|
logs des system progressive protection trojaners Ok, erst mal herzlichsttes Danke daß es dieses Forum gibt. Ich habe eure Anleitung zum entfernen der system progressive protection maleware befolgt und poste nun die logs, dazu ist anzumerken, daß gmer nix fand. soderle. OTL logfile created on: 28.11.2012 17:08:05 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\cosmycfuture\Documents 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 27,21% Memory free 5,99 Gb Paging File | 2,34 Gb Available in Paging File | 39,02% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 226,46 Gb Total Space | 129,47 Gb Free Space | 57,17% Space Free | Partition Type: NTFS Drive D: | 226,56 Gb Total Space | 226,44 Gb Free Space | 99,95% Space Free | Partition Type: NTFS Drive E: | 226,56 Gb Total Space | 225,34 Gb Free Space | 99,46% Space Free | Partition Type: NTFS Drive G: | 931,28 Gb Total Space | 908,95 Gb Free Space | 97,60% Space Free | Partition Type: FAT32 Computer Name: COSMYCFUTURE-PC | User Name: cosmycfuture | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.28 17:07:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\cosmycfuture\Documents\OTL.exe PRC - [2012.11.06 19:00:32 | 003,143,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe PRC - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe PRC - [2012.10.24 15:05:40 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe PRC - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.09.29 20:06:42 | 001,353,080 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe PRC - [2012.09.29 19:54:26 | 000,981,656 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.08.29 13:00:12 | 000,059,280 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe PRC - [2011.07.03 04:43:59 | 000,240,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10t_ActiveX.exe PRC - [2010.07.12 17:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\instProgramme\winamp\winampa.exe ========== Modules (No Company Name) ========== MOD - [2012.10.24 15:05:40 | 020,317,008 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll MOD - [2012.10.24 15:05:39 | 001,099,616 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll MOD - [2012.10.24 15:05:39 | 000,902,480 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL MOD - [2012.10.24 15:05:39 | 000,190,816 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll MOD - [2012.10.24 15:05:39 | 000,123,232 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll MOD - [2011.06.25 11:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.25 11:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ========== Services (SafeList) ========== SRV:64bit: - [2012.07.27 01:30:58 | 000,170,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R) SRV - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012.10.24 15:05:40 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd) SRV - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2011.08.07 13:40:00 | 003,804,120 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.10.22 13:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver) DRV:64bit: - [2012.10.15 03:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA) DRV:64bit: - [2012.10.05 03:32:50 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64) DRV:64bit: - [2012.10.02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64) DRV:64bit: - [2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.09.21 03:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia) DRV:64bit: - [2012.09.21 03:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga) DRV:64bit: - [2012.09.14 03:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64) DRV:64bit: - [2012.08.21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.07.09 12:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.05.05 17:50:51 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.03.07 10:56:19 | 000,301,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1e6232e.sys -- (e1express) DRV:64bit: - [2011.03.11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.04.28 07:57:50 | 000,061,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2010.04.19 20:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883) DRV:64bit: - [2009.07.14 01:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc) DRV:64bit: - [2009.07.14 01:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV) DRV:64bit: - [2009.06.10 21:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:32:37 | 001,627,520 | ---- | M] (NXP Semiconductors) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Ph3xIB64.sys -- (Ph3xIB64) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2006.11.30 14:17:56 | 000,033,048 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\x10ufx2.sys -- (XUIF) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=bf2&s={searchTerms}&f=4 IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682 IE - HKLM\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0E 07 EA C3 F6 6D CB 01 [binary data] IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKCU\..\URLSearchHook: {77f8c945-4b74-4bd6-a073-e0d1997edce8} - No CLSID value found IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No CLSID value found IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found IE - HKCU\..\URLSearchHook: {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC) IE - HKCU\..\SearchScopes,DefaultScope = {DB261C6D-D7C6-413E-A244-DA9C1B015D42} IE - HKCU\..\SearchScopes\{D3167839-45DB-48E0-9057-BF7B901DE9E3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120311,16987,0,8,0 IE - HKCU\..\SearchScopes\{DB261C6D-D7C6-413E-A244-DA9C1B015D42}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\instProgramme\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\instProgramme\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) [2012.05.05 18:02:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cosmycfuture\AppData\Roaming\mozilla\Firefox\Profiles\extensions [2011.09.11 11:28:14 | 000,002,046 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://search.iminent.com/?appId=C83A60C2-9F4F-4854-A707-B14E77475941 CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\instProgramme\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\instProgramme\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\instProgramme\bin\new_plugin\npjp2.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - Extension: PriceGong = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.5.3_0\ CHR - Extension: YouTube = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: Google-Suche = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\ CHR - Extension: BrotherSoft Extreme = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\naipdapbimiiikbbgjcpbgmfhnlbagpj\2.2.0.5_0\ CHR - Extension: Google Mail = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\instProgramme\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Deaktivierungs-Add-on für Browser von Google Analytics) - {75EF13CE-B59E-41ba-8A5A-A944031BD8B4} - C:\Program Files (x86)\Google\Google Analytics Opt-Out\gaoptout.dll (Google, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\instProgramme\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (NetAssistant) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (W3i, LLC) O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll () O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {77F8C945-4B74-4BD6-A073-E0D1997EDCE8} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [StereoLinksInstall] C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe (NVIDIA Corporation) O4 - HKLM..\Run: [WinampAgent] C:\instProgramme\winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKCU..\Run: [Orb] C:\Program Files (x86)\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4:64bit: - HKLM..