Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   internet explorer öffnet sich von selbst - welches programm muss weg? (https://www.trojaner-board.de/86868-internet-explorer-oeffnet-selbst-welches-programm-weg.html)

M.C.rezi 08.06.2010 17:00
internet explorer öffnet sich von selbst - welches programm muss weg?
 
Hi Leute
Seit ein paar Tagen öffnet sich mein internet explorer von alleine. Es ist immer die selbe Seite : www.raise-inc.com Kurz bevor ich die Seite sehe schliest sich der internet explorer und öffnet sich wieder. Hier ist der scan von hijack:

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\m.c.rezi\Desktop\HiJackThis204.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ATI Drivers] C:\Users\m.c.rezi\AppData\Local\ATI Drivers\ATI_graphics.exe
O4 - HKCU\..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe
O4 - HKCU\..\Run: [Sound Settings Service] C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
O4 - HKCU\..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe
O4 - HKCU\..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
O4 - HKCU\..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

was muss ich fxen?
danke im vorraus
M.C.rezi

markusg 08.06.2010 17:18
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "run Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
eventuell musst du die auf 2 oder mehr beiträge aufteilen.

M.C.rezi 09.06.2010 13:11
ich habe jetzt beide reports
OTL:
OTL Logfile:
Code:
OTL logfile created on: 09.06.2010 13:59:27 - Run 1
OTL by OldTimer - Version 3.2.5.3    Folder = C:\Users\m.c.rezi\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 18,13 Gb Free Space | 18,57% Space Free | Partition Type: NTFS
Drive D: | 135,23 Gb Total Space | 133,92 Gb Free Space | 99,03% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MCREZI-PC
Current User Name: m.c.rezi
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\m.c.rezi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\m.c.rezi\AppData\Roaming\sounds.exe (FLaEqrMsDkv)
PRC - C:\Users\m.c.rezi\AppData\Local\Temp\AutoStart.exe ()
PRC - C:\Users\m.c.rezi\AppData\Local\ATI Drivers\ATI_graphics.exe (Microsoft)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\m.c.rezi\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (vncmirror) -- C:\Windows\System32\drivers\vncmirror.sys (RealVNC Ltd.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (CAM1210) -- C:\Windows\System32\drivers\cam1210.sys (USB video camera)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}:1.0.0.1
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.19.1
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.02 15:50:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.21 17:28:41 | 000,000,000 | ---D | M]
 
