Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bei Verbindung mit dem Internet, kommt ein Fenster vom BKA, dass ich 100€ zahlen soll... (https://www.trojaner-board.de/112622-verbindung-internet-kommt-fenster-bka-100-zahlen.html)

Aendee 29.03.2012 20:26
Bei Verbindung mit dem Internet, kommt ein Fenster vom BKA, dass ich 100€ zahlen soll...
 
Hallo Trojaner-Board Team,

ich muss zugeben, dass ich auf einer Pornographischen Internetseite gelandet bin und sich dadurch bei mir etwas eingeschlichen hat. Dann öffnete sich ein Fenster angeblich vom "BKA". Ich soll 100€ per Paysafe einzahlen und sich dann die Oberfläche wieder freischaltet. Ich wusste gleich das da was faul ist. Dadurch lässt sich nichts mehr machen auf dem PC.
Habe jetzt im Abgesicherten Modus das Program OTL gestartet und schicke das Log im Anhang mit. Ich hoffe Ihr könnt mir da schnell helfen.
Vielen DAnk :killpc:

Larusso 30.03.2012 07:06
:hallo:

Mein Name ist Daniel und ich werde dir mit deinem Malware Relevanten Problemen helfen.

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen erst einmal durch. Sollte irgendetwas unklar sein, Frage bevor du beginnst.
  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
  • Sollte ich auf diese, sowie allen weiteren Antworten, innerhalb von 3 Tagen keine Antwort von dir erhalten, werde ich das Thema aus meinen Abonnements löschen.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst und Installiere / Deinstalliere keine Software ohne Aufforderung.
  • Poste die Logfiles direkt in deinen Thread und nicht als Anhang, ausser du wurdest dazu aufgefordert. Erschwert mir das Auswerten.


Cool, da sind paar Dinge die ich schon seit 3 Jahren nicht mehr gesehen habe :D


Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Aendee 01.04.2012 18:00
Es ist so das dieses Problem bei einem Freund aufgetreten ist. Ich bin im moment nicht bei ihm, Frühestens morgen könnte ich den ersten Schritt dann mal durchführen.
Was für Dinge sind das denn die du da bei mir gesehen hast? :confused:

Danke fürs erste.

Larusso 02.04.2012 15:48
Ich seh da paar ältere Infektionen bzw Anzeichen davon. Wusste nicht, dass die noch leben :)

Aendee 04.04.2012 20:50
Hier ist die Log vom Combofix
------------------------------------

Combofix Logfile:
Code:
ComboFix 12-04-04.02 - troy1980 04.04.2012  21:22:19.1.4 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.3071.2095 [GMT 2:00]
ausgeführt von:: c:\users\troy1980\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Recycle.Bin
C:\SystemData
c:\users\troy1980\AppData\Local\kayqmmw.dat
c:\users\troy1980\AppData\Local\kayqmmw_nav.dat
c:\users\troy1980\AppData\Local\kayqmmw_navps.dat
c:\users\troy1980\AppData\Local\kayqmmw_navup.dat
c:\users\troy1980\Desktopblackbird.jpg
c:\users\troy1980\DesktopEditorFKWP1.5.exe
c:\users\troy1980\DesktopEditorFKWP2.0.exe
c:\users\troy1980\Desktopfilemanagerclient.exe
c:\users\troy1980\Desktopfkwp1.5.exe
c:\users\troy1980\Desktopfkwp2.0.exe
c:\users\troy1980\Desktopfwebd.exe
c:\users\troy1980\DesktopFWebdEditor.exe
c:\users\troy1980\DesktopTrojan.Win32.BlackBird.exe
c:\users\troy1980\Desktopvirii
c:\windows\IsUn0407.exe
c:\windows\system32\tmp1903.tmp
c:\windows\system32\tmp1CBD.tmp
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-04 bis 2012-04-04  ))))))))))))))))))))))))))))))
.
.
2012-04-04 19:31 . 2012-04-04 19:32        --------        d-----w-        c:\users\troy1980\AppData\Local\temp
2012-04-04 19:31 . 2012-04-04 19:31        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-04-04 19:31 . 2012-04-04 19:31        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-04-04 19:26 . 2012-04-04 19:26        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{EE9280EC-0394-4307-8959-F795D5B4DF34}\offreg.dll
2012-04-01 15:41 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{EE9280EC-0394-4307-8959-F795D5B4DF34}\mpengine.dll
2012-03-18 19:24 . 2012-03-18 19:24        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-18 19:24 . 2012-03-18 19:24        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2009-10-05 13:59        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-06 22:55 . 2012-02-06 22:55        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-03-18 19:24 . 2011-07-23 13:50        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11DCAFD6-DDBA-4ADA-998B-996B7B691AE0}]
2010-12-02 15:12        201728        ----a-w-        c:\users\troy1980\AppData\Roaming\FBConnect\IE\FBConnect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-03 c:\windows\Tasks\User_Feed_Synchronization-{5DC64ABE-5E94-4D4A-BD25-889D1531C5BB}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
uInternet Settings,ProxyServer = www.google.de:80
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
IE: Free YouTube Download - c:\users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Öffnen mit WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: everestpoker.com\account
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FF - ProfilePath - c:\users\troy1980\AppData\Roaming\Mozilla\Firefox\Profiles\v0kaz9i0.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
AddRemove-Tom Clancy's Rainbow Six - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-04 21:32
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2666627118-1337066670-649592564-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:96,17,d1,22,30,7a,e5,40,a2,41,b6,12,e2,50,ee,dd,fc,dc,1e,80,1e,f1,a8,
  90,24,45,6e,7b,75,0d,aa,41,fc,c6,9c,81,ff,1f,1b,45,c4,54,8a,e3,fc,26,34,4f,\
"??"=hex:3c,e4,61,7e,9a,5c,89,99,d0,62,b9,7d,0b,45,9b,7c
.
[HKEY_USERS\S-1-5-21-2666627118-1337066670-649592564-1000\Software\SecuROM\License information*]
"datasecu"=hex:bc,2e,e4,eb,c9,08,e0,8f,2e,bb,e5,dd,97,37,ff,75,30,29,c5,f4,82,
  cc,9c,db,3c,74,5d,d4,e4,17,53,fb,b1,2a,c4,4a,a0,7b,90,26,2b,a4,11,44,5a,f3,\
"rkeysecu"=hex:f3,ea,d0,b2,7c,3d,50,02,61,53,fd,68,1d,8c,49,e5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-04-04  21:38:38
ComboFix-quarantined-files.txt  2012-04-04 19:38
.
Vor Suchlauf: 21 Verzeichnis(se), 91.384.967.168 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 91.367.383.040 Bytes frei
.
- - End Of File - - 6AC0921A5760FB40530F1B2B1234C571
--- --- ---