\RunOnce: [NoIE4StubProcessing] C:\Windows\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///K:/Programme/Mysteryville%202/Images/stg_drm.ocx (SpinTop DRM Control) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab (Battlefield Play4Free Updater) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///K:/Programme/Mysteryville%202/Images/armhelper.ocx (ArmHelper Control) O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.9.0.cab (SysInfo Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0157D32E-E455-4321-8FB6-59490FC0D4A3}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BB4E5B48-EE3E-4D95-925E-1EA3CEAC29BE}: DhcpNameServer = 139.7.30.125 139.7.30.126 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{b6633804-1585-11e0-be48-001d9272add9}\Shell - "" = AutoRun O33 - MountPoints2\{b6633804-1585-11e0-be48-001d9272add9}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.28 17:07:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\cosmycfuture\Documents\OTL.exe [2012.11.28 02:54:23 | 000,060,776 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.11.28 02:54:23 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.11.28 02:53:46 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2012.11.28 02:53:32 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2012.11.28 02:53:32 | 000,000,000 | ---D | C] -- C:\Windows\LastGood [2012.11.28 02:21:17 | 252,331,096 | ---- | C] (Emsisoft GmbH ) -- C:\Users\cosmycfuture\Documents\EmsisoftAntiMalwareSetup.exe [2012.11.27 20:57:14 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\AppData\Roaming\Malwarebytes [2012.11.27 20:57:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.11.27 20:57:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.11.27 20:57:08 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.11.27 20:57:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.11.27 20:52:58 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\AppData\Roaming\AVG2013 [2012.11.27 20:52:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2012.11.27 20:52:31 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\AppData\Roaming\TuneUp Software [2012.11.27 20:52:04 | 000,000,000 | -H-D | C] -- C:\$AVG [2012.11.27 20:52:04 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013 [2012.11.27 20:51:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG [2012.11.27 20:50:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.11.27 20:50:02 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\AppData\Local\MFAData [2012.11.27 20:50:02 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2012.11.27 20:50:02 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\AppData\Local\Avg2013 [2012.11.27 20:47:58 | 000,000,000 | ---D | C] -- C:\Users\cosmycfuture\Desktop\rkill [2012.11.27 20:38:32 | 010,524,080 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\cosmycfuture\Documents\Marianne.exe [2012.11.27 19:00:20 | 000,000,000 | ---D | C] -- C:\ProgramData\0C2C49979E3AC35600000C2C3D76CEC4 [2007.08.14 06:46:00 | 000,102,912 | ---- | C] (Albert L Faber) -- C:\Users\cosmycfuture\AppData\Local\CDRip.dll [2007.01.19 10:09:54 | 000,623,616 | ---- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\cosmycfuture\AppData\Local\No23 Recorder.exe [2006.12.12 08:13:14 | 000,013,872 | ---- | C] (Un4seen Developments) -- C:\Users\cosmycfuture\AppData\Local\basscd.dll [2006.12.12 08:13:12 | 000,097,336 | ---- | C] (Un4seen Developments) -- C:\Users\cosmycfuture\AppData\Local\bass.dll [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\cosmycfuture\*.tmp files -> C:\Users\cosmycfuture\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.28 17:09:06 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.11.28 17:07:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\cosmycfuture\Documents\OTL.exe [2012.11.28 17:02:56 | 000,000,168 | ---- | M] () -- C:\Users\cosmycfuture\defogger_reenable [2012.11.28 16:09:14 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.11.28 03:30:36 | 001,518,986 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.11.28 03:30:36 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.11.28 03:30:36 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.11.28 03:30:36 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.11.28 03:30:36 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.11.28 02:35:26 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.28 02:35:26 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.28 02:26:59 | 252,331,096 | ---- | M] (Emsisoft GmbH ) -- C:\Users\cosmycfuture\Documents\EmsisoftAntiMalwareSetup.exe [2012.11.28 02:07:55 | 000,000,406 | ---- | M] () -- C:\Windows\tasks\FinalTorrent Update Checker.job [2012.11.28 02:07:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.28 02:07:50 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys [2012.11.27 20:58:02 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012.11.27 20:52:35 | 000,000,232 | ---- | M] () -- C:\Windows\tasks\SidebarExecute.job [2012.11.27 20:52:32 | 000,000,981 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2012.11.27 20:43:33 | 000,000,130 | ---- | M] () -- C:\Users\cosmycfuture\Desktop\System Progressive Protection Support Site.url [2012.11.27 20:38:36 | 010,524,080 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\cosmycfuture\Documents\Marianne.exe [2012.11.27 19:50:20 | 145,671,736 | ---- | M] () -- C:\Users\cosmycfuture\Documents\zut.exe [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\cosmycfuture\*.tmp files -> C:\Users\cosmycfuture\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.28 17:02:56 | 000,000,168 | ---- | C] () -- C:\Users\cosmycfuture\defogger_reenable [2012.11.27 20:57:09 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012.11.27 20:52:35 | 000,000,232 | ---- | C] () -- C:\Windows\tasks\SidebarExecute.job [2012.11.27 20:52:32 | 000,000,981 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2012.11.27 20:43:33 | 000,000,130 | ---- | C] () -- C:\Users\cosmycfuture\Desktop\System Progressive Protection Support Site.url [2012.11.27 19:47:22 | 145,671,736 | ---- | C] () -- C:\Users\cosmycfuture\Documents\zut.exe [2012.06.08 17:34:47 | 000,012,130 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\slot1.mm1 [2012.04.14 22:17:08 | 000,000,336 | ---- | C] () -- C:\Windows\game.ini [2011.11.27 08:39:17 | 000,004,608 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.07.23 21:32:48 | 000,001,465 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\RecConfig.xml [2011.04.17 09:57:30 | 000,000,014 | ---- | C] () -- C:\Windows\popcinfo.dat [2011.03.11 21:07:33 | 043,403,368 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Roaming\.minecraft.rar [2010.10.22 10:42:28 | 000,007,619 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\resmon.resmoncfg [2007.08.14 06:46:00 | 000,155,136 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\lame_enc.dll [2006.10.26 14:06:48 | 000,064,000 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\vorbisenc.dll [2006.10.26 14:06:48 | 000,019,456 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\vorbisfile.dll [2006.10.26 14:06:46 | 000,143,872 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\vorbis.dll [2006.10.26 14:06:36 | 000,015,872 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\ogg.dll [2005.08.24 11:34:06 | 000,029,184 | ---- | C] () -- C:\Users\cosmycfuture\AppData\Local\no23xwrapper.dll ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2010.07.27 15:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 15:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.09.29 19:58:14 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\.minecraft [2011.07.24 02:18:13 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\20000Leagues [2012.10.28 14:08:11 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\4 Friends Games [2012.10.28 15:52:22 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Abra Academy2 [2012.06.22 14:48:19 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Aeria Games & Entertainment [2012.10.28 13:49:45 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Alawar Stargaze [2012.10.03 10:49:41 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Artogon [2012.11.27 20:52:58 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\AVG2013 [2011.07.31 08:20:28 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Azuaz Games [2012.08.29 08:17:49 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Azureus [2011.09.11 10:30:27 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Babylon [2012.10.21 16:59:26 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Big Fish Games [2012.06.27 19:33:20 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Blue