[2009.12.03 17:12:22 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\mozilla\Extensions
[2010.06.08 18:00:34 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\mozilla\Firefox\Profiles\eomakf88.default\extensions
[2009.12.09 16:40:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\m.c.rezi\AppData\Roaming\mozilla\Firefox\Profiles\eomakf88.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.05.29 14:05:25 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\mozilla\Firefox\Profiles\eomakf88.default\extensions\foxyproxy@eric.h.jung
[2009.12.03 17:17:27 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.03.30 12:57:04 | 000,098,304 | ---- | M] (NHN USA Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2010.01.10 13:22:03 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.10 13:22:03 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.10 13:22:03 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.10 13:22:03 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.10 13:22:03 | 000,000,801 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [ATI Drivers] C:\Users\m.c.rezi\AppData\Local\ATI Drivers\ATI_graphics.exe (Microsoft)
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe ()
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe File not found
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe File not found
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe (An)
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Sound Settings Service] C:\Users\m.c.rezi\AppData\Roaming\sounds.exe (FLaEqrMsDkv)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\system32\default\msnmsgr.exe File not found
O7 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\system32\default\msnmsgr.exe File not found
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2006.11.02 13:18:47 | 000,000,000 | ---D | M]
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk - C:\PROGRA~1\GAMERS~1\LIVE!\Live.exe - File not found
MsConfig - StartUpFolder: C:^Users^m.c.rezi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe - (LogMeIn Inc.)
MsConfig - StartUpReg: AdobeCS4ServiceManager - hkey= - key= - C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe File not found
MsConfig - StartUpReg: BitTorrent DNA - hkey= - key= - C:\Users\m.c.rezi\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
MsConfig - StartUpReg: bZE165UrdWubConcffD - hkey= - key= - C:\Windows\system\sounds.exe File not found
MsConfig - StartUpReg: G7yARTVYT2FHoHsb0 - hkey= - key= - C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe (An)
MsConfig - StartUpReg: HKLM - hkey= - key= -  File not found
MsConfig - StartUpReg: Intel Pro Motherboard - hkey= - key= - C:\Users\m.c.rezi\AppData\Local\Intel Pro\inetl_pro_wireless.exe (Microsoft)
MsConfig - StartUpReg: LK4Verx5FJxOvJr7n - hkey= - key= - C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe (An)
MsConfig - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe File not found
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe File not found
MsConfig - StartUpReg: Pando Media Booster - hkey= - key= - C:\Program Files\Pando Networks\Media Booster\PMB.exe File not found
MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: WaitingDog - hkey= - key= - C:\Windows\StiD1210.exe ()
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A7A80813-4A83-C3F7-5083-F65B8E5F55E6} - Browser Customizations
ActiveX: {B0C56C22-305A-6B04-5821-45C57CD7DC34} - Microsoft Windows Media Player 11.0
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {W41680AS-73V3-T2GP-813Q-552YY6C5SP8C} - C:\Windows\system32\default\msnmsgr.exe Restart
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.09 13:57:12 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Users\m.c.rezi\Desktop\OTL.exe
[2010.06.08 16:46:03 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\fish digga
[2010.06.06 16:05:17 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\easy
[2010.06.04 15:27:00 | 000,247,808 | ---- | C] (Unfair-Gamers.com) -- C:\Users\m.c.rezi\Desktop\[UG] M2 MultiHack v8.0.exe
[2010.06.04 14:37:07 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.06.02 17:57:32 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\kev OMG
[2010.06.02 15:49:48 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\Dope Life
[2010.06.01 14:41:13 | 000,368,640 | -H-- | C] (FLaEqrMsDkv) -- C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
[2010.05.29 16:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\Metin2
[2010.05.29 14:24:24 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\Showtek - Analogue Players In A Digital World (2009)
[2010.05.27 15:10:28 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\cnc cheated
[2010.05.26 12:01:13 | 1022,490,237 | ---- | C] (Nexon) -- C:\Users\m.c.rezi\Combatarms_eu.exe
[2010.05.25 12:45:45 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\EA Games
[2010.05.25 12:42:48 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\bilder
[2010.05.24 14:19:07 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\AppData\Roaming\Teeworlds
[2010.05.24 14:18:56 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Desktop\teeworlds-0.5.2-win32
[2010.05.24 12:49:22 | 000,409,600 | -HS- | C] (An) -- C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
[2010.05.24 12:34:35 | 000,000,000 | ---D | C] -- C:\Program Files\CheatTS
[2010.05.21 17:28:42 | 000,147,456 | ---- | C] (TODO: <Company name>) -- C:\Windows\System32\uc_neosteam_launching.dll
[2010.05.20 15:58:36 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\{07a1437c-b21e-454e-818d-f58cfad887b3}
[2010.05.20 15:51:53 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung
[2010.05.20 14:47:07 | 000,000,000 | RHSD | C] -- C:\Users\m.c.rezi\AppData\Local\Intel Pro
[2010.05.20 14:46:18 | 000,000,000 | RHSD | C] -- C:\Users\m.c.rezi\AppData\Local\ATI Drivers
[2010.05.20 14:20:34 | 000,000,000 | ---D | C] -- C:\Program Files\Jens Lorek
[2010.05.19 15:58:24 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\m.c.rezi\Desktop\HiJackThis204.exe
[2010.05.18 14:01:30 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\Application Data
[2010.05.18 13:53:51 | 000,000,000 | ---D | C] -- C:\Users\m.c.rezi\AppData\Roaming\install
[2010.05.16 13:57:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2009.11.10 19:57:44 | 000,315,392 | ---- | C] ( ) -- C:\Windows\System32\sbcrreag.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.09 13:58:00 | 002,097,152 | -HS- | M] () -- C:\Users\m.c.rezi\NTUSER.DAT
[2010.06.09 13:57:15 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\m.c.rezi\Desktop\OTL.exe
[2010.06.09 13:56:28 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.06.09 13:56:21 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.06.09 13:56:20 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.06.09 13:56:18 | 000,022,783 | ---- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\data.dat
[2010.06.09 13:55:55 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.09 13:55:55 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.09 13:55:53 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.09 13:55:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.09 13:55:39 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.08 17:53:27 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat
[2010.06.08 17:53:18 | 000,002,339 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.06.08 17:45:08 | 000,101,346 | -H-- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\cglogs.dat
[2010.06.08 17:38:53 | 000,109,310 | ---- | M] () -- C:\Users\m.c.rezi\0608_173252.jpg
[2010.06.08 17:14:41 | 000,131,984 | ---- | M] () -- C:\Users\m.c.rezi\Heiratsantrag.jpg
[2010.06.08 17:02:02 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.06.08 16:55:43 | 000,083,923 | ---- | M] () -- C:\Users\m.c.rezi\0608_164912.jpg
[2010.06.08 16:45:15 | 001,102,615 | ---- | M] () -- C:\Users\m.c.rezi\Desktop\M2Fish 2.6.zip
[2010.06.07 13:59:09 | 002,156,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.06.05 17:19:00 | 000,000,552 | ---- | M] () -- C:\Users\m.c.rezi\AppData\Local\d3d8caps.dat
[2010.06.04 15:26:51 | 000,105,895 | ---- | M] () -- C:\Users\m.c.rezi\[UG] M2 MultiHack v8.0.rar
[2010.06.02 16:20:56 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\m.c.rezi\Desktop\HiJackThis204.exe
[2010.06.01 14:41:14 | 000,368,640 | -H-- | M] (FLaEqrMsDkv) -- C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
[2010.05.29 16:45:39 | 000,000,736 | ---- | M] () -- C:\Users\Public\Desktop\Metin2.lnk
[2010.05.29 14:02:37 | 000,641,106 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.05.29 14:02:37 | 000,609,944 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.05.29 14:02:37 | 000,116,500 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.05.29 14:02:37 | 000,103,726 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.29 14:02:36 | 001,461,736 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.05.26 12:07:24 | 000,001,578 | ---- | M] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk
[2010.05.26 12:01:13 | 1022,490,237 | ---- | M] (Nexon) -- C:\Users\m.c.rezi\Combatarms_eu.exe