---------------------------------------------------------------

Bis dann :blabla:

Larusso 05.04.2012 06:35
Hinweis für Mitleser:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, dass kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:
BleepingComputer.com - ForoSpyware.com
und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:
DDS::
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\ctbr.dll
FireFox::
FF - ProfilePath - c:\users\troy1980\AppData\Roaming\Mozilla\Firefox\Profiles\v0kaz9i0.default\
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60076&qkw=
ClearJavaCache::
Speichere dies als CFScript.txt auf deinem Desktop.
Wichtig:
  • Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern. Danach wieder anstellen nicht vergessen!
  • Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Schließe alle laufenden Programme. Gehe sicher, dass ComboFix ungehindert arbeiten kann.
  • Mache nichts am PC solange ComboFix läuft.

http://i266.photobucket.com/albums/i.../CFScriptB.gif
  • In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
  • Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.
Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.



Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Aendee 06.04.2012 20:15
So, ich habe erst combofix und anschliessend Malware gestartet. Hier sind beide Logs:
-----------------------------------------------------------------------
Combofix Logfile:
Code:
ComboFix 12-04-06.03 - troy1980 06.04.2012  20:34:23.1.4 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.3071.1935 [GMT 2:00]
ausgeführt von:: c:\users\troy1980\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\troy1980\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~1\Crawler\ctbr.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-06 bis 2012-04-06  ))))))))))))))))))))))))))))))
.
.
2012-04-06 18:43 . 2012-04-06 18:44        --------        d-----w-        c:\users\troy1980\AppData\Local\temp
2012-04-06 18:43 . 2012-04-06 18:43        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-04-06 18:43 . 2012-04-06 18:43        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-04-06 18:28 . 2011-12-10 13:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-04-06 18:16 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{9E0385C7-5885-4153-9112-4F3180A87D63}\mpengine.dll
2012-04-06 00:07 . 2012-04-06 00:07        --------        d-----w-        c:\program files\iPod
2012-04-06 00:07 . 2012-04-06 00:09        --------        d-----w-        c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2012-04-06 00:07 . 2012-04-06 00:09        --------        d-----w-        c:\program files\iTunes
2012-04-06 00:04 . 2012-04-06 00:04        --------        d-----w-        c:\program files\Apple Software Update
2012-04-06 00:00 . 2012-04-06 00:00        --------        d-----w-        c:\program files\Bonjour
2012-03-18 19:24 . 2012-03-18 19:24        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-18 19:24 . 2012-03-18 19:24        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2009-10-05 13:59        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-15 09:01 . 2012-02-15 09:01        4547944        ----a-w-        c:\windows\system32\usbaaplrc.dll
2012-02-15 09:01 . 2012-02-15 09:01        43520        ----a-w-        c:\windows\system32\drivers\usbaapl.sys
2012-02-06 22:55 . 2012-02-06 22:55        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-03-18 19:24 . 2011-07-23 13:50        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11DCAFD6-DDBA-4ADA-998B-996B7B691AE0}]
2010-12-02 15:12        201728        ----a-w-        c:\users\troy1980\AppData\Roaming\FBConnect\IE\FBConnect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-05 c:\windows\Tasks\User_Feed_Synchronization-{5DC64ABE-5E94-4D4A-BD25-889D1531C5BB}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyServer = www.google.de:80
IE: Free YouTube Download - c:\users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Öffnen mit WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: everestpoker.com\account
FF - ProfilePath - c:\users\troy1980\AppData\Roaming\Mozilla\Firefox\Profiles\v0kaz9i0.default\
FF - prefs.js: browser.search.selectedEngine - Google
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-06 20:43
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2666627118-1337066670-649592564-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:96,17,d1,22,30,7a,e5,40,a2,41,b6,12,e2,50,ee,dd,fc,dc,1e,80,1e,f1,a8,
  90,24,45,6e,7b,75,0d,aa,41,fc,c6,9c,81,ff,1f,1b,45,c4,54,8a,e3,fc,26,34,4f,\
"??"=hex:3c,e4,61,7e,9a,5c,89,99,d0,62,b9,7d,0b,45,9b,7c
.
[HKEY_USERS\S-1-5-21-2666627118-1337066670-649592564-1000\Software\SecuROM\License information*]
"datasecu"=hex:bc,2e,e4,eb,c9,08,e0,8f,2e,bb,e5,dd,97,37,ff,75,30,29,c5,f4,82,
  cc,9c,db,3c,74,5d,d4,e4,17,53,fb,b1,2a,c4,4a,a0,7b,90,26,2b,a4,11,44,5a,f3,\
"rkeysecu"=hex:f3,ea,d0,b2,7c,3d,50,02,61,53,fd,68,1d,8c,49,e5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-04-06  20:50:41
ComboFix-quarantined-files.txt  2012-04-06 18:50
ComboFix2.txt  2012-04-04 19:38
.
Vor Suchlauf: 23 Verzeichnis(se), 90.694.524.928 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 90.657.968.128 Bytes frei
.
- - End Of File - - 66C05D7362AE62B221101CCF7C0A5C92
--- --- ---

------------------------------------------------------------

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.06.06

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
troy1980 :: TROY1980-PC [Administrator]

Schutz: Aktiviert

06.04.2012 20:52:08
mbam-log-2012-04-06 (20-52-08).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 206202
Laufzeit: 3 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

----------------------------------------

Das wärs dann wieder. Mal schaun was als nächstes folgt. Denn bis jetzt läuft das System wieder einwandfrei. Danke dir bis hier. :applaus:

Larusso 07.04.2012 04:50
Freut mich :)



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Aendee 08.04.2012 14:33
So, die nächsten Scans hab ich über den Rechner ergehen lassen. Hier erstmal der ESET ScanBericht:
---------------------------------------------------------------------------

C:\Program Files\Everest Poker\cstart-tmp.exe a variant of Win32/Casino application
C:\Users\troy1980\AppData\Local\Mozilla\Firefox\Profiles\v0kaz9i0.default\Cache\7\39\A8E0Dd01 JS/Exploit.Pdfka.PJG trojan
C:\Users\troy1980\AppData\Local\Mozilla\Firefox\Profiles\v0kaz9i0.default\Cache\C\15\22106d01 JS/Kryptik.KY trojan
C:\Users\troy1980\AppData\Local\Mozilla\Firefox\Profiles\v0kaz9i0.default\Cache\C\6A\6F86Fd01 JS/Exploit.Pdfka.PJF trojan
C:\Users\troy1980\AppData\Local\Mozilla\Firefox\Profiles\v0kaz9i0.default\Cache\D\0F\67E0Fd01 JS/Kryptik.KY trojan
C:\Users\troy1980\AppData\Local\Mozilla\Firefox\Profiles\v0kaz9i0.default\Cache\E\BF\7C7ABd01 HTML/Iframe.B.Gen virus
C:\Users\troy1980\Desktop\Verknüpfung Programme\tools\Everest_Poker.exe a variant of Win32/Casino application
C:\Users\troy1980\Desktop\Verknüpfung Programme\tools\SoftonicDownloader_fuer_virtual-dj.exe a variant of Win32/SoftonicDownloader.A application
C:\Users\troy1980\Documents\Downloads\MsgPlusLive-482.exe a variant of Win32/Adware.CiDHelp application

--------------------------------------------------------------------------

UNd nun noch Die OTL-Logs:
1.OTL.txt
--------------------------------------------------------------------------OTL Logfile:
Code:
OTL logfile created on: 08.04.2012 15:19:50 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\troy1980\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,84 Gb Available Physical Memory | 61,26% Memory free
6,19 Gb Paging File | 5,08 Gb Available in Paging File | 82,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 83,69 Gb Free Space | 27,59% Space Free | Partition Type: NTFS
Drive D: | 150,69 Gb Total Space | 150,60 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive F: | 6,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TROY1980-PC | User Name: troy1980 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\troy1980\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - C:\Program Files\Avira\AntiVir Desktop\avscan.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Windows\System32\PSIService.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
SRV - (lxce_device) -- C:\Windows\System32\lxcecoms.exe (Lexmark International, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (sp_rsdrv2) -- C:\Windows\System32\drivers\sp_rsdrv2.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1029unic.sys (MCCI Corporation)
DRV - (s1029mdm) -- C:\Windows\System32\drivers\s1029mdm.sys (MCCI Corporation)
DRV - (s1029bus) Sony Ericsson Device 1029 driver (WDM) -- C:\Windows\System32\drivers\s1029bus.sys (MCCI Corporation)
DRV - (s1029mdfl) -- C:\Windows\System32\drivers\s1029mdfl.sys (MCCI Corporation)
DRV - (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1029mgmt.sys (MCCI Corporation)
DRV - (s1029obex) -- C:\Windows\System32\drivers\s1029obex.sys (MCCI Corporation)
DRV - (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1029nd5.sys (MCCI Corporation)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - SOFTWARE\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}\InprocServer32 File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = www.google.de:80
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: c:\Program Files\Sony\Media Go\npmediago.dll (Sony Creative Software Inc)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.04.01 16:27:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.18 08:04:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.18 08:04:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\firefox\ [2011.07.23 23:11:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.18 21:24:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.07.09 08:55:41 | 000,000,000 | ---D | M]
 
[2011.07.23 15:50:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\troy1980\AppData\Roaming\mozilla\Extensions
[2011.09.09 20:29:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\troy1980\AppData\Roaming\mozilla\Firefox\Profiles\v0kaz9i0.default\extensions
[2011.07.23 15:50:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.01.15 09:53:01 | 000,000,000 | ---D | M] (Facebook Connect) -- C:\Program Files\mozilla firefox\extensions\{9a4e42f4-ee19-467a-ad67-3c31ed29837b}
[2011.01.15 09:53:01 | 000,000,000 | ---D | M] (Win32+64) -- C:\Program Files\mozilla firefox\extensions\win32-64@anonymous.org
() (No name found) -- C:\USERS\TROY1980\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V0KAZ9I0.DEFAULT\EXTENSIONS\{DD05FD3D-18DF-4CE4-AE53-E795339C5F01}.XPI
[2009.08.15 17:28:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.03.18 21:24:33 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.20 17:57:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.20 17:57:17 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2012.02.20 17:57:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.20 17:57:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.20 17:57:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.20 17:57:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Media Go Detector (Enabled) = c:\Program Files\Sony\Media Go\npmediago.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: DivX HiQ = C:\Users\troy1980\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\troy1980\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
 