Tea Games [2012.06.26 10:55:12 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Boomzap [2011.07.31 02:09:37 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Casual Arts [2012.06.08 12:04:46 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\casualArts [2011.07.31 10:18:58 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\cerasus.media [2012.08.29 08:17:49 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\DAEMON Tools Lite [2011.08.22 03:04:54 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Dekovir [2011.07.31 09:40:00 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\EleFun Games [2011.07.31 07:54:03 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Elephant Games [2011.07.31 11:56:13 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\ERS G-Studio [2012.10.28 16:03:07 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\ERS Game Studios [2012.09.23 12:10:24 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\FinalTorrent [2011.08.27 21:19:44 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Flood Light Games [2012.10.21 17:38:24 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\FlyWheelGames [2011.06.10 23:53:07 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Forte [2011.08.22 04:07:46 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Frogwares [2011.07.31 10:13:43 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Gamers Digital [2011.01.15 14:27:39 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\GamesFaction [2011.09.11 10:50:54 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\GetRightToGo [2012.10.21 21:10:27 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\HdO Adventure [2011.08.01 02:53:35 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\HiT-MM [2010.12.31 16:31:47 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Jetsetter [2010.11.20 20:04:58 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Longbow Digital Arts [2011.08.07 01:04:36 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Magic Academy [2011.07.31 13:01:43 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Magic Academy 2 [2011.07.24 06:54:27 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\MagicIndie [2010.12.31 16:18:22 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Merscom [2011.08.22 02:51:51 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\My Games [2011.02.20 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Mystery of Mortlake Mansion [2011.07.24 03:15:39 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Mysteryville2 [2011.09.18 09:13:17 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\nHancer [2012.06.27 10:41:51 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Orneon [2012.06.27 12:29:53 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Phantasmat_bf_se1 [2011.09.18 09:09:42 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Philipp Winterberg [2011.08.01 07:25:09 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Pirateville [2012.06.26 11:17:34 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\PlayFavoriteGames [2011.07.31 05:54:14 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\PlayFirst [2010.11.07 12:51:34 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Polynomial [2012.08.13 08:07:59 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\PopCap Games [2012.03.18 01:04:51 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\PriceGong [2011.05.22 06:59:14 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Software4u [2012.10.21 18:08:13 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Specialbit [2012.06.22 03:50:19 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\SpinTop Games [2010.11.06 22:08:43 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Star Ruler [2010.11.01 10:21:28 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\streamripper [2012.06.26 11:37:22 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\TitanicMystery [2011.08.01 05:32:28 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Top Evidence [2012.11.27 20:52:31 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\TuneUp Software [2011.09.18 08:59:59 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\uTorrent [2011.07.31 12:37:39 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\VendelGAMES [2011.07.31 11:39:44 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\Vogat Interactive [2011.07.07 06:34:19 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\WindSolutions [2012.10.21 15:43:01 | 000,000,000 | ---D | M] -- C:\Users\cosmycfuture\AppData\Roaming\YoudaGames ========== Purity Check ========== ========== Files - Unicode (All) ========== [2011.06.02 20:04:40 | 000,000,246 | ---- | M] ()(C:\Users\cosmycfuture\Desktop\TEPCO ??????????.url) -- C:\Users\cosmycfuture\Desktop\TEPCO 福島第一原子力発電所.url [2011.06.02 20:04:40 | 000,000,246 | ---- | C] ()(C:\Users\cosmycfuture\Desktop\TEPCO ??????????.url) -- C:\Users\cosmycfuture\Desktop\TEPCO 福島第一原子力発電所.url ========== Alternate Data Streams ========== @Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:225CD7D5 @Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:E945C214 @Alternate Data Stream - 956 bytes -> C:\Users\cosmycfuture\Desktop\Lost Planet: Extreme Condition Trial.lnk @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:E32966C0 @Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:45E33ED2 @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:F7FFE8AF @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:5A9F1AE5 @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:319D783D @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:EBCF5924 @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A3857D86 @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:54380FEC @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:3F266659 @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:12D21A9A @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:63A71C6F @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:526B3022 @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:5025C6E4 @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0BBF232A @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:BE0654D6 @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:C6D0ABC3 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:75978481 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4C9782FB @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:3651A580 @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:BD34FFC5 @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:36FFA2FB @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:5E413CD6 @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:E14FA16F @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:943E8182 @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:6212DF7A @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:03A039A3 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:D3A82449 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:85376176 @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D88D995C @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:33E12B7A @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:EDC744FB @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:E83EE313 @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:61B54B15 @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:3539CD43 @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:C0893153 @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:74B9EA7F @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:3ABC38E6 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:7ADB695A @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:627153F1 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:551BED5F @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:FD20BDA6 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:EE69D7DF @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C9CDDE5E @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:95079543 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:14520962 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E2458802 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:D6D084A5 