[2010.05.26 11:42:08 | 000,421,888 | ---- | M] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe
[2010.05.24 12:49:19 | 000,409,600 | -HS- | M] (An) -- C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
[2010.05.24 12:32:49 | 000,290,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2010.05.24 12:32:48 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2010.05.23 23:50:30 | 000,247,808 | ---- | M] (Unfair-Gamers.com) -- C:\Users\m.c.rezi\Desktop\[UG] M2 MultiHack v8.0.exe
[2010.05.21 17:31:54 | 000,000,299 | -H-- | M] () -- C:\Users\m.c.rezi\Desktop\U_AVA_Setup.exe.bfi
[2010.05.21 17:28:44 | 000,001,762 | ---- | M] () -- C:\Users\Public\Desktop\ijji REACTOR.lnk
[2010.05.21 17:21:14 | 000,000,000 | ---- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\chrtmp
[2010.05.20 16:24:14 | 000,001,567 | ---- | M] () -- C:\Users\m.c.rezi\Physik.rtf
[2010.05.20 16:02:29 | 000,000,000 | ---- | M] () -- C:\ProgramData\LauncherAccess.dt
[2010.05.19 16:36:05 | 020,854,188 | ---- | M] () -- C:\Users\m.c.rezi\Mod Downloader by salihman.rar
[2010.05.12 11:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2010.06.09 13:55:39 | 3220,627,456 | -HS- | C] () -- C:\hiberfil.sys
[2010.06.08 17:57:43 | 000,003,891 | ---- | C] () -- C:\Users\m.c.rezi\hijackthis.log
[2010.06.08 17:53:27 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.06.08 17:32:52 | 000,109,310 | ---- | C] () -- C:\Users\m.c.rezi\0608_173252.jpg
[2010.06.08 17:14:30 | 000,131,984 | ---- | C] () -- C:\Users\m.c.rezi\Heiratsantrag.jpg
[2010.06.08 16:49:12 | 000,083,923 | ---- | C] () -- C:\Users\m.c.rezi\0608_164912.jpg
[2010.06.08 16:44:00 | 001,102,615 | ---- | C] () -- C:\Users\m.c.rezi\Desktop\M2Fish 2.6.zip
[2010.06.05 17:19:00 | 000,000,552 | ---- | C] () -- C:\Users\m.c.rezi\AppData\Local\d3d8caps.dat
[2010.06.04 15:26:31 | 000,105,895 | ---- | C] () -- C:\Users\m.c.rezi\[UG] M2 MultiHack v8.0.rar
[2010.06.01 14:41:48 | 000,022,783 | ---- | C] () -- C:\Users\m.c.rezi\AppData\Roaming\data.dat
[2010.05.29 16:45:39 | 000,000,736 | ---- | C] () -- C:\Users\Public\Desktop\Metin2.lnk
[2010.05.26 12:07:24 | 000,001,578 | ---- | C] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk
[2010.05.21 17:28:44 | 000,001,762 | ---- | C] () -- C:\Users\Public\Desktop\ijji REACTOR.lnk
[2010.05.21 17:28:42 | 000,009,728 | ---- | C] () -- C:\Windows\System32\uc_karos_launching.dll
[2010.05.21 17:21:14 | 000,000,000 | ---- | C] () -- C:\Users\m.c.rezi\AppData\Roaming\chrtmp
[2010.05.20 16:07:14 | 000,001,567 | ---- | C] () -- C:\Users\m.c.rezi\Physik.rtf
[2010.05.20 15:58:21 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2010.05.20 15:52:32 | 000,000,766 | ---- | C] () -- C:\Windows\System32\Uninstall.ico
[2010.05.20 15:52:20 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010.05.19 16:26:26 | 020,854,188 | ---- | C] () -- C:\Users\m.c.rezi\Mod Downloader by salihman.rar
[2010.05.18 16:35:37 | 005,640,938 | ---- | C] () -- C:\Users\m.c.rezi\GUNS_T_PV_MELEE.rez
[2010.05.16 13:57:34 | 000,001,100 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.16 13:57:31 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.03.11 17:51:37 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.02.27 14:40:04 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.01.02 13:37:22 | 000,020,480 | ---- | C] () -- C:\Windows\System32\H@tKeysH@@k.DLL
[2007.03.07 20:07:12 | 000,021,174 | ---- | C] () -- C:\Windows\cam1210.ini
[2006.11.08 14:27:06 | 000,030,208 | ---- | C] () -- C:\Windows\System32\cam1210.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2010.04.16 13:07:30 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\BitTorrent
[2010.04.28 15:38:31 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Command and Conquer 4
[2005.07.01 05:43:13 | 000,000,000 | RHSD | M] -- C:\Users\m.c.rezi\AppData\Roaming\default
[2009.12.20 14:57:42 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\DNA
[2010.01.24 16:59:53 | 000,000,000 | -H-D | M] -- C:\Users\m.c.rezi\AppData\Roaming\ijjigame
[2010.05.24 12:49:20 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\install
[2009.12.08 18:42:35 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Leadertech
[2010.05.26 17:16:42 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\spynet
[2010.01.19 17:54:19 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\TeamViewer
[2010.05.24 14:19:15 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Teeworlds
[2010.04.11 16:16:47 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\TubeBox
[2010.06.08 17:47:14 | 000,032,616 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.05.16 14:03:22 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Adobe
[2010.03.26 16:02:16 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Avira
[2010.04.16 13:07:30 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\BitTorrent
[2010.04.28 15:38:31 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Command and Conquer 4
[2005.07.01 05:43:13 | 000,000,000 | RHSD | M] -- C:\Users\m.c.rezi\AppData\Roaming\default
[2009.12.20 14:57:42 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\DNA
[2010.06.03 12:32:24 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Hamachi
[2009.12.03 16:56:38 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Identities
[2010.01.24 16:59:53 | 000,000,000 | -H-D | M] -- C:\Users\m.c.rezi\AppData\Roaming\ijjigame
[2010.05.24 12:49:20 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\install
[2009.12.03 17:07:23 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\InstallShield
[2010.02.02 17:02:55 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\InstallShield Installation Information
[2009.12.08 18:42:35 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Leadertech
[2009.12.03 17:19:43 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Macromedia
[2010.04.29 14:27:26 | 000,000,000 | --SD | M] -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft
[2009.12.03 17:12:22 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Mozilla
[2010.06.08 17:54:00 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Skype
[2010.06.08 17:53:26 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\skypePM
[2010.05.26 17:16:42 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\spynet
[2010.01.19 17:54:19 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\TeamViewer
[2010.05.24 14:19:15 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\Teeworlds
[2010.04.11 16:16:47 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\TubeBox
[2009.12.06 17:57:15 | 000,000,000 | ---D | M] -- C:\Users\m.c.rezi\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.06.01 14:41:14 | 000,368,640 | -H-- | M] (FLaEqrMsDkv) -- C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
[2010.05.24 12:49:19 | 000,409,600 | -HS- | M] (An) -- C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
[2005.07.10 12:56:21 | 000,409,600 | RHS- | M] (An) -- C:\Users\m.c.rezi\AppData\Roaming\default\msnmsgr.exe
[2004.10.22 06:16:58 | 000,118,736 | ---- | M] (Macrovision Corporation) -- C:\Users\m.c.rezi\AppData\Roaming\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe
[2005.03.24 05:00:16 | 000,120,040 | ---- | M] (InstallShield Software Corporation) -- C:\Users\m.c.rezi\AppData\Roaming\InstallShield Installation Information\{DBFF7A38-F460-419A-A2E7-2D55BD2D9AD4}\setup.exe
[2010.03.20 16:32:34 | 000,038,784 | ---- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2009.12.24 14:46:38 | 000,010,134 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{32C2F9AA-7484-48C2-AC19-2031F2ADD8F2}\ARPPRODUCTICON.exe
[2009.12.24 14:46:38 | 000,040,960 | R--- | M] (Macrovision Corporation) -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{32C2F9AA-7484-48C2-AC19-2031F2ADD8F2}\NewShortcut1_32C2F9AA748448C2AC192031F2ADD8F2.exe
[2009.12.24 14:46:38 | 000,008,854 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{32C2F9AA-7484-48C2-AC19-2031F2ADD8F2}\UNINST_Uninstall_H_32C2F9AA748448C2AC192031F2ADD8F2.exe
[2010.05.20 14:20:38 | 000,010,134 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_06AD63CCBCBA508D193269.exe
[2010.05.20 14:20:37 | 000,025,214 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_4B8709E2321C73F37A3A7B.exe
[2010.05.20 14:20:37 | 000,009,662 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe
[2010.05.20 14:20:38 | 000,355,574 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_9418668BEEAABDC7D6D2ED.exe
[2010.05.20 14:20:38 | 000,355,574 | R--- | M] () -- C:\Users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_D5F7931E8956E5F2853715.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\drivers\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\SoftwareDistribution\Download\c91af43e301542f65a88d59517636d32\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2006.11.02 11:46:10 | 001,376,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\msvbvm60.dll
[2006.11.02 11:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2006.11.02 11:46:13 | 000,221,184 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:24051EFF
< End of report >
--- --- ---