O1 HOSTS File: ([2012.04.06 20:43:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Facebook Connect) - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\troy1980\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
O2 - BHO: (&Crawler Toolbar Helper) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Öffnen mit WordPerfect - c:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: everestpoker.com ([account] https in Vertrauenswürdige Sites)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E4621BA7-579F-4372-8146-84F8D71DBFFC}: NameServer = 62.109.123.197 213.191.74.19
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FFFBED12-9E38-422E-A81F-CFC3EF686581}: DhcpNameServer = 195.50.140.252 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\troy1980\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\troy1980\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.08.24 07:53:21 | 008,958,304 | R--- | M] (Electronic Arts) - F:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2011.09.07 03:00:07 | 000,000,000 | R--D | M] - F:\Autorun -- [ UDF ]
O32 - AutoRun File - [2011.09.07 02:08:12 | 000,032,783 | R--- | M] () - F:\Autorun.ico -- [ UDF ]
O32 - AutoRun File - [2011.09.07 03:00:07 | 000,000,132 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.08 00:41:51 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.04.06 20:50:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.04.06 20:50:51 | 000,000,000 | ---D | C] -- C:\Users\troy1980\AppData\Local\temp
[2012.04.06 20:49:49 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.04.06 20:28:28 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.04.06 20:16:49 | 004,450,572 | R--- | C] (Swearware) -- C:\Users\troy1980\Desktop\ComboFix.exe
[2012.04.06 02:09:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.04.06 02:07:54 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.04.06 02:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.04.06 02:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012.04.06 02:04:07 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2012.04.06 02:00:57 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012.04.06 02:00:54 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012.04.04 21:19:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.04.04 21:19:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.04.04 21:19:29 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2012.04.04 21:19:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.04.04 21:05:44 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.04.04 21:05:41 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.29 20:52:07 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\troy1980\Desktop\OTL.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.08 15:15:23 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.08 15:15:23 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.08 15:15:23 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.08 15:15:23 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.08 15:11:35 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5DC64ABE-5E94-4D4A-BD25-889D1531C5BB}.job
[2012.04.08 15:09:04 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.08 15:09:04 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.08 15:08:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.08 15:08:57 | 3220,496,384 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.08 03:36:30 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.06 20:43:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.04.06 20:28:30 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.06 20:17:00 | 004,450,572 | R--- | M] (Swearware) -- C:\Users\troy1980\Desktop\ComboFix.exe
[2012.04.06 02:09:07 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.04.01 17:11:33 | 000,038,400 | ---- | M] () -- C:\Users\troy1980\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.29 23:00:02 | 000,001,356 | ---- | M] () -- C:\Users\troy1980\AppData\Local\d3d9caps.dat
[2012.03.29 22:59:27 | 000,000,552 | ---- | M] () -- C:\Users\troy1980\AppData\Local\d3d8caps.dat
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.06 20:28:30 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.06 02:09:07 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.04.04 21:19:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.04.04 21:19:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.04.04 21:19:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.04.04 21:19:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.04.04 21:19:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.29 23:01:08 | 3220,496,384 | -HS- | C] () -- C:\hiberfil.sys
[2012.03.29 22:59:27 | 000,000,552 | ---- | C] () -- C:\Users\troy1980\AppData\Local\d3d8caps.dat
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.07.10 07:44:50 | 000,000,770 | ---- | C] () -- C:\Windows\Sof2.INI
[2011.04.30 11:35:23 | 000,233,472 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe
[2011.04.30 11:32:55 | 000,233,472 | R--- | C] () -- C:\Users\troy1980\AppData\Roaming\MafiaSetup.exe
[2011.01.04 03:56:51 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010.01.20 20:10:48 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.01.16 23:22:15 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2010.01.16 22:44:57 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.08.14 14:21:05 | 000,001,356 | ---- | C] () -- C:\Users\troy1980\AppData\Local\d3d9caps.dat
[2009.01.24 15:48:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.10.01 16:49:10 | 000,000,093 | ---- | C] () -- C:\Users\troy1980\AppData\Local\ajbngj.bat
[2008.04.09 20:30:55 | 000,000,206 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2008.03.02 14:36:03 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.03.01 15:32:57 | 000,215,144 | ---- | C] () -- C:\Windows\patchw32.dll
[2008.01.16 17:19:32 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.01.16 17:19:31 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2007.12.17 14:12:27 | 000,000,900 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2007.12.13 19:55:57 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2007.12.01 00:18:17 | 000,038,400 | ---- | C] () -- C:\Users\troy1980\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.12.01 00:13:15 | 000,103,024 | ---- | C] () -- C:\Windows\Unwise.exe
[2007.11.30 22:10:39 | 000,000,096 | ---- | C] () -- C:\Users\troy1980\AppData\Local\fusioncache.dat
[2007.11.30 21:53:56 | 000,138,584 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2007.11.30 21:53:55 | 000,022,328 | ---- | C] () -- C:\Users\troy1980\AppData\Roaming\PnkBstrK.sys
[2007.11.30 21:53:40 | 000,189,672 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2007.11.30 21:53:39 | 000,682,280 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2007.11.30 21:53:39 | 000,070,968 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2007.04.20 08:57:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2006.11.02 21:40:12 | 000,174,656 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2006.11.02 17:33:31 | 000,651,112 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,120,908 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,258,864 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,618,272 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,416 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2005.08.01 02:09:36 | 000,102,400 | ---- | C] () -- C:\Windows\System32\lxceinsr.dll
[2005.08.01 02:09:32 | 000,036,864 | ---- | C] () -- C:\Windows\System32\lxcecur.dll
[2005.08.01 02:09:20 | 000,139,264 | ---- | C] () -- C:\Windows\System32\lxcejswr.dll
[2005.07.14 10:15:30 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxcevs.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
--- --- ---
------------------------------------------------------------------------