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:51E1A4D8 @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:3B812EE0 @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:2E636DD9 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:895A78C5 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:5520ED93 @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:E2CFA9CD @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C72A744C @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:FD000392 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A02025CE @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:61F0C8FB @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:1DEE6B65 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:EC0A74A1 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:9D06FB9C @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:943971F5 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:070D9534 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:7CA7BED1 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:5D351BC6 @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:E3B5F2D1 @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:2F6462DF @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C8E82994 @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:927EC486 @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:6E2D80C8 @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:0C5AF2AA @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:4FE30352 @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:A56D6987 @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:6C5EC3CD @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:409A775B @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:90D89144 @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:92A815D8 @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:C07A6A6B @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:523B97A0 @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:08D8BB20 < End of report > OTL Extras logfile created on: 28.11.2012 17:08:05 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\cosmycfuture\Documents 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 27,21% Memory free 5,99 Gb Paging File | 2,34 Gb Available in Paging File | 39,02% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 226,46 Gb Total Space | 129,47 Gb Free Space | 57,17% Space Free | Partition Type: NTFS Drive D: | 226,56 Gb Total Space | 226,44 Gb Free Space | 99,95% Space Free | Partition Type: NTFS Drive E: | 226,56 Gb Total Space | 225,34 Gb Free Space | 99,46% Space Free | Partition Type: NTFS Drive G: | 931,28 Gb Total Space | 908,95 Gb Free Space | 97,60% Space Free | Partition Type: FAT32 Computer Name: COSMYCFUTURE-PC | User Name: cosmycfuture | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = ChromeHTML] -- Reg Error: Key error. File not found .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS) Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\instProgramme\winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\instProgramme\winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\instProgramme\winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS) Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\instProgramme\winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\instProgramme\winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\instProgramme\winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1327979D-9FB2-4A96-AF33-9BFDEAAE1F6B}" = lport=2869 | protocol=6 | dir=in | app=system | "{28B9142D-2644-409F-B971-B6511B269137}" = lport=138 | protocol=17 | dir=in | app=system | "{39D62BB3-C79E-469A-A351-47F6DBBCA2B5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{41C1F092-1DC7-4A61-AB4B-5258C2DD1867}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{4A03E782-AE28-4647-929E-7E7DF5172E20}" = lport=139 | protocol=6 | dir=in | app=system | "{5AF368E3-0BBC-418C-B24E-482230ADFEA8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{5C82A41C-981C-454D-A16E-9249A9EC77BC}" = rport=138 | protocol=17 | dir=out | app=system | "{64D64250-6BDB-4A1D-973E-E9A3E0BBA83F}" = lport=445 | protocol=6 | dir=in | app=system | "{959A494A-3A6A-4B30-8604-53DA979B4F14}" = rport=139 | protocol=6 | dir=out | app=system | "{972F10D3-10D8-4678-9BDC-5C8CD0554DB6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{A509F7BB-C67E-470B-9433-D4F59F624897}" = lport=137 | protocol=17 | dir=in | app=system | "{B9DA502C-854E-4328-A4F7-2ECB5DBEE3B1}" = rport=137 | protocol=17 | dir=out | app=system | "{C75A6EE5-1C5F-4830-9D61-3DB021CAD677}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{DD609FDF-B1F6-4048-9F0F-0ED015869B7A}" = rport=445 | protocol=6 | dir=out | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00087CA8-B8BA-4077-A6FD-BB94990FE54B}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | "{0727775C-2401-46A2-9ED8-F93E895D59DA}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | "{0C6192DD-9CAC-4D6B-8A2D-DDDA09655E50}" = dir=in | app=c:\program files (x86)\finaltorrent\finaltorrent.exe | "{0FA862EC-A8ED-4137-9A45-FF0AB923C7AB}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{1C5125BD-9770-429D-8E3F-A24E749D78F6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{2870E78E-9FB9-4EC5-A63E-2D3D558AB90C}" = protocol=17 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | "{2F9D8D6E-9823-481F-9994-2EDA95C659F2}" = dir=in | app=c:\program files (x86)\finaltorrent\ftcheckforupdates.exe | "{34F00920-C6E4-4E68-AED0-B66DA06058D3}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | "{3638CB7F-33A4-41D1-873A-8A077FF391A6}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | "{3A4906C8-AE0D-4928-846E-D7C50A33D569}" = dir=in | app=c:\program files (x86)\finaltorrent\finaltorrent.exe | "{3AF58C8F-1056-41E6-A967-8C2DAB2A0B85}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbir.exe | "{3EB950C7-7F1F-441A-9961-29DD1801C2A8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{3F6A8F97-518E-4476-96DA-7FABD4D670E0}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp remote\bin\orb.exe | "{4271DFB8-7637-4C97-8DA6-EFB9F9CC035F}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbir.exe | "{4CA5796C-7ECB-4495-BEA4-708DC1C909B8}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp remote\bin\orb.exe | "{4CFD62B6-1BB1-4BD6-8B68-7B1E4B1EC646}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | "{50E63A01-2D65-4188-B021-E48B5637E215}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{538157E4-E341-4BBC-B987-8B95F28BAD03}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{58F99C56-3917-4A1F-993B-FB222BC14D25}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{5EC29C9E-4248-4841-AFB7-ECF0B9C84065}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{6C3F7D87-1D5C-4061-9534-A13D97EE9F33}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\microvolts\launcher.exe | "{7293A123-3D7D-42FB-AD06-E52D1406061B}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{768E7D9B-2ABF-473F-9C09-C5050ACFD22D}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | "{7C1C28CD-A6C8-4A8D-A40B-CF63A52B30BC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{8A59C55B-1E94-45EB-B594-AC2C69034B20}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbtray.exe | "{8F5D8B32-2E7F-4E06-922A-1396A6F23FB3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | "{98669383-44C7-4122-8B9D-8115F611BDAB}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbtray.exe | "{A0174DBA-F347-4C8A-9D2D-2C1539008060}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | "{A078F487-0FC8-4989-9976-B0A37F27DC4E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\microvolts\launcher.exe | "{A4D18507-1D2B-4324-A4BE-2F3213C15500}" = dir=in | app=c:\program files (x86)\finaltorrent\ftcheckforupdates.exe | "{B30EC898-C7C7-44DE-9292-8F2B13EFA20E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{B373B069-C320-43C6-9750-029F1ACF7DC5}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbstreamerclient.exe | "{B828DB72-B97B-40B6-A8FE-D27CA4BFFD22}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{C8868A67-558D-430C-A570-801A013D8AE4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{CA3BD56F-BFE9-457B-A9EB-67E60021CCE5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{CD1F8631-B763-4F00-9B82-767F1523FA3F}" = protocol=6 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | "{D7759672-A012-42C3-8368-282B37709A69}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{E34C4356-9A6A-4C0B-8552-A7D504C8C81A}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp remote\bin\orbstreamerclient.exe | "{E86ABF6E-9C9F-4F30-9D5C-A29D3967E71F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{F56D0B06-B383-4B26-8388-126CF2D08FF2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{F7E3926E-A005-4DF6-A631-FD8F78D70DCE}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "TCP Query User{0F832233-DF2B-41CE-AD3C-8825085C707C}F:\d-link.exe" = protocol=6 | dir=in | app=f:\d-link.exe | "TCP Query User{1B37A1C6-A8CC-4DA3-AF0A-87323061C39C}C:\program files (x86)\microsoft games\halo server\haloded.