48-DE4C-C934-1A9C11F1D7AE}" = ccc-core-static

"{EF1D891C-1616-C383-AD0B-6C8B0A8F8CC9}" = CCC Help Czech

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F231A12D-5C87-6201-DF65-25106365399D}" = Catalyst Control Center Graphics Full New

"{F25E99CD-A296-85C2-BF1A-9E6BCDE8FA4A}" = CCC Help Greek

"{F3DCF8E5-F5BA-492B-8113-7FAAED125BE0}" = capella 1200

"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"{FFCB7CDF-534B-3297-8B3E-2E7587A4AE1A}" = CCC Help Norwegian

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"avast" = avast! Free Antivirus

"Babylon" = Babylon

"CABAL Online: Episode IV_is1" = Cabal Online Europe - Episode IV

"Camtasia Studio 3" = Camtasia Studio 3

"CCleaner" = CCleaner

"CNXT_AUDIO_HDA" = Conexant HD Audio

"Der Schreibtrainer" = Der Schreibtrainer 3.7

"DivX Setup.divx.com" = DivX-Setup

"ENTERPRISE" = Microsoft Office Enterprise 2007

"ESET Online Scanner" = ESET Online Scanner v3

"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50

"Free YouTube Download_is1" = Free YouTube Download 2.6

"FreeApp v1" = FreeApps

"Game Booster_is1" = Game Booster

"Game Maker 8.0" = Game Maker 8.0

"Google Chrome" = Google Chrome

"Google Desktop" = Google Desktop

"Google Updater" = Google Updater

"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery

"InstallShield_{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)

"Notepad++" = Notepad++

"PC SECURITY TEST 2009_is1" = PC SECURITY TEST 2009

"Picasa 3" = Picasa 3

"PowerISO" = PowerISO

"PunkBusterSvc" = PunkBuster Services

"RAR Password Cracker" = RAR Password Cracker 4.12

"RealPlayer 12.0" = RealPlayer

"Revo Uninstaller" = Revo Uninstaller 1.92

"RocketDock_is1" = RocketDock 1.3.5

"SC2 Replay Catcher_is1" = SC2 Replay Catcher version 0.1.0.3a

"Smart Defrag_is1" = Smart Defrag

"SpywareBlaster_is1" = SpywareBlaster 4.4

"StarCraft II" = StarCraft II

"Stardock MyColors" = Stardock MyColors

"SW-Tukupdater_is1" = SW-TukUpdater

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"Test Drive Unlimited 2_is1" = Test Drive Unlimited 2

"Uninstall_is1" = Uninstall 1.0.0.1

"Webocton - Scriptly_is1" = Webocton - Scriptly 0.8.95.6

"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe

"WinLiveSuite" = Windows Live Essentials

"WinRAR archiver" = WinRAR

"World of Warcraft" = World of Warcraft

"World of Warcraft Public Test" = World of Warcraft Public Test

"Xfire" = Xfire (remove only)

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"090215de958f1060" = Curse Client

"ccb6737a8af9d4ff" = Lenovo Driver Download Manager

"UnityWebPlayer" = Unity Web Player

"WinPump" = WinPump

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 09.07.2011 06:14:56 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Razer\Drivers\RzSynapse\DPInst_amd64.exe".

Die

 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 09.07.2011 06:19:32 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\spybot

 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program

 files\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des "language"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

Error - 09.07.2011 07:01:06 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 08:09:20 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 09:07:45 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 10:12:24 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 11:07:46 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 12:07:31 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 13:12:28 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 09.07.2011 14:08:34 | Computer Name = Dennis-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

[ Media Center Events ]

Error - 28.03.2011 07:25:42 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 13:25:41 - Fehler beim Herstellen der Internetverbindung.  13:25:41 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 28.03.2011 07:25:55 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 13:25:49 - Fehler beim Herstellen der Internetverbindung.  13:25:49 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.04.2011 04:34:45 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 10:34:44 - Fehler beim Herstellen der Internetverbindung.  10:34:45 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.04.2011 04:35:36 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 10:35:14 - Fehler beim Herstellen der Internetverbindung.  10:35:14 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.04.2011 06:37:45 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 12:37:45 - Fehler beim Herstellen der Internetverbindung.  12:37:45 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 16.04.2011 06:38:25 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 12:38:14 - Fehler beim Herstellen der Internetverbindung.  12:38:14 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 24.04.2011 03:57:10 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 09:54:53 - Directory konnte nicht abgerufen werden (Fehler: Die Anfrage

 wurde abgebrochen: Die Anfrage wurde abgebrochen..)  