M.C.rezi 09.06.2010 13:13
und extras:
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 09.06.2010 13:59:27 - Run 1
OTL by OldTimer - Version 3.2.5.3    Folder = C:\Users\m.c.rezi\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 18,13 Gb Free Space | 18,57% Space Free | Partition Type: NTFS
Drive D: | 135,23 Gb Total Space | 133,92 Gb Free Space | 99,03% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MCREZI-PC
Current User Name: m.c.rezi
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3440306680-3731255177-4239468505-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01DEEF63-9E49-4CCF-9F5D-EED7A647910F}" = rport=137 | protocol=17 | dir=out | app=system |
"{04277413-B614-4D01-ADAC-0BA60EB8992B}" = rport=139 | protocol=6 | dir=out | app=system |
"{270D7471-F9E4-4102-983D-E0077EAB6821}" = lport=137 | protocol=17 | dir=in | app=system |
"{560A58FE-84FF-4C73-8374-FE3728F3C18A}" = lport=138 | protocol=17 | dir=in | app=system |
"{56B54727-ECD4-4E91-AEDD-A80A2A6D5BE4}" = lport=445 | protocol=6 | dir=in | app=system |
"{8A59E3BF-E3B0-4A2D-ADBA-BD731D932F44}" = lport=139 | protocol=6 | dir=in | app=system |
"{8A6F56FA-BC0D-465B-BAE0-748DF8D631A6}" = rport=138 | protocol=17 | dir=out | app=system |
"{AFA4A000-8F8F-4A71-9454-10E2CCE64264}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D5F69298-1646-488B-A689-1A95AB812685}" = rport=445 | protocol=6 | dir=out | app=system |
"{EE8E9500-73A5-4BF8-9BC8-4D1FD80DCABF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{006E61ED-603A-4F8F-8DB0-40DA4AAEB24D}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{0D3B2A43-9BD1-4AF8-8DCF-0FAB8715F663}" = protocol=17 | dir=in | app=c:\users\m.c.rezi\appdata\local\temp\ijjioptimizer.exe |
"{0DAD8A1E-47C3-4FB6-A26F-D8B473001D65}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{193483A4-9030-4B54-970F-B8F4030422B4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1AE5B8B0-81CC-4323-91B1-059A015BC9BF}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{1F46AF94-0538-4340-94AA-80F56BC60B67}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{20B8C58E-FC27-47A6-A253-DEA823366DA0}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{24963EB1-1153-480F-B718-7D708F0BAAF9}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{2D297228-188A-474C-85E4-0B70DA59FE0C}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe |
"{301644F5-DD39-4179-8A7A-AB19646C2263}" = protocol=6 | dir=in | app=c:\blackshot\blackshot\system\blackshot.exe |
"{3DD60D49-034E-41E7-979A-A37BD8A67E29}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{41519E72-BF83-4EFC-B483-E878FD777B6C}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{42F70829-158F-468D-BBD3-2E23B98A9A82}" = protocol=17 | dir=in | app=c:\blackshot\blackshot\system\blackshot.exe |
"{457A53AF-F4C8-4191-8BEA-CD5C5C8EE35C}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{4921D034-04CC-4A3C-BF99-48EA5751482B}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe |
"{67DB70AC-A7DE-4FD5-9259-DDE8ED61B000}" = protocol=6 | dir=in | app=c:\users\m.c.rezi\appdata\local\temp\ijjioptimizer.exe |
"{732861E2-3008-4241-B8ED-75CD589D7D3F}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{7683B37C-55C4-4BA6-8B34-A3E33D216BBC}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battlefield 2142\bf2142.exe |
"{7A3C0E54-FD05-4683-AA8E-38ED9CC096F1}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battlefield 2142\bf2142.exe |
"{81648E7E-2C87-471D-A93E-556705077B9E}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{899DDD8E-C194-40B7-825E-9807E7A82B47}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe |
"{97B48C9E-485F-4DA5-9705-D2CA731371F4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{98D41787-9E4E-4246-ACBE-C794F1E9CA2D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9C5B1D15-D873-402B-9041-47E2D33C43CD}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{9E247A77-21B8-4D5D-9633-2B4E34C69D8F}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe |
"{9FB6C0AB-4D75-4EE4-916F-A6E96421758D}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{B6CFF0D1-49B1-46D3-A686-432589AE6038}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{B6DBCE27-AC9C-4B09-AC49-84C8EE289D88}" = protocol=17 | dir=in | app=c:\program files\ijji\ijji reactor\ijjioptimizer.exe |
"{B72DFDB1-8F6C-441C-BF58-0FE67BE632C9}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{BF076ABD-787A-4C6B-91BC-922D8C520334}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe |
"{C11EEC9D-08C3-473E-A55F-87E6F3E9D917}" = protocol=6 | dir=in | app=c:\program files\ijji\ijji reactor\ijjioptimizer.exe |
"{C482F8EB-94FF-45BE-BC20-27B3F7B801B4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CBFEB588-A5BB-49E7-B1CB-FA7396A8CD1A}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{D741E4ED-8EA2-43A2-99BC-33CB8A84BB37}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{D94C9030-4C0B-4584-A7F9-71C3922F646D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DA8E8423-7805-4036-B6FB-5338AB60DDD0}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe |
"{E3201610-B6BD-4501-9FC2-8EE8B7535FF1}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{E8AA6D2B-6D8D-445B-9C96-579DA41EFB75}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{F39CCB1E-CB06-4DC8-BE60-52BCDE4193F8}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{F588E7CD-06D5-4C9E-BF0F-68C5F7BA02E5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F8549622-7666-4EF3-941D-2326A64DA390}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"TCP Query User{0259AE46-9629-46FE-8A45-7DD8F1E5DEBF}C:\program files\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=6 | dir=in | app=c:\program files\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"TCP Query User{046622F9-DBF5-44F1-9D63-020B1FC63123}C:\westwood\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=6 | dir=in | app=c:\westwood\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"TCP Query User{072212B1-F044-446E-B935-D53503B9574E}C:\users\m.c.rezi\appdata\local\intel pro\inetl_pro_wireless.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\appdata\local\intel pro\inetl_pro_wireless.exe |
"TCP Query User{0B225BFC-7703-4D40-BDCD-9826629D3420}C:\program files\hamachi\hamachi.exe" = protocol=6 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"TCP Query User{0CCF109C-3C33-455C-BB64-087137295AB4}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"TCP Query User{0FC55488-6C11-4367-A9E5-3563A78DC166}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=6 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe |
"TCP Query User{1B979396-6415-4E28-85A5-AF4C3D9DACD2}C:\program files\metin2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files\metin2\metin2client.bin |
"TCP Query User{2765B167-58E4-487C-A286-D72870CD6AA2}C:\users\m.c.rezi\desktop\dune2000\dune2000.dat" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\dune2000\dune2000.dat |
"TCP Query User{2A642007-7F74-4A99-806B-D5C7886A2E93}C:\users\m.c.rezi\desktop\finalmt2 official client\metin2.bin" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\finalmt2 official client\metin2.bin |
"TCP Query User{3C4E33AF-17F1-42A7-B4E4-022CFDB367AF}C:\ijji\english\ava\binaries\ava.exe" = protocol=6 | dir=in | app=c:\ijji\english\ava\binaries\ava.exe |
"TCP Query User{3F883EC4-D409-4F8B-B1F3-905710E02EE2}C:\users\m.c.rezi\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\program files\dna\btdna.exe |
"TCP Query User{457F47DD-7EFD-47AC-8CD0-31093A19148B}C:\ijji\english\gunz\gunz.exe" = protocol=6 | dir=in | app=c:\ijji\english\gunz\gunz.exe |
"TCP Query User{4722E225-ACC5-4E1E-808A-E4A7653CD960}C:\users\m.c.rezi\desktop\metin2\m2china\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\m2china\mc.exe |
"TCP Query User{559AB76B-4CDD-46DE-B55D-542395715A97}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"TCP Query User{593311CF-B4BF-4905-A164-7FD7F7C71F71}C:\program files\electronic arts\command & conquer 4 tiberian twilight\data\worldbuilder.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\command & conquer 4 tiberian twilight\data\worldbuilder.exe |
"TCP Query User{5BCDA3E4-A687-4E91-891D-EFF0AB5A21FB}C:\users\m.c.rezi\desktop\games\dune2000\dune2000.dat" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\games\dune2000\dune2000.dat |
"TCP Query User{5EFF5E92-6966-4C5A-A367-E2CAD829CDC7}C:\users\m.c.rezi\desktop\m2 ps\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\m2 ps\mc.exe |
"TCP Query User{6A63AA1E-BAF2-4115-BC3C-31470A91F730}C:\program files\metin2\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2\metin2.bin |
"TCP Query User{6B681B91-4734-4F60-9FFD-6D6FDB0A2E87}C:\users\m.c.rezi\desktop\p server\longdingsmt2-client\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\p server\longdingsmt2-client\mc.exe |
"TCP Query User{6BC560C3-81B7-4370-986A-0363C76425BC}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe |
"TCP Query User{7BCA4E6D-07E7-455F-85E4-40C555F1563B}C:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe |
"TCP Query User{8B6886BA-E1A1-49D7-BC8A-21F27598D7F2}C:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009_13_1.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009_13_1.exe |
"TCP Query User{9787C3DA-9D10-4A0E-9D5A-54C590FA7A67}C:\program files\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game" = protocol=6 | dir=in | app=c:\program files\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game |
"TCP Query User{988225D0-B765-4758-8056-F46A871455FA}C:\users\m.c.rezi\desktop\m2china\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\m2china\mc.exe |
"TCP Query User{99A6A05F-A943-4A09-893A-0CBE2E10EFFB}C:\users\m.c.rezi\desktop\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"TCP Query User{9CB7AE14-84D6-4C22-88ED-D2A2FA7F7C61}C:\program files\softnyx\wolfteam\wolfteam.bin" = protocol=6 | dir=in | app=c:\program files\softnyx\wolfteam\wolfteam.bin |
"TCP Query User{A441510F-89E0-4F00-8FC3-3AE5854C32B9}C:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\metin2starter.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\metin2starter.exe |
"TCP Query User{B31B29A1-A015-445E-909D-072376F5C90F}C:\users\m.c.rezi\desktop\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe |
"TCP Query User{B76134B8-510C-4242-80AC-FA77507B4CCC}C:\program files\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\counter-strike source\hl2.exe |