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo server\haloded.exe | "TCP Query User{1EE058B6-CEB8-4C7F-94B9-6D928962D2A1}C:\program files (x86)\imesh applications\imesh\imesh.exe" = protocol=6 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | "TCP Query User{53B4DA03-3EA5-4118-BE1F-46F1E216F5AA}F:\d-link.exe" = protocol=6 | dir=in | app=f:\d-link.exe | "TCP Query User{5B0284AB-7B16-40F0-9342-19763923442F}C:\windows\syswow64\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dpnsvr.exe | "TCP Query User{848E8B5F-806A-4C3B-A78C-75E7D70358D5}C:\program files (x86)\microsoft games\halo trial\halo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo trial\halo.exe | "TCP Query User{86C80B1D-09EC-4C3C-A40F-50A6CA4E8EC8}C:\users\cosmycfuture\appdata\local\temp\rar$ex47.392\f3.exe" = protocol=6 | dir=in | app=c:\users\cosmycfuture\appdata\local\temp\rar$ex47.392\f3.exe | "TCP Query User{883F4862-E172-4411-B4B2-94F141DC3C19}C:\users\cosmycfuture\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\cosmycfuture\appdata\local\akamai\netsession_win.exe | "TCP Query User{D88F520F-88F4-4015-AA75-BB41965F0748}C:\instprogramme\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\instprogramme\winamp\winamp.exe | "TCP Query User{EB118635-7968-43D8-BCCC-B7F8F0419C39}C:\program files (x86)\microsoft games\halo trial\halo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo trial\halo.exe | "TCP Query User{ECAD62A0-8789-403E-B965-9ED842F77980}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | "UDP Query User{2220E5D0-E99C-4303-BEED-3EE9F43F0675}C:\program files (x86)\microsoft games\halo trial\halo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo trial\halo.exe | "UDP Query User{2DD87233-0E34-46A8-9229-50566105C158}F:\d-link.exe" = protocol=17 | dir=in | app=f:\d-link.exe | "UDP Query User{50CF311C-3B45-4DC6-8696-6E62E4FCEA47}C:\program files (x86)\microsoft games\halo server\haloded.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo server\haloded.exe | "UDP Query User{57C7D899-578C-4415-AA8B-F28D1DC589DF}C:\program files (x86)\microsoft games\halo trial\halo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo trial\halo.exe | "UDP Query User{7C196FF6-5EAD-4EF3-B65F-5EDDA6D83111}C:\users\cosmycfuture\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\cosmycfuture\appdata\local\akamai\netsession_win.exe | "UDP Query User{9E7702E4-4B39-401A-9964-B40CB8BF9670}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | "UDP Query User{A9B557E9-805C-450C-BAA9-812FDFE5A8C8}F:\d-link.exe" = protocol=17 | dir=in | app=f:\d-link.exe | "UDP Query User{B0A503A4-BEDB-4317-AD6A-50737D2664E7}C:\windows\syswow64\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dpnsvr.exe | "UDP Query User{B43F8EAD-C2CD-4711-83CD-254A189AA40C}C:\instprogramme\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\instprogramme\winamp\winamp.exe | "UDP Query User{BA2E86D6-19E8-4CC8-A737-EA85C3656DAD}C:\users\cosmycfuture\appdata\local\temp\rar$ex47.392\f3.exe" = protocol=17 | dir=in | app=c:\users\cosmycfuture\appdata\local\temp\rar$ex47.392\f3.exe | "UDP Query User{EDB1B8C0-0D98-4AEA-A173-48058DBE72FB}C:\program files (x86)\imesh applications\imesh\imesh.exe" = protocol=17 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes "{17B77355-3934-4D0E-8FAC-C420482C8E7D}" = Windows Live Family Safety "{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables "{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java(TM) 6 Update 22 (64-bit) "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{4BC310C4-B898-46E2-B5FB-B85A30AA7142}" = iCloud "{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9B305FB9-297D-4F86-BC8B-740E7A1EF200}" = AVG 2013 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64 "{D2B1C10F-369B-40BC-B550-271F968C5EE0}" = Intel(R) Network Connections 17.3.63.0 "{DAD98ADA-0824-4946-98BB-0BDD03233398}" = AVG 2013 "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Adobe Flash Player ActiveX 64" = Adobe Flash Player 10 ActiveX 64-bit "AVG" = AVG 2013 "CCleaner" = CCleaner "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "PROSetDX" = Intel(R) Network Connections 17.3.63.0 "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software "SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "WinRAR archiver" = WinRAR 4.20 (64-Bit) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{05A10D05-8389-4CA2-963A-CA7C08AC2BD8}" = iPhone-Konfigurationsprogramm "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29 "{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{5508128A-2C7B-46B5-81F9-58E8E8115F0B}" = AdblockIE "{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync "{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support "{68BA90DE-424A-493E-B069-4EB33590C96C}" = Deaktivierungs-Add-on für Browser von Google Analytics "{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86) "{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX "{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update "{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}" = iMesh "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack "{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker "{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}" = IMinent Toolbar "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X - Deutsch "{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86) "{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update "{C71067FC-288F-4E0B-88C6-44DFDA8311E2}" = System Requirements Lab for Intel "{C792A75A-2A1F-4991-9B85-291745478A79}" = NetAssistant "{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime "{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials "{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}" = WinZip 15.0 "{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "65df6446db757f428ab8c929827ab03b" = Dynomite "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Shockwave Player" = Adobe Shockwave Player 11.6 "AVMFBox" = AVM FRITZ!Box Dokumentation "BFGC" = Big Fish Games: Game Manager "CursorFX" = CursorFX "DAEMON Tools Lite" = DAEMON Tools Lite "FinalTorrent_is1" = FinalTorrent 2011 "iMesh" = iMesh "iPhoneBackupExtractor" = iPhone Backup Extractor "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000 "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "OpenAL" = OpenAL "Orb" = Winamp Remote "PacSteamT" = PacSteamT "Smart PC Cleaner_is1" = Smart PC Cleaner v3.0 "Steam App 109400" = MicroVolts "Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer "Streamripper" = Streamripper (Remove only) "Trusted Software Assistant_is1" = File Type Assistant "VLC media player" = VLC media player 1.1.5 "Winamp" = Winamp "Winamp Toolbar" = Winamp Toolbar "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR 4.20 (32-Bit) ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Akamai" = Akamai NetSession Interface "CopyTrans Suite" = Nur Deinstallierung der CopyTrans Suite möglich. "NetAssistant 3.8.3" = Freeze.com NetAssistant "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 27.08.2012 18:30:47 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842832 Description = Fehler beim Generieren des Aktivierungskontexts für "c:\instprogramme\SoftonicDownloader_fuer_freemusic.