Extras.txt

------------------------------------------------------------------------OTL Logfile:
Code:
OTL Extras logfile created on: 08.04.2012 15:19:50 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\troy1980\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,84 Gb Available Physical Memory | 61,26% Memory free
6,19 Gb Paging File | 5,08 Gb Available in Paging File | 82,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 83,69 Gb Free Space | 27,59% Space Free | Partition Type: NTFS
Drive D: | 150,69 Gb Total Space | 150,60 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive F: | 6,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TROY1980-PC | User Name: troy1980 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06D25C93-D00E-4F7B-A3A0-4959863705CD}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=c:\windows\system32\svchost.exe |
"{10705A28-485F-4005-AC21-F33772BC174C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{18DA2C0C-C108-41EA-8ACD-C9E97F22F1B0}" = rport=138 | protocol=17 | dir=out | app=system |
"{40332F33-2F66-46D6-906B-4AEC6B104BFD}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4F6B988C-0521-479C-98C5-40C7E7111C7E}" = lport=135 | protocol=6 | dir=in | name=tcp port 135 |
"{58B694E0-0534-49EF-8A53-B1417D0538B4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6FF97DAA-A786-4201-B933-80D0D8D3510C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{73D9AAD0-18E5-4DDF-BFE1-88E806697B37}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=c:\windows\system32\svchost.exe |
"{763E55D9-3648-4E55-AC7E-CDCBC4020947}" = lport=137 | protocol=17 | dir=in | app=system |
"{7972379C-BDEF-4109-A170-B05B9286FE9B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{862F63E5-5213-48B2-A28F-3F2EAB6B7E7D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{885CD312-976F-4B6E-9B50-A9A411597A3D}" = lport=138 | protocol=17 | dir=in | app=system |
"{8C99D211-4B91-46D2-BD2A-69C5CC57F716}" = rport=137 | protocol=17 | dir=out | app=system |
"{986865D1-FC02-4DA0-98F7-C61F32EE6F76}" = lport=445 | protocol=6 | dir=in | app=system |
"{A3EC8AE3-A237-4DF0-9A86-94F1DE71D05D}" = rport=139 | protocol=6 | dir=out | app=system |
"{A4A45F4D-F2A1-4142-8121-69F4090ECA70}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{ABB6581C-B5AD-4555-83F0-FAEA0BE5D0FA}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B6284860-7108-4E63-8069-5B687653BB44}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BC2CC625-26E6-4559-987D-A4942810D4EC}" = rport=445 | protocol=6 | dir=out | app=system |
"{C0FB76F3-8201-4414-B5B3-716A85A7F4C6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{D51AE25D-466A-4C51-8A24-DE365A50C841}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{DBFC6880-A5D6-466F-8F46-52FDCF9EF718}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBD5089C-2109-42B4-BE38-A87FE9B635B6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F45828B3-3DE3-4BF3-9415-E418FCD3D509}" = lport=139 | protocol=6 | dir=in | app=system |
"{F9BC085F-97B2-4A37-9909-E158F32D3EA0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FF6AF61E-019F-46C0-9D76-925E49121C5C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00EE948A-4F57-4996-B9B8-EBBC25230318}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{09E95F67-ED8D-4F8D-B116-FD199168BCBD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{12C9070A-280D-48B6-B141-ADE8547DEE93}" = protocol=6 | dir=in | app=c:\program files\ascaron entertainment\sacred 2 - demo\system\s2gs.exe |
"{142899BC-5154-418F-81C4-1824C6F388F6}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{271505CB-BDD2-4BC7-A02D-6D6C0E6EF305}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe |
"{31A985A9-FF7B-4606-BF79-C4881B7245B4}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{320D237F-CC9B-4411-BAFD-E6A2524EC1F4}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{3527F2E9-7BAC-492C-B311-FD285471A3F4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{414F80C7-67E4-40AC-BA29-58677B8716E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{42365F60-E043-455A-9F23-1438C3B62A20}" = protocol=17 | dir=in | app=c:\program files\ascaron entertainment\sacred 2 - demo\system\s2gs.exe |
"{4AF6CD66-1559-476E-82BF-E0EF6EC31857}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{4CB5E013-7449-4479-82CE-5C5A0DAB5882}" = protocol=6 | dir=out | app=system |
"{5AC28836-B120-4A7A-81E9-00F5F452A455}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5B0D19B2-BD69-4F8F-94B9-AB85881B3553}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5F2D4B6E-5AD3-4751-8E58-A2BD0E99B02D}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{617EC6C0-D4F7-4D9F-A2E7-55D5EAC6AAF9}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{664AC070-4C55-4F0D-986D-058F2DAC764D}" = protocol=6 | dir=in | app=c:\program files\origin games\fifa 12\game\fifa.exe |
"{697C9C1E-A4DB-47AD-A969-7C2376DC651E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6D1FB01C-617C-4C1D-B0DA-36A18D38022C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6D340F40-8303-4A4C-B470-10C2E64D4D63}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{70A0310C-85A4-4731-B6D8-EDCE2CCFDE47}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{758A7656-660C-4D3D-AD70-823ED47DB8FD}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{81DCD9DB-51FF-40BB-8A89-A0A708BB3697}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe |
"{8305496F-1A18-43C1-912D-DF642972574F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{846B35DF-8DE5-4B1E-9D13-BA08E6F49488}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8B999A7D-2C72-4A31-A7EA-893B001741DB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A2FB7B04-F8C6-42CE-90C6-D2DE16AB2453}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{A6A3453C-80FC-44A1-A74C-C60D80CE13A6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike\hl.exe |
"{A9196221-BBBD-414C-8DE4-7CC123CD994B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AF397409-EB97-4719-ABB1-C4E61D41A2AA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B5AEEEE8-B4C3-4725-A36C-4B7190B84DAB}" = protocol=17 | dir=in | app=c:\program files\ascaron entertainment\sacred 2 - demo\system\sacred2.exe |
"{B80D0B57-FBBF-47BC-9580-E9EA350702BC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{BBB1AABA-B4D5-4462-8382-039EFDC3FAB2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BCF23D11-FDB1-4299-8FC7-B3A8F4BC2065}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C75BB517-80DB-4102-BE80-1AFA684C7896}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{D5AC74B7-A009-4A3A-A9D7-E6D937BB49A1}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe |
"{D5AD3DC4-6A52-4048-87C8-EE9596357372}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe |
"{D88E3B99-2F4B-4C76-B23C-8CD1EA559DF8}" = protocol=6 | dir=in | app=c:\program files\ascaron entertainment\sacred 2 - demo\system\sacred2.exe |
"{D9919647-CB6B-4F27-8196-771E8863AA70}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DD2424E0-AFD9-4B9F-BC4C-A30A7A4E3C77}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike\hl.exe |