"TCP Query User{C0DF6959-69BF-46B5-BB29-AC944C802563}C:\program files\hamachi\hamachi.exe" = protocol=6 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"TCP Query User{C168B8DF-4345-4177-9EBD-168D7DDFE3E1}C:\program files\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\counter-strike source\hl2.exe |
"TCP Query User{CAF95AF4-D16F-43FE-841F-273C35B46358}C:\users\m.c.rezi\desktop\p server\geilmt2-client\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\p server\geilmt2-client\mc.exe |
"TCP Query User{CB666040-5F57-438F-A796-3241954CABAA}C:\users\m.c.rezi\desktop\leck mich\portmap\portmap.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\leck mich\portmap\portmap.exe |
"TCP Query User{D7E02021-49F9-4D15-8589-166E6449781D}C:\users\m.c.rezi\desktop\modified-client_v3.0-full_client\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\modified-client_v3.0-full_client\mc.exe |
"TCP Query User{DC4DAEED-017B-4A7F-AC3F-384CAFC5AAA2}C:\users\m.c.rezi\desktop\m2\metin2.bin" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\m2\metin2.bin |
"TCP Query User{DDD646C7-7E3D-4CFE-BC1C-59D9504B670D}C:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\mc.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\mc.exe |
"TCP Query User{DFCE45E3-E177-4C16-AAFA-7A581E7C3100}C:\users\m.c.rezi\appdata\local\ati drivers\ati_graphics.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\appdata\local\ati drivers\ati_graphics.exe |
"TCP Query User{F7DC95A2-0D24-404A-9AF7-BD0899F8B7E8}C:\users\m.c.rezi\desktop\emule\emule.exe" = protocol=6 | dir=in | app=c:\users\m.c.rezi\desktop\emule\emule.exe |
"UDP Query User{0AE2A765-D1AF-42EC-BDC4-4F6BFA646A65}C:\users\m.c.rezi\desktop\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe |
"UDP Query User{1287B1B5-6F54-4DF2-AA0B-2AAF886115EA}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"UDP Query User{128908A6-6EDB-4923-921A-620D7A7D49E1}C:\users\m.c.rezi\desktop\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"UDP Query User{1647D80E-90EF-4712-BEE6-80964CB2ED9A}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe |
"UDP Query User{2AB1015B-9919-43DC-A064-0D3A6FE759F7}C:\users\m.c.rezi\appdata\local\intel pro\inetl_pro_wireless.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\appdata\local\intel pro\inetl_pro_wireless.exe |
"UDP Query User{3091EABB-8910-4E3D-B405-7BB41C9A8579}C:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009_13_1.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009_13_1.exe |
"UDP Query User{31227773-9B65-42CE-ACAD-C25249DABF9C}C:\users\m.c.rezi\desktop\m2 ps\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\m2 ps\mc.exe |
"UDP Query User{381DA6A8-782B-4065-BE8C-A149B6CB0A8B}C:\users\m.c.rezi\desktop\emule\emule.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\emule\emule.exe |
"UDP Query User{4861567C-13EA-4CDF-87AB-82A931CA631F}C:\users\m.c.rezi\appdata\local\ati drivers\ati_graphics.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\appdata\local\ati drivers\ati_graphics.exe |
"UDP Query User{4E003CA4-AE47-42D8-9990-802A8EEEA5DE}C:\users\m.c.rezi\desktop\finalmt2 official client\metin2.bin" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\finalmt2 official client\metin2.bin |
"UDP Query User{4E1B8288-2AE7-405C-9A9A-FFA8085F410C}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=17 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe |
"UDP Query User{6283E1B2-BF72-444D-BF17-A7129A144DEB}C:\users\m.c.rezi\desktop\leck mich\portmap\portmap.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\leck mich\portmap\portmap.exe |
"UDP Query User{6807C0A0-C1B3-45C6-A71B-D254526A306F}C:\program files\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game" = protocol=17 | dir=in | app=c:\program files\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game |
"UDP Query User{6FD31E24-81B3-4D48-82E6-A6F85B64F13D}C:\program files\hamachi\hamachi.exe" = protocol=17 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"UDP Query User{73BFE3C3-01C6-4996-9EC8-01FE48AC8298}C:\program files\metin2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files\metin2\metin2client.bin |
"UDP Query User{78CC2ECD-B66E-43E2-8BE9-FAAEE628A4E0}C:\program files\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\counter-strike source\hl2.exe |
"UDP Query User{7B696433-CBBD-4A5F-A880-71F9BCC366DB}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"UDP Query User{7EB3E4CE-46E8-47C5-9D25-368633891BBC}C:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\metin2starter.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\metin2starter.exe |
"UDP Query User{84E3C3C3-D6D0-4D7D-9965-35E662A0CBB0}C:\users\m.c.rezi\desktop\m2\metin2.bin" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\m2\metin2.bin |
"UDP Query User{8CEDBB0F-99F8-47EE-88FC-7B66FD46349F}C:\users\m.c.rezi\desktop\metin2\m2china\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\m2china\mc.exe |
"UDP Query User{902BACBD-E354-4727-A69D-DA87CFF6BE5C}C:\users\m.c.rezi\desktop\games\dune2000\dune2000.dat" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\games\dune2000\dune2000.dat |
"UDP Query User{96ACECC1-9619-4327-805B-E33002F8E315}C:\program files\softnyx\wolfteam\wolfteam.bin" = protocol=17 | dir=in | app=c:\program files\softnyx\wolfteam\wolfteam.bin |
"UDP Query User{98C02A86-FD6B-4570-A52B-408037346330}C:\program files\metin2\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2\metin2.bin |
"UDP Query User{9A1E2666-F415-48AE-9498-A9DC5B6CC0FA}C:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\geilmt2-client\geilmt2-client\mc.exe |
"UDP Query User{A406E599-ED56-45AE-A865-57AE002151E5}C:\users\m.c.rezi\desktop\p server\longdingsmt2-client\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\p server\longdingsmt2-client\mc.exe |
"UDP Query User{B3FCEC5E-D740-4663-B643-F828DEBCA3A4}C:\program files\hamachi\hamachi.exe" = protocol=17 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"UDP Query User{BE8A077C-8E1B-40BF-BF34-1D227E0F822B}C:\users\m.c.rezi\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\program files\dna\btdna.exe |
"UDP Query User{BEE46608-BA9C-474C-BB2D-DC97DDBBD18C}C:\ijji\english\gunz\gunz.exe" = protocol=17 | dir=in | app=c:\ijji\english\gunz\gunz.exe |
"UDP Query User{CA6471EF-76E9-4825-A365-FDD0BA46E265}C:\users\m.c.rezi\desktop\m2china\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\m2china\mc.exe |
"UDP Query User{D038C9F6-92A1-46FD-A5A3-27FD0CEC332F}C:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\metin2\finalmt2 client  - 05.01.2010\finalmt2_2009-22-12.exe |
"UDP Query User{D088D76A-8063-47FC-ACCB-C84ECB9723C6}C:\program files\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=17 | dir=in | app=c:\program files\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"UDP Query User{D101A33B-71C2-483C-B37F-828772BF4108}C:\users\m.c.rezi\desktop\dune2000\dune2000.dat" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\dune2000\dune2000.dat |
"UDP Query User{D8ABAB30-2548-4840-B528-F7EC9EC30039}C:\ijji\english\ava\binaries\ava.exe" = protocol=17 | dir=in | app=c:\ijji\english\ava\binaries\ava.exe |
"UDP Query User{D94CDADD-16D6-4CB2-920E-3D1CDFD9C5B8}C:\westwood\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe" = protocol=17 | dir=in | app=c:\westwood\ea games\command & conquer the first decade\command & conquer(tm) tiberian sun(tm)\sun\game.exe |
"UDP Query User{DAEAD07D-5C1F-45C7-AD7D-C791AD2384FB}C:\users\m.c.rezi\desktop\modified-client_v3.0-full_client\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\modified-client_v3.0-full_client\mc.exe |
"UDP Query User{DE0565CA-D082-4BAB-86CE-4B5ABFC0C0EE}C:\users\m.c.rezi\desktop\p server\geilmt2-client\mc.exe" = protocol=17 | dir=in | app=c:\users\m.c.rezi\desktop\p server\geilmt2-client\mc.exe |
"UDP Query User{E267A92F-0A38-403B-9733-C26AAA41AC10}C:\program files\electronic arts\command & conquer 4 tiberian twilight\data\worldbuilder.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\command & conquer 4 tiberian twilight\data\worldbuilder.exe |
"UDP Query User{FB61E16A-1DE9-4EB1-A6C9-C333279734DA}C:\program files\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\counter-strike source\hl2.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{1B0098FF-1816-4F42-8203-FA29F5735596}" = Samsung PC Studio 3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{32C2F9AA-7484-48C2-AC19-2031F2ADD8F2}" = HAMA WEBCAM AC-130
"{37F04E1C-FB59-C2CA-0BEE-D0C78162E634}" = ATI Catalyst Install Manager
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{4527481F-E36D-408E-9F40-89E2630E2120}" = TubeBox!
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{56BDDC6B-A676-4559-B9D7-D2E19264E80D}" = Cnc4WorldBuilder
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{82696435-8572-4D8B-A230-D1AA567D0F0F}" = Command & Conquer™ 4 Tiberian Twilight
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{901DC58A-5C1B-4315-BA40-5AD3D3A463B9}" = ijji REACTOR
"{936B67BE-1EB4-4D98-815A-EA1E75FFED2F}" = Counter-Strike Source Final 07102004
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D5A9DA4B-E4F9-FB49-017D-769FC540F1F0}" = EA Download Manager UI
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}" = Battlefield 2142
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitTorrent" = BitTorrent
"CCleaner" = CCleaner
"Cheat Engine 5.6_is1" = Cheat Engine 5.6
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Combat Arms EU" = Combat Arms EU
"Cross Fire_is1" = Cross Fire En
"EA Download Manager" = EA Download Manager
"Emperor" = Emperor - Schlacht um Dune
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Guild Wars" = GUILD WARS
"Hamachi" = Hamachi 1.0.3.0
"Metin2_is1" = Metin2
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PunkBusterSvc" = PunkBuster Services
"ST6UNST #1" = CheatTS
"TeamViewer 5" = TeamViewer 5
"TmNationsForever_is1" = TmNationsForever
"Uninstall_is1" = Uninstall 1.0.0.1
"WinRAR archiver" = WinRAR
"WOLAPI" = Gemeinsam genutzte Internet-Komponenten von Westwood
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3440306680-3731255177-4239468505-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{DBFF7A38-F460-419A-A2E7-2D55BD2D9AD4}" = Dynasty Warriors 4 Hyper
"BitTorrent DNA" = DNA
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.06.2010 08:50:12 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549adc4, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc0000374, Fehleroffset 0x000af1c9,  Prozess-ID 0x620, Anwendungsstartzeit
 01cb018017493a3a.
 