 

Error - 24.04.2011 04:16:26 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0

Description = 10:15:06 - MCESpotlight konnte nicht abgerufen werden (Fehler: Invalid

 security token.)  

 

[ OSession Events ]

Error - 28.09.2010 15:26:09 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3436

 seconds with 480 seconds of active time.  This session ended with a crash.

 

Error - 05.10.2010 15:37:15 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1278

 seconds with 300 seconds of active time.  This session ended with a crash.

 

Error - 25.11.2010 16:24:56 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10330

 seconds with 2460 seconds of active time.  This session ended with a crash.

 

Error - 13.12.2010 16:19:25 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8119

 seconds with 780 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 08.07.2011 18:22:12 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 08.07.2011 18:22:12 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 08.07.2011 18:22:21 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 08.07.2011 18:22:21 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 08.07.2011 18:22:29 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SBSD Security Center Service" ist vom Dienst "wscsvc" 

abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058

 

Error - 09.07.2011 05:28:23 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 09.07.2011 05:28:24 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 09.07.2011 05:28:33 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 09.07.2011 05:28:33 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190

Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

 

Error - 09.07.2011 05:28:41 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SBSD Security Center Service" ist vom Dienst "wscsvc" 

abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058

 

 

< End of report >

Security-Check:

Code:

 Results of screen317's Security Check version 0.99.17  

 Windows 7  (UAC is enabled) 

 Internet Explorer 8  
 `````````````````````````````` 
 Antivirus/Firewall Check: 

 Windows Security Center service is not running! This report may not be accurate! 

 avast! Free Antivirus    

 ESET Online Scanner v3   

 WMI entry may not exist for antivirus; attempting automatic update. 
 ``````````````````````````````` 
 Anti-malware/Other Utilities Check: 

 Malwarebytes' Anti-Malware    

 CCleaner     

 Java(TM) 6 Update 26  
 Flash Player Out of Date! 

 Adobe Flash Player         10.1.102.64  

 Adobe Reader X (10.1.0) 