"{DEBC6810-0B95-472F-AFB4-86459F21BF4A}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{E383E806-3C44-4EBB-BC0D-764B21242D15}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{E55C5BC6-D277-427E-AAF1-86EE52BADFD0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E66CE490-38A4-41A4-9958-E1FC149F9FAE}" = protocol=17 | dir=in | app=c:\program files\origin games\fifa 12\game\fifa.exe |
"{EC9765F8-EE99-4E79-B107-6641E78ACDEE}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{F06F5445-8163-41AA-91F8-C1F972CD8E25}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"TCP Query User{177AEABE-EF73-4522-A4C1-754D354E242D}C:\program files\sony\media go\mediago.exe" = protocol=6 | dir=in | app=c:\program files\sony\media go\mediago.exe |
"TCP Query User{185C53E2-ABC9-4BB8-A481-4D2676851B66}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{2BEC7808-30E3-4FF7-B651-E7F279130DE9}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{4264CB6A-8E7F-4115-8204-6423B4549FBC}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{4A33F961-3570-49C2-A891-E9D384946400}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{66565823-30BD-4771-8E5A-F61920CBDA10}C:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe |
"TCP Query User{73839B82-BA80-4652-9ABD-999D79AEB0EC}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{7EC6826B-75B0-49F0-B561-1051DA542A1E}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{8934C575-5B38-4B3A-ADC1-B47CA893DDDF}C:\program files\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files\anno 1701\anno1701.exe |
"TCP Query User{D949B81F-DD67-47C0-A77D-756591A09C2A}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{01092D6C-2FF8-4F76-986E-DB4462D4BBA6}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{245A43B5-C280-487B-9B27-D1EA007E0C48}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{2E9D8C09-4E2F-42E9-824B-F062B17AE529}C:\program files\sony\media go\mediago.exe" = protocol=17 | dir=in | app=c:\program files\sony\media go\mediago.exe |
"UDP Query User{7CBA347A-B269-4D8F-8310-21C6631EF88F}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"UDP Query User{8418C587-4525-4FB5-A769-EFFFD944F2A9}C:\program files\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files\anno 1701\anno1701.exe |
"UDP Query User{87EA7D0D-3912-4A95-83D9-E34D60F176E0}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe |
"UDP Query User{8C86CDAB-9DB8-4AC1-BC29-1D950ABEEAFF}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{93B70C8D-6B34-4DFD-8F92-E2ABA9478AAB}C:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\kart123\counter-strike source\hl2.exe |
"UDP Query User{BD38313D-6A6B-4BB9-BBB5-6CDA60C1ED32}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{C518DD64-6953-4744-8486-23B70C2D3265}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0D005F09-A5F4-473B-A901-5735C6AF5628}" = Silent Hunter 4 Wolves of the Pacific
"{11BFB898-71E5-488A-A8FF-0E462667FB72}" = Soldier of Fortune Payback
"{16393B5A-43A8-434B-B22A-0724581F7873}" = GameShadow
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}" = Need for Speed™ ProStreet
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{4636E701-5410-4231-BF83-6B99DE575149}" = Sacred 2 Demo
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6803A6E6-48FF-48AB-B558-7B651BBE1031}" = Nero 8 Essentials
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F1A5941-5664-4E5D-848A-9D605BFA49AF}" = Frontline: Fields of Thunder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72EBA4A9-25D7-4F86-AB6D-0848C74CC3F8}" = Conceptronic 54Mbps Wireless Utility
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{83012AA4-027F-3721-A0C5-0D31FD58C5DF}" = NVIDIA PhysX SDK 2.8.1
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}" = AGEIA PhysX v7.11.13
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC86ECA1-FA14-11D1-B4F6-00609781F44C}" = Der Brockhaus multimedial
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{C2D129C0-7508-11DF-9F1B-005056806466}" = Google Earth
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C711E88C-9DC2-4254-A989-D6E017844DDF}" = Frontlines: Fuel of War
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kanes Rache
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{DFFCDB41-C2DA-47D6-96FF-03C05C0BEA22}" = resident evil 4
"{E91E8912-769D-42F0-8408-0E329443BABC}" = Ralink Wireless LAN Card
"{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}" = FIFA 12
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F972403C-BFE4-49EB-82B8-10D0FDBD1BB1}" = VirtualDJ Home FREE
"{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}" = Media Go
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Big Fish Games Center" = Big Fish Games Center (remove only)
"Big Fish Games Sudoku" = Big Fish Games Sudoku (remove only)
"CCleaner" = CCleaner
"Cradle of Rome" = Cradle of Rome (remove only)
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup.divx.com" = DivX-Setup
"EAX Unified" = EAX Unified
"ESET Online Scanner" = ESET Online Scanner v3
"Everest Poker" = Everest Poker (Remove Only)
"Free Studio_is1" = Free Studio version 4.9
"Free YouTube Download_is1" = Free YouTube Download 2.9
"GameSpy Arcade" = GameSpy Arcade
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"IPIX ActiveX Viewer" = IPIX ActiveX Viewer
"IPIX Netscape Plugin Viewer" = IPIX Netscape Plugin Viewer
"IPIX Viewer" = IPIX Viewer
"kayqmmw" = Favorit
"Lexmark 4300 Series" = Lexmark 4300 Series
"Lexmark Fax Solutions" = Lexmark Fax-Lösungen
"Luxor Amun Rising" = Luxor Amun Rising (remove only)
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Mahjong Towers Eternity EU" = Mahjong Towers Eternity EU (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"mplayer.com" = mplayer.com
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Origin" = Origin
"PhotoScape" = PhotoScape
"Poker Superstars II" = Poker Superstars II (remove only)
"PokerStars" = PokerStars
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"S.T.A.L.K.E.R. - Clear Sky_is1" = S.T.A.L.K.E.R. - Clear Sky
"S.T.A.L.K.E.R. - Shadow of Chernobyl_is1" = S.T.A.L.K.E.R. - Shadow of Chernobyl
"Soldier of Fortune II - Double Helix" = Soldier of Fortune II - Double Helix
"Spyware Terminator_is1" = Spyware Terminator
"Steam App 10" = Counter-Strike
"Steam App 240" = Counter-Strike: Source
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Uninstall_is1" = Uninstall 1.0.0.1
"Virtual Villagers" = Virtual Villagers (remove only)
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.04.2012 15:12:02 | Computer Name = troy1980-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 06.04.2012 15:13:43 | Computer Name = troy1980-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.04.2012 02:20:03 | Computer Name = troy1980-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.04.2012 05:54:16 | Computer Name = troy1980-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.04.2012 09:30:01 | Computer Name = troy1980-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung LEXPPS.EXE, Version 8.16.0.0, Zeitstempel 0x3e5a944f,
 fehlerhaftes Modul LEXBCE.DLL_unloaded, Version 0.0.0.0, Zeitstempel 0x3e5a9489,
 Ausnahmecode 0xc0000005, Fehleroffset 0x6300fd00,  Prozess-ID 0x634, Anwendungsstartzeit
 01cd14a463916a73.
 