Error - 03.06.2010 06:43:53 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6000.16771, Zeitstempel
 0x4907deda, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x6a254618,  Prozess-ID 0x44c, Anwendungsstartzeit
 01cb0309941e1cb5.
 
Error - 03.06.2010 06:44:02 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung explorer.exe, Version 6.0.6000.16771, Zeitstempel
 0x4907deda, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel
 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x6a254618,  Prozess-ID 0x7fc,
Anwendungsstartzeit 01cb0309ac80a2a5.
 
Error - 03.06.2010 06:44:05 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung explorer.exe, Version 6.0.6000.16771, Zeitstempel
 0x4907deda, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel
 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x6a254618,  Prozess-ID 0x388,
Anwendungsstartzeit 01cb0309b0092d25.
 
Error - 03.06.2010 06:45:00 | Computer Name = mcrezi-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.0.6000.16771 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: f34  Anfangszeit: 01cb0309ac80a2a5  Zeitpunkt
 der Beendigung: 0
 
Error - 03.06.2010 09:57:16 | Computer Name = mcrezi-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 07.06.2010 08:52:17 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung metin2client.bin, Version 0.0.0.0, Zeitstempel
 0x4bdac5a2, fehlerhaftes Modul python22.dll, Version 2.2.15.1011, Zeitstempel 0x3ce1abd1,
 Ausnahmecode 0xc0000005, Fehleroffset 0x000323c0,  Prozess-ID 0x7ac, Anwendungsstartzeit
 01cb063fd0ab8894.
 
Error - 08.06.2010 10:58:30 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung metin2client.bin, Version 0.0.0.0, Zeitstempel
 0x4bdac5a2, fehlerhaftes Modul kernel32.dll, Version 6.0.6000.16820, Zeitstempel
 0x49952034, Ausnahmecode 0x0eedfade, Fehleroffset 0x0001b09e,  Prozess-ID 0x1398,
 Anwendungsstartzeit 01cb071863ee91be.
 
Error - 08.06.2010 11:02:13 | Computer Name = mcrezi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung metin2client.bin, Version 0.0.0.0, Zeitstempel
 0x4bdac5a2, fehlerhaftes Modul kernel32.dll, Version 6.0.6000.16820, Zeitstempel
 0x49952034, Ausnahmecode 0x0eedfade, Fehleroffset 0x0001b09e,  Prozess-ID 0x175c,
 Anwendungsstartzeit 01cb071b150f801e.
 
Error - 08.06.2010 11:49:00 | Computer Name = mcrezi-PC | Source = EventSystem | ID = 4609
Description =
 
[ System Events ]
Error - 06.04.2010 10:06:03 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 06.04.2010 10:06:03 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 06.04.2010 10:08:02 | Computer Name = mcrezi-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 07.04.2010 03:39:54 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 07.04.2010 03:39:54 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 07.04.2010 03:41:54 | Computer Name = mcrezi-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 07.04.2010 07:36:00 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 07.04.2010 07:36:00 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 08.04.2010 05:14:04 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 08.04.2010 05:14:04 | Computer Name = mcrezi-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
 
< End of report >
--- --- ---

markusg 09.06.2010 13:36
VirusTotal - Free Online Virus and Malware Scan
b
dort prüfe
C:\Users\m.c.rezi\AppData\Local\ATI Drivers\ATI_graphics.exe
falls datei bereits analysiert, klicke erneut prüfen, ergebniss posten.