 Mozilla Firefox (x86 de..) 
 ```````````````````````````````` 

Process Check:  
 objlist.exe by Laurent 

 Malwarebytes' Anti-Malware mbamservice.exe  

 Malwarebytes' Anti-Malware mbamgui.exe  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 ``````````End of Log````````````

Wie läuft dein Rechner derzeit? Ganz normal :)
Gibt es noch irgendwelche Probleme? Nein
Und danke für die beantwortung meiner Fragen. (Naja, das dchp check ich zwar nicht aber man kann ja nicht alles haben ;))
Greetz,
Deathkid

Hallo Deathkid,

deine Logfiles sehen schon besser aus.
Um ein paar Dinge müssen wir uns noch kümmern, u. a. auch darum:

Zitat:

Windows Security Center service is not running! This report may not be accurate!

Das Windows Sicherheitscenter läuft wahrscheinlich nicht.

Schritt # 1: Registry Cleaner
Ich sehe, dass Du sogenannte Registry Cleaner am System hast.
In deinem Fall CCleaner.

Wir empfehlen auf keinen Fall jegliche Art von Registry Cleaner.

Der Grund ist ganz einfach:

Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Wir lesen oft genug von Hilfesuchenden, dass deren System nach der Nutzung von Registry Cleanern nicht mehr booted.

Wie soll der Cleaner zu 100% wissen ob der Eintrag benötigt wird oder nicht ?
Es ist vollkommen egal ob ein paar verwaiste Registry Einträge am System sind oder nicht.
Auch die dauernd angepriesene Beschleunigung des Systems ist nur bedingt wahr. Du würdest es nicht merken.

Ein sogenanntes False Positive von einem Cleaner kann auch dein System unbootbar machen.
Zerstörst Du die Registry, zerstörst Du Windows.

Ich empfehle Dir hiermit die oben genannte Software zu deinstallieren und in Zukunft auf solche Art von Software zu verzichten.

Schritt # 2: Adobe Flash Player aktualisieren

Lade dir die neuste Version des Flash Players von Adobe für Firefox und den Internet Explorer herunter.
Installiere die neuste Version auf deinem Computer.

Schritt # 3: Wichtige Updates

Lade dir bitte zudem von hier den Internet Explorer 9 (32 Bit Version) auf deinen Desktop und installiere die neue Version.

Schritt # 4: Manuelles Löschen von Dateien
Der ESET Online Scanner hat folgende Datei als Adware beanstandet:

Zitat:

C:\Users\Administrator\AppData\Roaming\WinPump\extensions.exe Win32/Adware.GoodMedia.C application

Kennst du diese Datei bzw. hast du diese bewusst auf deinen Rechner geladen oder installiert?
Ich empfehle dir, diese Datei zu löschen.

Schritt # 5: Registry mit ERUNT absichern
Da wir in der Registry Änderungen vornehmen müssen, wirst Du die Registry vorher wie folgt sichern:
Lade das Tool ERUNT von Lars Hederer herunter und installiere es. Starte die erunt.exe und erstelle damit eine Backup der Registry in den vorgegebenen Ordner. Unter Sicherungsoptionen bitte alle drei Möglichkeiten anhaken. Das Programm nicht in den Systemstart aufnehmen.

Schritt # 6: Batch Datei ausführen
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

@echo off

cd \

set log=%userprofile%\Desktop\ergebnis.txt

if exist %log% del %log%

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc" /s >> "%userprofile%\Desktop\ergebnis.txt"

notepad "%userprofile%\Desktop\ergebnis.txt"

del %0

Wähle Datei --> Speichern unter
Dateiname: suche1.bat
Dateityp: Wähle Alle Dateien (*.*)
Speichere die Datei auf deinem Desktop.
Es sollte nun ungefähr so aussehen http://larusso.trojaner-board.de/Images/bat.jpg
Starte die suche1.bat.
Vista und Win7 User: Mit Rechtsklick "als Administrator starten"
Es öffnet sich die Textdatei ergebnis.txt. Diese Datei befindet sich auch auf deinem Desktop.

Schritt # 7: Durchführung einer Sicherheitskontrolle

Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
Wenn der Scan beendet wurde, sollte sich ein Textdokument ( checkup.txt ) öffnen.
Poste den Inhalt bitte hier.

Schritt # 8: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Ergebnis der Batch Datei und
das neue Logfile von SecurityCheck.

Hallo M-K-D-B,
Ergebnis der Batch-Datei:

Code:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

    Type    REG_DWORD    0x20

    Start    REG_DWORD    0x4

    ErrorControl    REG_DWORD    0x1

    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted

    DependOnService    REG_MULTI_SZ    RpcSs\0winmgmt

    ObjectName    REG_SZ    NT AUTHORITY\LocalService

    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeImpersonatePrivilege

    DelayedAutoStart    REG_DWORD    0x1

    FailureActions    REG_BINARY    805101000000000000000000030000001400000001000000C0D4010001000000E09304000000000000000000
 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Enum

    0    REG_SZ    Root\LEGACY_WSCSVC\0000

    Count    REG_DWORD    0x1

    NextInstance    REG_DWORD    0x1
 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Parameters

    ServiceDll    REG_EXPAND_SZ    %SYSTEMROOT%\system32\wscsvc.dll

Ergebnis der Sicherheitskontrolle:

Code:

 Results of screen317's Security Check version 0.99.17  

 Windows 7  (UAC is enabled) 

 Internet Explorer 8  
 `````````````````````````````` 
 Antivirus/Firewall Check: 

 Windows Security Center service is not running! This report may not be accurate! 

 avast! Free Antivirus    

 ESET Online Scanner v3   

 WMI entry may not exist for antivirus; attempting automatic update. 
 ``````````````````````````````` 
 Anti-malware/Other Utilities Check: 

 Malwarebytes' Anti-Malware    

 Java(TM) 6 Update 26  

 Adobe Flash Player         10.3.181.34  

 Adobe Reader X (10.1.0) 

 Mozilla Firefox (x86 de..) 
 ```````````````````````````````` 

Process Check:  
 objlist.exe by Laurent 

 Malwarebytes' Anti-Malware mbamservice.exe  

 Malwarebytes' Anti-Malware mbamgui.exe  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 ``````````End of Log````````````

Und naja, ich fahr in einer STunde in den Urlaub bis Freitag.. Soll ich dir dann ne PM schicken.
MFG,
Deathkid

Hallo Deathkid,

Zitat:

Zitat von Deathkid535 (Beitrag 681301)

Und naja, ich fahr in einer STunde in den Urlaub bis Freitag.. Soll ich dir dann ne PM schicken.

Nein, du brauchst mir keine PM schicken. Sobald du wieder vom Urlaub zu Hause bist, machen wir einfach hier weiter. :daumenhoc

Wir sind fast fertig.
Ich bereite jetzt die nächsten Schritte vor. Bearbeite diese einfach, wenn du wieder zu Hause bist. :)

Ich wünsche dir einen schönen Urlaub. Bis Freitag.