Error - 07.04.2012 10:33:50 | Computer Name = troy1980-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.04.2012 14:17:38 | Computer Name = troy1980-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 07.04.2012 14:17:38 | Computer Name = troy1980-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 07.04.2012 14:17:38 | Computer Name = troy1980-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 08.04.2012 09:15:23 | Computer Name = troy1980-PC | Source = WerSvc | ID = 5007
Description =
 
[ Media Center Events ]
Error - 16.04.2008 19:52:04 | Computer Name = troy1980-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: Download von Paket MCESpotlight
 gescheitert.
 
[ System Events ]
Error - 29.03.2012 15:10:14 | Computer Name = troy1980-PC | Source = DCOM | ID = 10005
Description =
 
Error - 31.03.2012 06:15:52 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 03.04.2012 05:07:22 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 04.04.2012 15:00:07 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 05.04.2012 15:58:48 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 06.04.2012 14:05:54 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 06.04.2012 15:08:20 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 07.04.2012 05:54:15 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
Error - 07.04.2012 05:55:50 | Computer Name = troy1980-PC | Source = Service Control Manager | ID = 7026
Description =
 
Error - 08.04.2012 09:09:04 | Computer Name = troy1980-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
 
 
< End of report >
--- --- ---

------------------------------------------------------------------------

Frohe Ostern. :singsing:

Larusso 09.04.2012 16:37
Zitat:
VirtualDJ Home FREE
Zufrieden damit ? :D Nutzte ich auch ne Zeit, jetzt bleib ich aber bei Traktor


Deinstalliere bitte
Crawler Toolbar with Web Security Guard
Spyware Terminator
Favorit



Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome.


In Firefox bitte auf Extras --> Einstellungen --> Erweitert --> Netzwerk und klicke auf beide Jetzt leeren Buttons.

Starte FF neu.



Starte bitte OTL.exe und drücke den Quick Scan Button.
Poste die OTL.txt hier in deinen Thread.



Berichte wie der Rechner läuft

Larusso 21.04.2012 12:25
Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

Aendee 29.04.2012 14:01
Sorry das es solange gedauert hat.
Der Rechner läuft bestens.
Hier ist dann noch die OTL.txtOTL Logfile:
Code:
OTL logfile created on: 29.04.2012 14:57:35 - Run 3
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\troy1980\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,90 Gb Available Physical Memory | 63,52% Memory free
6,19 Gb Paging File | 5,11 Gb Available in Paging File | 82,53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 87,96 Gb Free Space | 29,00% Space Free | Partition Type: NTFS
Drive D: | 150,69 Gb Total Space | 150,60 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive F: | 6,91 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: TROY1980-PC | User Name: troy1980 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\troy1980\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Windows\System32\PSIService.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\DivX\DivX Plus Web Player\libxml2.dll ()
MOD - C:\Users\troy1980\AppData\Roaming\FBConnect\IE\sqlite3.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
SRV - (lxce_device) -- C:\Windows\System32\lxcecoms.exe (Lexmark International, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (sp_rsdrv2) -- C:\Windows\System32\drivers\sp_rsdrv2.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1029unic.sys (MCCI Corporation)
DRV - (s1029mdm) -- C:\Windows\System32\drivers\s1029mdm.sys (MCCI Corporation)
DRV - (s1029bus) Sony Ericsson Device 1029 driver (WDM) -- C:\Windows\System32\drivers\s1029bus.sys (MCCI Corporation)
DRV - (s1029mdfl) -- C:\Windows\System32\drivers\s1029mdfl.sys (MCCI Corporation)
DRV - (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1029mgmt.sys (MCCI Corporation)
DRV - (s1029obex) -- C:\Windows\System32\drivers\s1029obex.sys (MCCI Corporation)
DRV - (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1029nd5.sys (MCCI Corporation)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - SOFTWARE\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}\InprocServer32 File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = Google
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: c:\Program Files\Sony\Media Go\npmediago.dll (Sony Creative Software Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.04.01 16:27:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.18 08:04:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.18 08:04:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\firefox\ [2011.07.23 23:11:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.28 19:27:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.29 14:55:14 | 000,000,000 | ---D | M]
 
[2011.07.23 15:50:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\troy1980\AppData\Roaming\mozilla\Extensions
[2012.04.26 00:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\troy1980\AppData\Roaming\mozilla\Firefox\Profiles\v0kaz9i0.default\extensions
[2011.07.23 15:50:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.01.15 09:53:01 | 000,000,000 | ---D | M] (Facebook Connect) -- C:\Program Files\mozilla firefox\extensions\{9a4e42f4-ee19-467a-ad67-3c31ed29837b}
[2011.01.15 09:53:01 | 000,000,000 | ---D | M] (Win32+64) -- C:\Program Files\mozilla firefox\extensions\win32-64@anonymous.org
() (No name found) -- C:\USERS\TROY1980\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V0KAZ9I0.DEFAULT\EXTENSIONS\{DD05FD3D-18DF-4CE4-AE53-E795339C5F01}.XPI
[2009.08.15 17:28:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012.04.28 19:27:40 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.20 17:57:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.20 17:57:17 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2012.02.20 17:57:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.20 17:57:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.20 17:57:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.20 17:57:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\11.0.696.71\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Media Go Detector (Enabled) = c:\Program Files\Sony\Media Go\npmediago.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: DivX HiQ = C:\Users\troy1980\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\troy1980\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
 