M.C.rezi 09.06.2010 13:42
hier ist das ergebnis:
Antivirus Version letzte aktualisierung Ergebnis
a-squared 5.0.0.26 2010.06.09 -
AhnLab-V3 2010.06.09.04 2010.06.09 -
AntiVir 8.2.2.6 2010.06.09 -
Antiy-AVL 2.0.3.7 2010.06.08 -
Authentium 5.2.0.5 2010.06.09 -
Avast 4.8.1351.0 2010.06.09 -
Avast5 5.0.332.0 2010.06.09 -
AVG 9.0.0.787 2010.06.09 -
BitDefender 7.2 2010.06.09 -
CAT-QuickHeal 10.00 2010.06.09 -
ClamAV 0.96.0.3-git 2010.06.09 -
Comodo 5040 2010.06.09 -
DrWeb 5.0.2.03300 2010.06.09 -
eSafe 7.0.17.0 2010.06.08 -
eTrust-Vet 36.1.7622 2010.06.09 -
F-Prot 4.6.0.103 2010.06.08 -
F-Secure 9.0.15370.0 2010.06.09 -
Fortinet 4.1.133.0 2010.06.09 -
GData 21 2010.06.09 -
Ikarus T3.1.1.84.0 2010.06.09 -
Jiangmin 13.0.900 2010.06.09 -
Kaspersky 7.0.0.125 2010.06.09 -
McAfee 5.400.0.1158 2010.06.09 -
McAfee-GW-Edition 2010.1 2010.06.09 -
Microsoft 1.5802 2010.06.09 -
NOD32 5184 2010.06.09 -
Norman 6.04.12 2010.06.09 -
nProtect 2010-06-09.02 2010.06.09 -
Panda 10.0.2.7 2010.06.08 -
PCTools 7.0.3.5 2010.06.09 -
Prevx 3.0 2010.06.09 -
Rising 22.51.02.03 2010.06.09 -
Sophos 4.53.0 2010.06.09 -
Sunbelt 6424 2010.06.09 -
Symantec 20101.1.0.89 2010.06.09 -
TheHacker 6.5.2.0.295 2010.06.08 -
TrendMicro 9.120.0.1004 2010.06.09 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.09 -
VBA32 3.12.12.5 2010.06.09 -
ViRobot 2010.6.9.2346 2010.06.09 -
VirusBuster 5.0.27.0 2010.06.08 -
weitere Informationen
File size: 39424 bytes
MD5...: 28c189f3c02afb9aa45cdc59a5f6f171
SHA1..: 591ede8324d5128633c1bf9c3a331a5244237af6
SHA256: 11cabde313734003ee95bc769fa62d3ef83756eee809b8faca01f6f368d7a896
ssdeep: 384:eINBsYkuUPDYhd8B1RzFOjXOF5JukLhiJzycbdkJFrcilnFQFFFFFFFFQQFF
Q2FE:FBiuU037S5MGhi9B69DbhBSvG8dEGU
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xaf92
timedatestamp.....: 0x4bf2f61a (Tue May 18 20:18:34 2010)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x2000 0x8f98 0x9000 6.03 888086d74b0fa54a2b0006c945aa0799
.reloc 0xc000 0xc 0x200 0.08 50d925e90380b366eed40019c442efbd
.rsrc 0xe000 0x574 0x600 4.00 8c95623e74eb5f68055e5bfe7c31c31a

( 1 imports )
> mscoree.dll: _CorExeMain

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic CIL Executable (.NET, Mono, etc.) (78.4%)
Win32 Executable Generic (9.1%)
Win32 Dynamic Link Library (generic) (8.1%)
Generic Win/DOS Executable (2.1%)
DOS Executable Generic (2.1%)
Symantec Reputation Network: Suspicious.Insight hxxp://www.symantec.com/security_response/writeup.jsp?docid=2010-021223-0550-99
sigcheck:
publisher....: Microsoft
copyright....: Copyright (c) Microsoft 2010
product......: ATI
description..: ATI
original name: ATI Driver.exe
internal name: ATI Driver.exe
file version.: 1.0.0.0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

markusg 09.06.2010 13:48
Fixen mit OTL

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\m.c.rezi\AppData\Local\Temp\AutoStart.exe ()
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe ()
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe File not found
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe File not found
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe (An)
O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Sound Settings Service]
C:\Users\m.c.rezi\AppData\Roaming\sounds.exe (FLaEqrMsDkv)
O4 - HKCU\..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe
O4 - HKCU\..\Run: [Sound Settings Service] C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
O4 - HKCU\..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe
O4 - HKCU\..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
O4 - HKCU\..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe
:Files
C:\Users\m.c.rezi\AppData\Local\Temp\AutoStart.exe
C:\Windows\System32\default\msnmsgr.exe
C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe
C:\Users\m.c.rezi\AppData\Roaming\sounds.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[start explorer]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Run Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten

M.C.rezi 09.06.2010 13:55
ergebnis:
All processes killed
Error: Unable to interpret <PRC - C:\Users\m.c.rezi\AppData\Local\Temp\AutoStart.exe ()> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe ()> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe File not found> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe File not found> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe (An)> in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-21-3440306680-3731255177-4239468505-1000..\Run: [Sound Settings Service]> in the current context!
Error: Unable to interpret <C:\Users\m.c.rezi\AppData\Roaming\sounds.exe (FLaEqrMsDkv)> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Run: [Audio HD Driver] C:\Users\MCC0A1~1.REZ\AppData\Local\Temp\AutoStart.exe> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Run: [Sound Settings Service] C:\Users\m.c.rezi\AppData\Roaming\sounds.exe> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Run: [bZE165UrdWubConcffD] C:\Windows\system\sounds.exe> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Run: [LK4Verx5FJxOvJr7n] C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Run: [HKCU] C:\Windows\System32\default\msnmsgr.exe> in the current context!
Error: Unable to interpret <O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe> in the current context!
Error: Unable to interpret <O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\system32\default\msnmsgr.exe> in the current context!
========== FILES ==========
C:\Users\m.c.rezi\AppData\Local\Temp\AutoStart.exe moved successfully.
File\Folder C:\Windows\System32\default\msnmsgr.exe not found.
C:\Users\m.c.rezi\AppData\Roaming\updateservice.exe moved successfully.
C:\Users\m.c.rezi\AppData\Roaming\sounds.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 41620 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: m.c.rezi
->Flash cache emptied: 43567 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: m.c.rezi
->Temp folder emptied: 29505707 bytes
->Temporary Internet Files folder emptied: 102457 bytes
->FireFox cache emptied: 91371881 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19576 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 115,00 mb


OTL by OldTimer - Version 3.2.5.3 log created on 06092010_145136

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg 09.06.2010 14:46
ah hatte nen fehler drinnen, ist aber nicht weiter schlimm.
bitte erstelle und poste ein combofix log.

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

M.C.rezi 09.06.2010 15:13
hier der log:
Combofix Logfile:
Code:
ComboFix 10-06-08.05 - m.c.rezi 09.06.2010  16:04:48.1.2 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6000.0.1252.49.1031.18.3071.1799 [GMT 2:00]
ausgeführt von:: c:\users\m.c.rezi\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Cheat Engine\dbk32.sys
c:\users\m.c.rezi\AppData\Roaming\cglogs.dat
c:\users\m.c.rezi\AppData\Roaming\chrtmp
c:\users\m.c.rezi\AppData\Roaming\data.dat

.
(((((((((((((((((((((((  Dateien erstellt von 2010-05-09 bis 2010-06-09  ))))))))))))))))))))))))))))))
.