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest. Error - 27.08.2012 18:31:01 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 27.08.2012 18:31:14 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842811 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll" in Zeile 2. Ungültige XML-Syntax. Error - 28.08.2012 01:14:13 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 28.08.2012 02:54:19 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 28.08.2012 02:57:43 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 28.08.2012 03:33:27 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 28.08.2012 17:10:07 | Computer Name = cosmycfuture-PC | Source = SideBySide | ID = 16842787 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 28.08.2012 17:13:04 | Computer Name = cosmycfuture-PC | Source = Software Protection Platform Service | ID = 8200 Description = Lizenzerwerb-Fehlerdetails. hr=0x80072EE7 Error - 28.08.2012 17:13:04 | Computer Name = cosmycfuture-PC | Source = Software Protection Platform Service | ID = 8208 Description = Fehler bei der Erfassung des authentischen Tickets (hr=0x80072EE7) für die Vorlagen-ID 66c92734-d682-4d71-983e-d6ec3f16059f. [ System Events ] Error - 27.11.2012 15:52:22 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 27.11.2012 15:52:22 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 27.11.2012 15:52:23 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7001 Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error - 27.11.2012 15:52:59 | Computer Name = cosmycfuture-PC | Source = DCOM | ID = 10010 Description = Error - 27.11.2012 15:54:02 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7006 Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error - 27.11.2012 15:54:08 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7006 Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error - 27.11.2012 21:06:42 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7006 Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error - 27.11.2012 21:06:44 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7016 Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen Status gemeldet: 32 Error - 27.11.2012 21:07:55 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7006 Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error - 27.11.2012 21:07:57 | Computer Name = cosmycfuture-PC | Source = Service Control Manager | ID = 7006 Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: %%5 < End of report > |
:hallo: Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich. Dürfen wir das Logfile von Malwarebytes auch sehen? |
OK, sorry das hab ich in der Aufregung vergessen. Ich poste jetze erst mal nur das erste logfile, wenn du alle haben willst, kriegste och alle. Kurz ein paar infos zu meinem Verdacht wo ich mir das eingefangen habe: eine mail vom Kabelanbieter, zur Kenntnisnahme das die online-Rechnung bereit steht. Diese sah diesmal komisch ander aus und das login funktionierte auch nicht. Bin dann über die Internetwebside ins Kundencenter und da funktionierte das login. Die Mail würde ich dir gern schicken, aber ich weiß nicht wie ich eine Mail mit 7zip verpacke. Entpacken krieg ich noch hin. Eine andere Möglichkeit: Ich habe in der Suchmaschine budapester vierloch schuheeingegeben und dann auf Bilder geklickt um nach einem bestellten und in Vorkasse bezahlten Artikel zu suchen . Lange rede kurzer Sinn bevor ich mich hier in belangloses Zeug verliere: Hier das erste log. Malwarebytes Anti-Malware (Test) 1.65.1.1000 Malwarebytes : Free anti-malware download Datenbank Version: v2012.11.27.11 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 cosmycfuture :: COSMYCFUTURE-PC [Administrator] Schutz: Aktiviert 27.11.2012 21:00:16 mbam-log-2012-11-27 (21-00-16).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 307749 Laufzeit: 47 Minute(n), 42 Sekunde(n) Infizierte Speicherprozesse: 1 C:\ProgramData\0C2C49979E3AC35600000C2C3D76CEC4\0C2C49979E3AC35600000C2C3D76CEC4.exe (Trojan.FakeAlert.SSGen) -> 2160 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 11 HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Progressive Protection (Trojan.FakeAlert.SSGen) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\clickpotatolitesa (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|0C2C49979E3AC35600000C2C3D76CEC4 (Trojan.FakeAlert.SSGen) -> Daten: C:\ProgramData\0C2C49979E3AC35600000C2C3D76CEC4\0C2C49979E3AC35600000C2C3D76CEC4.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Daten: C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox\extensions -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 9 C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox\extensions (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox\extensions\plugins (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\QuestBrwSearch (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 11 C:\instProgramme\SoftonicDownloader_fuer_freemusic.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox\extensions\plugins\npclntax_ClickPotatoLiteSA.dll (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\cosmycfuture\Desktop\System Progressive Protection.lnk (Rogue.SystemProgressiveProtection) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\0C2C49979E3AC35600000C2C3D76CEC4\0C2C49979E3AC35600000C2C3D76CEC4.exe (Trojan.FakeAlert.SSGen) -> Löschen bei Neustart. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_hpk.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\ClickPotatoLite\bin\10.0.666.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
Nein so ein Email will ich gar nicht. Und für die Zukunft: Klicke nicht irgendwo hin nur weil es bunt ist oder seriös aussieht! Schritt 1: AdwCleaner: Werbeprogramme suchen und löschen Schritt 2: Scan mit DDS (+ attach) Downloade dir bitte DDS (von sUBs) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop. |
Hallo ryder, der Schritt mit adwcleaner hat geklappt. Hab eben die Entdeckung gemacht, daß ich eine Anwendung mor.exe habe, die ich nicht zuordnen kann und google und das Trojanerboard sagen mir daß es ein Trojaner ist.son schiet. Soderle. Anbei die logs dds und attach: [CODE]. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT .DDS Logfile: Code: DDS (Ver_2012-11-20.01)Code: DDS (Ver_2012-11-20.01) - NTFS_AMD64 |
Dann bitte Combofix ausführen: Scan mit Combofix
|
Ok hier das log von combofix Code: ComboFix 12-12-01.01 - cosmycfuture 01.12.2012 18:30:56.1.4 - x64 |
Gut! :daumenhoc Wir müssen jetzt noch ein paar Kontrollen machen. Schritt 1: Quick-Scan mit Malwarebytes Schritt 2: ESET Online Scanner Zitat:
Schritt 3: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck |
guten morgen Code: Malwarebytes Anti-Malware (Test) 1.65.1.1000Code: C:\Program Files (x86)\Smart PC Cleaner\SmartPCCleaner.exe a variant of Win32/SpeedingUpMyPC applicationgute nacht und:dankeschoen: guten morgen ryder Schritt 3 macht Probleme,vermutlich weil ich erst versuchte, die älteren Java-Versionen zu deinstallieren. Eine davon weigert sich. Habe dann einen Wiederherstellungspunkt vom 1.12. aktiviert und jetzt security.check ausgeführt. Aber: Im Infobereich der Taskleiste Symbole und Benachrichtigungen befindet sich immer noch die Anwendung "mor.exe" allerdings ohne Symbol. Code: Results of screen317's Security Check version 0.99.56 |
Zitat:
|
Tut mir leid einen Fehler gemacht zu haben. Ich habe kein Problem damit alle Schritte von Anfang an nochmal zu wiederholen, jetze wo ich sowieso schon eine Menge interessanter Arbeit habe.Bis zur endgültigen Kapitulation (Formartieren aller Festplatten)habe ich noch eine Menge Geduld.:killpc: Nachtrag:Bei dem ganzen Prozedere habe ich eine weitere externe Festplatte übersehen. Dort wurde soeben backdoor ircbotHRK gefunden, da steckt vermutlich noch mehr. |
Wie hast du das gefunden und wo ist das Logfile dazu? |
Während Avast Antivirus free lief, meldete AVG folgende Bedrohungen: backdoor ircbot HRK Adware:Generic3.FKK(davon sehr viele mit jeweils anderen Kennzahlen) AVG bot mir entfernen oder ignorieren an, ich entschied mich für entfernen,leider. Ich kann das log von AVG nicht finden bzw ich weiß nicht wo ich suchen soll und ja ich bin(noch) ein DAU. sorry. jetzt läuft bzw pausiert wegen eben dieser Antwort nochmal malewarebytes antimaleware komplett auf sämtlichen Partitionen und externen festplatten, das wird einige Stunden dauern. |