O1 HOSTS File: ([2012.04.06 20:43:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Facebook Connect) - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\troy1980\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
O2 - BHO: (&Crawler Toolbar Helper) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Öffnen mit WordPerfect - c:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: everestpoker.com ([account] https in Vertrauenswürdige Sites)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E4621BA7-579F-4372-8146-84F8D71DBFFC}: NameServer = 62.109.123.6 213.191.92.87
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FFFBED12-9E38-422E-A81F-CFC3EF686581}: DhcpNameServer = 195.50.140.252 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\troy1980\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\troy1980\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.08.24 07:53:21 | 008,958,304 | R--- | M] (Electronic Arts) - F:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2011.09.07 03:00:07 | 000,000,000 | R--D | M] - F:\Autorun -- [ UDF ]
O32 - AutoRun File - [2011.09.07 02:08:12 | 000,032,783 | R--- | M] () - F:\Autorun.ico -- [ UDF ]
O32 - AutoRun File - [2011.09.07 03:00:07 | 000,000,132 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.28 19:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.04.28 19:27:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.04.08 00:41:51 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.04.06 20:50:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.04.06 20:50:51 | 000,000,000 | ---D | C] -- C:\Users\troy1980\AppData\Local\temp
[2012.04.06 20:49:49 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.04.06 20:28:28 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.04.06 20:16:49 | 004,450,572 | R--- | C] (Swearware) -- C:\Users\troy1980\Desktop\ComboFix.exe
[2012.04.06 02:09:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.04.06 02:07:54 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.04.06 02:07:52 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.04.06 02:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012.04.06 02:04:07 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2012.04.06 02:00:57 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012.04.06 02:00:54 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012.04.04 21:19:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.04.04 21:19:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.04.04 21:19:29 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2012.04.04 21:19:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.04.04 21:05:44 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.04.04 21:05:41 | 000,000,000 | ---D | C] -- C:\Qoobox
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.29 14:55:14 | 000,001,898 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.04.29 14:53:09 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.29 14:53:09 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.29 12:59:37 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.29 12:59:37 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.29 12:59:37 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.29 12:59:37 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.29 12:53:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.29 12:52:29 | 3220,496,384 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.29 12:46:55 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.29 12:33:33 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5DC64ABE-5E94-4D4A-BD25-889D1531C5BB}.job
[2012.04.06 20:43:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.04.06 20:28:30 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.06 20:17:00 | 004,450,572 | R--- | M] (Swearware) -- C:\Users\troy1980\Desktop\ComboFix.exe
[2012.04.06 02:09:07 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.04.01 17:11:33 | 000,038,400 | ---- | M] () -- C:\Users\troy1980\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.29 14:55:14 | 000,001,898 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.04.29 14:55:14 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.04.06 20:28:30 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.06 02:09:07 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.04.04 21:19:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.04.04 21:19:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.04.04 21:19:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.04.04 21:19:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.04.04 21:19:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.29 22:59:27 | 000,000,552 | ---- | C] () -- C:\Users\troy1980\AppData\Local\d3d8caps.dat
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.07.10 07:44:50 | 000,000,770 | ---- | C] () -- C:\Windows\Sof2.INI
[2011.04.30 11:35:23 | 000,233,472 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe
[2011.04.30 11:32:55 | 000,233,472 | R--- | C] () -- C:\Users\troy1980\AppData\Roaming\MafiaSetup.exe
[2011.01.04 03:56:51 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010.01.20 20:10:48 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.01.16 23:22:15 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2010.01.16 22:44:57 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.08.14 14:21:05 | 000,001,356 | ---- | C] () -- C:\Users\troy1980\AppData\Local\d3d9caps.dat
[2009.01.24 15:48:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.10.01 16:49:10 | 000,000,093 | ---- | C] () -- C:\Users\troy1980\AppData\Local\ajbngj.bat
[2008.04.09 20:30:55 | 000,000,206 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2008.03.02 14:36:03 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.03.01 15:32:57 | 000,215,144 | ---- | C] () -- C:\Windows\patchw32.dll
[2008.01.16 17:19:32 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.01.16 17:19:31 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2007.12.17 14:12:27 | 000,000,900 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2007.12.13 19:55:57 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2007.12.01 00:18:17 | 000,038,400 | ---- | C] () -- C:\Users\troy1980\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.12.01 00:13:15 | 000,103,024 | ---- | C] () -- C:\Windows\Unwise.exe
[2007.11.30 22:10:39 | 000,000,096 | ---- | C] () -- C:\Users\troy1980\AppData\Local\fusioncache.dat
[2007.11.30 21:53:56 | 000,138,584 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2007.11.30 21:53:55 | 000,022,328 | ---- | C] () -- C:\Users\troy1980\AppData\Roaming\PnkBstrK.sys
[2007.11.30 21:53:40 | 000,189,672 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2007.11.30 21:53:39 | 000,682,280 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2007.11.30 21:53:39 | 000,070,968 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2007.04.20 08:57:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.20 08:57:28 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2006.11.02 21:40:12 | 000,174,656 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2006.11.02 17:33:31 | 000,651,112 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,120,908 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,258,864 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,618,272 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,416 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2005.08.01 02:09:36 | 000,102,400 | ---- | C] () -- C:\Windows\System32\lxceinsr.dll
[2005.08.01 02:09:32 | 000,036,864 | ---- | C] () -- C:\Windows\System32\lxcecur.dll
[2005.08.01 02:09:20 | 000,139,264 | ---- | C] () -- C:\Windows\System32\lxcejswr.dll
[2005.07.14 10:15:30 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxcevs.dll
 
========== LOP Check ==========
 
[2011.04.27 07:48:40 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Codemasters
[2008.04.12 10:08:56 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2008.02.13 22:24:01 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011.07.09 09:00:24 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\DAEMON Tools Lite
[2010.10.13 22:53:09 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\DVDVideoSoft
[2010.10.13 22:55:37 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.01.15 09:53:01 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\FBConnect
[2011.08.22 16:34:07 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\go
[2009.01.17 19:45:32 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Leadertech
[2011.12.10 02:51:58 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Origin
[2010.10.31 11:33:30 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\PhotoScape
[2010.10.13 21:50:23 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Sony
[2010.10.13 21:48:34 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Sony Setup
[2012.01.15 00:02:28 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Spyware Terminator
[2011.07.09 09:00:19 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\TS3Client
[2011.06.16 21:03:05 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Ubisoft
[2011.07.09 08:53:37 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Wosai
[2008.11.04 21:52:42 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\XRay Engine
[2011.07.09 09:51:19 | 000,000,000 | ---D | M] -- C:\Users\troy1980\AppData\Roaming\Ywrab
[2012.04.29 12:46:58 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.04.29 12:33:33 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{5DC64ABE-5E94-4D4A-BD25-889D1531C5BB}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:53 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131