Warum läuft Avast, wenn du AVG installiert hast? |
AVG hat viel Werbung und Kaufaufforderungen,die mich irritieren und zur Nutzung abschrecken,deshalb startete ich Avast ohne daran gedacht zu haben AVG zu deaktivieren.:headbang: |
Warnung: Mehrere Anti-Virus-Programme Dann deinstalliere AVG und konfiguriere Avast laut Anleitung: http://www.trojaner-board.de/127580-...igurieren.html Schritt 1: Windows 7 Service Pack 1 installieren
Schritt 2: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Update: Adobe Flash Player
Scan mit SecurityCheck Downloade Dir bitte SecurityCheck: LINK1 LINK2Schritt 6: Du machst jetzt nur noch wozu du aufgefordert wurdest! |
Frage: Nachdem AVG deinstalliert und seine Überreste mit AVG removable 64bit entfernt wurden folgende Frage: Ich kann die neueste Java Version nur downloaden, mir wird keine Option jxpiinstall.exe zu speichern geboten, ist diese Anwendung das Programm selbst? Was mache ich wenn es Probleme mit dem Entfernen der alten Java Versionen gibt? |
|
Ja das Windows 7 Service Pack 1 hab ich schon heute mittag installiert |
Gut, wo ist dann genau das Problem mit Java? Hast du den Offline-Installer probiert? http://javadl.sun.com/webapps/downlo...BundleId=69474 |
Beim Versuch Java(TM)6Update29zu deinstallieren erscheint folgende Fehlermeldung Code: Es liegt ein in diesem Windows Installer Paket betreffendes Problem vor.Eine für den Abschluss der Installation erforderliche DLL konnte nicht ausgeführt werden.Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. |
OKay da kommen wir evtl später noch drauf zurück. Die restlichen Schritte noch bitte. |
OK. Code: Results of screen317's Security Check version 0.99.56 |
OK, dann entferne noch den Smat PC Cleaner und dann wären wir soweit fertig. Was das Java 6 entfernen angeht, bitte ich dich ein eigenes Thema in "Rund um Windows" aufzumachen. Prima! :daumenhoc Damit wären wir fertig. Wir räumen jetzt noch ein wenig auf und dann habe ich am Ende etwas Lesestoff für dich. Schritt 1: Tools deinstallieren
Schritt 2: ESET deinstallieren (Optional) Abschließend noch Tipps zu folgenden Themen:
Damit wünsche ich dir noch viel Spaß beim Surfen im Internet :daumenhoc ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Eine Bitte: Gib mir eine kurze Rückmeldung, wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann. |
Zitat:
Tausendmal Danke für deine Mühe und Geduld. und ja ich möchte eine Unterstützung leisten, gibts dafür einen Beleg fürs Finanzamt?:stirn: |
Bitte meinen Schritt 1 beachten! Ich denke wenn du per Paypal spendest bekommst du ein Email über die Zahlung, das könntest du ausdrucken. Dein Rechner hat jetzt zumindest keinen Schädling mehr, den ich sehen kann. |
alles klar. was ist mit mor.exe? die ist immer noch da aber nicht aktiv, siehe screenshot Code: hxxp://s7.directupload.net/file/d/3092/jw8l26dm_png.htm |
Dann müssen wir nochmal schauen: Customscan mit OTL
|
okAnhang 47133 da die otl log datei zu groß ist muss ich das Handtuch schmeissen:heulen: |
|
Also da ist erstmal nichts zu sehen woher das kommen soll ... Fix mit OTL
Ich vermute, dass es einfach ein Überbleibsel ist. Du weißt ja schliesslich auch, dass man in so einer Bererinigung nicht immer alles komplett entfernen kann. Aber solange es inaktiv ist, sollte es ja kein Problem sein. Wenn es dich sehr Stört könnte man nochmal explizit danach suchen. Was sagst du? |
Zitat:
Code: All processes killed |
Dann schaun wir mal: Customscan mit OTL
|
Ich schreib mal vom tablet Sorry fürs zu spät kommem(Mittagschicht)kann es sein das OTL sich aufgehängt hat? In der Leiste unten die anzeigt wo der Scan gerade ist, wenn man schnell genug lesen kann, steht seit einigen Minuten.Abwarten? OK OTL hat sich immer wieder aufgehängt, habe ihn dann ein allerletztes mal ohne das kopierte Fix laufen lassen und den Infobereich der Taskleiste kontrolliert. Diese beiden unerwünschten Objekte sind verschwunden, visuell. OTL Teil1 OTL logfile created on: 05.12.2012 01:38:40 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\cosmycfuture\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,56 Gb Available Physical Memory | 52,14% Memory free 5,99 Gb Paging File | 4,54 Gb Available in Paging File | 75,75% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 226,46 Gb Total Space | 133,23 Gb Free Space | 58,83% Space Free | Partition Type: NTFS Drive D: | 226,56 Gb Total Space | 226,44 Gb Free Space | 99,95% Space Free | Partition Type: NTFS Drive E: | 226,56 Gb Total Space | 226,44 Gb Free Space | 99,95% Space Free | Partition Type: NTFS Drive G: | 931,28 Gb Total Space | 908,95 Gb Free Space | 97,60% Space Free | Partition Type: FAT32 Drive M: | 20,00 Gb Total Space | 10,28 Gb Free Space | 51,40% Space Free | Partition Type: NTFS Drive N: | 54,53 Gb Total Space | 44,05 Gb Free Space | 80,79% Space Free | Partition Type: NTFS Computer Name: COSMYCFUTURE-PC | User Name: cosmycfuture | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\cosmycfuture\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) PRC - C:\instProgramme\winamp\winampa.exe (Nullsoft, Inc.) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () ========== Services (SafeList) ========== SRV:64bit: - (Intel(R) -- C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6232e.sys (Intel Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (61883) -- C:\Windows\SysNative\drivers\61883.sys (Microsoft Corporation) DRV:64bit: - (Avc) -- C:\Windows\SysNative\drivers\avc.sys (Microsoft Corporation) DRV:64bit: - (MSDV) -- C:\Windows\SysNative\drivers\msdv.sys (Microsoft Corporation) DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (Ph3xIB64) -- C:\Windows\SysNative\drivers\Ph3xIB64.sys (NXP Semiconductors) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (XUIF) -- C:\Windows\SysNative\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0E 07 EA C3 F6 6D CB 01 [binary data] IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found IE - HKCU\..\URLSearchHook: {77f8c945-4b74-4bd6-a073-e0d1997edce8} - No CLSID value found IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No CLSID value found IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {DB261C6D-D7C6-413E-A244-DA9C1B015D42} IE - HKCU\..\SearchScopes\{D3167839-45DB-48E0-9057-BF7B901DE9E3}: "URL" = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120311,16987,0,8,0 IE - HKCU\..\SearchScopes\{DB261C6D-D7C6-413E-A244-DA9C1B015D42}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\instProgramme\bin\new_plugin\npjp2.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) [2012.05.05 18:02:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cosmycfuture\AppData\Roaming\mozilla\Firefox\Profiles\extensions ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: Google CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\instProgramme\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\instProgramme\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\instProgramme\bin\new_plugin\npjp2.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - Extension: YouTube = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: Google-Suche = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\ CHR - Extension: Google Mail = C:\Users\cosmycfuture\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\instProgramme\bin\jp2ssv.dll File not found O2 - BHO: (Deaktivierungs-Add-on für Browser von Google Analytics) - {75EF13CE-B59E-41ba-8A5A-A944031BD8B4} - C:\Program Files (x86)\Google\Google Analytics Opt-Out\gaoptout.dll (Google, Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [WinampAgent] C:\instProgramme\winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKCU..\Run: [Orb] C:\Program Files (x86)\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html File not found O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///K:/Programme/Mysteryville%202/Images/stg_drm.ocx (SpinTop DRM Control) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab (Battlefield Play4Free Updater) O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 10.9.2) O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///K:/Programme/Mysteryville%202/Images/armhelper.ocx (ArmHelper Control) O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.9.0.cab (SysInfo Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0157D32E-E455-4321-8FB6-59490FC0D4A3}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BB4E5B48-EE3E-4D95-925E-1EA3CEAC29BE}: DhcpNameServer = 139.7.30.125 139.7.30.126 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.03.10 14:31:18 | 000,000,000 | ---- | M] () - M:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{b6633804-1585-11e0-be48-001d9272add9}\Shell - "" = AutoRun O33 - MountPoints2\{b6633804-1585-11e0-be48-001d9272add9}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.04 11:21:46 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys [2012.12.04 11:21:46 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll [2012.12.04 11:19:35 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll [2012.12.04 11:19:33 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll [2012.12.04 11:19:33 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe [2012.12.04 11:19:33 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll [2012.12.04 10:35:45 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll [2012.12.04 10:35:41 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll [2012.12.04 10:35:41 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll [2012.12.04 10:35:41 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll [2012.12.04 10:35:31 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll [2012.12.04 10:35:26 | 002,315,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll [2012.12.04 10:35:26 | 002,223,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll [2012.12.04 10:35:25 | 001,401,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll [2012.12.04 10:35:25 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe [2012.12.04 10:35:24 | 001,549,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll [2012.12.04 10:35:24 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll [2012.12.04 10:35:24 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll [2012.12.04 10:35:23 | 000,778,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll [2012.12.04 10:35:23 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll [2012.12.04 10:35:23 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll [2012.12.04 10:35:23 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe [2012.12.04 10:35:22 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll [2012.12.04 10:35:22 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll [2012.12.04 10:35:21 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl [2012.12.04 10:35:20 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl [2012.12.04 10:35:11 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.12.04 10:35:11 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.12.04 10:35:10 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.12.04 10:35:10 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.12.04 10:35:08 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.12.04 10:35:08 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.12.04 10:35:07 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.12.04 10:35:07 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.12.04 10:35:06 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.12.04 10:35:06 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.12.04 10:35:06 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.12.04 10:35:06 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.12.04 10:35:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.04 10:35:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.12.04 10:35:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.12.04 10:35:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.12.04 10:35:04 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.12.04 10:35:04 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.12.04 10:35:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.12.04 10:35:03 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.12.04 10:34:59 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.12.04 10:34:59 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.12.04 10:34:59 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.12.04 10:34:59 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.12.04 10:34:59 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.12.04 10:34:59 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.12.04 10:34:59 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.12.04 10:34:59 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.12.04 10:34:57 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.12.04 10:34:47 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys [2012.12.04 10:34:45 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2012.12.04 10:34:39 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys [2012.12.04 10:34:39 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll [2012.12.04 10:34:39 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll [2012.12.04 10:34:38 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS [2012.12.04 10:34:38 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll [2012.12.04 10:34:38 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll [2012.12.04 10:34:38 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll [2012.12.04 10:34:38 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll [2012.12.04 10:34:32 | 000,027,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys [2012.12.04 10:34:29 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe [2012.12.04 10:34:05 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll [2012.12.04 10:33:52 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll [2012.12.04 10:33:41 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll [2012.12.04 10:33:28 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2012.12.04 10:33:27 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2012.12.04 10:33:25 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe Teil 2 Code: [2012.12.03 06:36:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BINCode: [2012.12.02 10:44:28 | 000,372,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rastls.dll |
Teil 4 Code: [2012.12.02 10:44:14 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ftp.exeCode: [2012.12.02 10:43:58 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mapistub.dllCode: |
Das sieht nicht so aus, als ob das richtig durchgeführt worden wäre. Bitte wiederholen. |
Frage:Wie lange soll ich warten wenn ich das Gefühl habe,daß sich customscan aufgehängt hat? |
Länger als 30 MInuten sollte es nicht gehen. Evtl hab ich da auch nen kleinen Fehler eingebaut, probiere alternativ das hier: Code: mor.exe /RS |
Nix zu machen, ryder. OTL bleibt für immer an denselben Registrierungsschlüssel stehen: HKEYLOCALMASHINE\software\microsoft\windowsNT\Current\Version\Perflib\007\Help aktuelle logdatei malewarebytes Code: Malwarebytes Anti-Malware (Test) 1.65.1.1000 |
Ja wie gesagt, du bist soweit sauber. Da sind eben nur noch inaktive Überreste. Um die zu finden müssen wir halt eben suchen. Willst du das immer noch? |
Auf jeden Fall! Eine Formatierung aller Laufwerke ist wie eine Kapitulation. Sowas muss man doch zu packen kriegen.:glaskugel2: Im InfobereichSymbole befindet sich dreimal die Option objlist.exe.Zweimal ohne Symbol und einmal mit dem Symbol Hardware sicher entfernen Mein Gefühl sagt mir, daß das eine Tarnung ist. Malewarebytes gab heute folgende Fehlermeldung: Aktion fehlgeschlagen. Fehlercode 108 |
Irgendwann ist aber auch so, dass man die Zeit besser anders investiert hätte und eine vollkommene Sicherheit erhälst du NIE zurück. Scan mit SystemLook Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
|
Zitat:
Schlaf gut.:kaffee: |
Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist |
ich starte gleich systemlook dann sind wir bestimmt fertig soderle. nix gefunden ryder. Ich denke wir können uns trennen. Recht herzlichen Dank für deine Geduld und Mühe und fröhliche Weihnachten:taenzer: Code: SystemLook 30.07.11 by jpshortstuff |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 00:23 Uhr. |
Copyright ©2000-2025, Trojaner-Board