2010-06-09 12:51 . 2010-06-09 12:51        --------        d-----w-        C:\_OTL
2010-06-09 12:05 . 2010-06-09 12:19        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2010-06-09 12:05 . 2010-06-09 12:05        --------        d-----w-        c:\program files\Spybot - Search & Destroy
2010-06-08 15:53 . 2010-06-08 15:53        56        ---ha-w-        c:\windows\system32\ezsidmv.dat
2010-06-05 15:19 . 2010-06-05 15:19        552        ----a-w-        c:\users\m.c.rezi\AppData\Local\d3d8caps.dat
2010-06-02 15:57 . 2010-06-03 11:57        --------        d-----w-        c:\users\m.c.rezi\kev OMG
2010-05-29 14:44 . 2010-06-09 12:56        --------        d-----w-        c:\program files\Metin2
2010-05-26 10:01 . 2010-05-26 10:01        1022490237        ----a-w-        c:\users\m.c.rezi\Combatarms_eu.exe
2010-05-25 10:42 . 2010-05-25 10:43        --------        d-----w-        c:\users\m.c.rezi\bilder
2010-05-24 12:19 . 2010-05-24 12:19        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\Teeworlds
2010-05-24 10:34 . 2010-05-24 10:34        --------        d-----w-        c:\program files\CheatTS
2010-05-21 15:28 . 2010-03-16 09:59        9728        ----a-w-        c:\windows\system32\uc_karos_launching.dll
2010-05-21 15:28 . 2010-03-16 09:59        147456        ----a-w-        c:\windows\system32\uc_neosteam_launching.dll
2010-05-20 13:58 . 2010-05-20 13:58        --------        d-----w-        c:\users\m.c.rezi\{07a1437c-b21e-454e-818d-f58cfad887b3}
2010-05-20 13:52 . 2006-07-24 14:05        5632        ----a-w-        c:\windows\system32\drivers\StarOpen.sys
2010-05-20 13:51 . 2010-05-20 13:51        --------        d-----w-        c:\program files\Samsung
2010-05-20 12:47 . 2010-05-20 12:47        --------        d-sh--r-        c:\users\m.c.rezi\AppData\Local\Intel Pro
2010-05-20 12:46 . 2010-05-20 12:46        --------        d-sh--r-        c:\users\m.c.rezi\AppData\Local\ATI Drivers
2010-05-20 12:20 . 2010-05-20 12:20        355574        ----a-r-        c:\users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_9418668BEEAABDC7D6D2ED.exe
2010-05-20 12:20 . 2010-05-20 12:20        10134        ----a-r-        c:\users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_06AD63CCBCBA508D193269.exe
2010-05-20 12:20 . 2010-05-20 12:20        355574        ----a-r-        c:\users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_D5F7931E8956E5F2853715.exe
2010-05-20 12:20 . 2010-05-20 12:20        9662        ----a-r-        c:\users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe
2010-05-20 12:20 . 2010-05-20 12:20        25214        ----a-r-        c:\users\m.c.rezi\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_4B8709E2321C73F37A3A7B.exe
2010-05-20 12:20 . 2010-05-20 12:20        --------        d-----w-        c:\program files\Jens Lorek
2010-05-18 11:53 . 2010-05-24 10:49        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\install

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-09 14:10 . 2009-12-03 15:15        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\Skype
2010-06-09 14:10 . 2010-03-11 15:51        --------        d-----w-        c:\program files\Cheat Engine
2010-06-09 14:04 . 2009-12-03 15:17        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\skypePM
2010-06-09 12:53 . 2010-05-02 10:24        35189        ----a-w-        c:\programdata\nvModes.dat
2010-06-09 12:53 . 2009-12-03 15:03        --------        d-----w-        c:\programdata\NVIDIA
2010-06-03 10:38 . 2010-04-30 12:03        --------        d-----w-        c:\program files\Image-Line
2010-06-03 10:32 . 2010-04-16 14:27        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\Hamachi
2010-05-29 12:02 . 2006-11-02 15:38        641106        ----a-w-        c:\windows\system32\perfh007.dat
2010-05-29 12:02 . 2006-11-02 15:38        116500        ----a-w-        c:\windows\system32\perfc007.dat
2010-05-26 15:16 . 2005-04-04 18:49        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\spynet
2010-05-26 10:01 . 2009-12-03 15:44        98304        ----a-w-        c:\programdata\NexonEU\NGM\nxgameeu.dll
2010-05-26 10:01 . 2009-12-03 15:44        81920        ----a-w-        c:\programdata\NexonEU\NGM\npNxGameeu.dll
2010-05-26 10:01 . 2009-12-03 15:44        331776        ----a-w-        c:\programdata\NexonEU\NGM\NGMResource.dll
2010-05-26 10:01 . 2009-12-03 15:44        258352        ----a-w-        c:\programdata\NexonEU\NGM\unicows.dll
2010-05-26 10:01 . 2009-12-03 15:44        532480        ----a-w-        c:\programdata\NexonEU\NGM\NGMDll.dll
2010-05-26 10:01 . 2009-12-03 15:44        155648        ----a-w-        c:\programdata\NexonEU\NGM\NGM.exe
2010-05-26 09:42 . 2009-12-03 15:20        421888        ----a-w-        c:\windows\NEXON_EU_DownloaderUpdater.exe
2010-05-25 10:45 . 2010-02-01 14:41        --------        d-----w-        c:\program files\EA GAMES
2010-05-24 10:32 . 2010-04-14 15:24        290816        ------w-        c:\windows\Setup1.exe
2010-05-24 10:32 . 2010-04-14 15:24        74752        ----a-w-        c:\windows\ST6UNST.EXE
2010-05-22 12:17 . 2009-12-03 15:06        --------        d--h--w-        c:\program files\InstallShield Installation Information
2010-05-21 12:28 . 2010-03-30 13:02        --------        d-----w-        c:\program files\Pando Networks
2010-05-16 12:03 . 2009-12-08 16:37        --------        d-----w-        c:\program files\Common Files\Adobe
2010-05-16 11:57 . 2009-12-08 16:23        --------        d-----w-        c:\program files\Google
2010-05-16 11:51 . 2009-12-03 15:16        --------        d-----w-        c:\program files\CCleaner
2010-05-12 09:21 . 2009-12-04 14:56        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-08 15:55 . 2010-01-05 15:01        --------        d-----w-        c:\program files\Electronic Arts
2010-05-02 11:06 . 2009-12-03 14:57        49680        ----a-w-        c:\users\m.c.rezi\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-02 10:22 . 2010-05-02 10:20        --------        d-----w-        c:\program files\NVIDIA Corporation
2010-04-30 12:03 . 2010-04-30 12:03        --------        d-----w-        c:\program files\Outsim
2010-04-29 12:26 . 2010-04-29 12:26        --------        d-----w-        c:\program files\Windows Live SkyDrive
2010-04-29 12:24 . 2010-04-29 12:24        --------        d-----w-        c:\program files\Common Files\Windows Live
2010-04-28 13:38 . 2010-03-20 14:59        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\Command and Conquer 4
2010-04-16 14:27 . 2010-04-16 14:27        --------        d-----w-        c:\program files\Hamachi
2010-04-16 14:27 . 2010-04-16 14:27        25280        ----a-w-        c:\windows\system32\drivers\hamachi.sys
2010-04-16 11:07 . 2009-12-08 16:52        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\BitTorrent
2010-04-11 14:16 . 2010-04-11 14:16        --------        d-----w-        c:\users\m.c.rezi\AppData\Roaming\TubeBox
2010-04-03 16:27 . 2010-04-03 16:27        985704        ----a-w-        c:\windows\system32\nvsvc.dll
2010-04-03 16:27 . 2010-04-03 16:27        66664        ----a-w-        c:\windows\system32\nvshext.dll
2010-04-03 16:27 . 2010-04-03 16:27        1515624        ----a-w-        c:\windows\system32\nvsvcr.dll
2010-04-03 16:27 . 2010-04-03 16:27        13683816        ----a-w-        c:\windows\system32\nvcpl.dll
2010-04-03 16:27 . 2010-04-03 16:27        129640        ----a-w-        c:\windows\system32\nvvsvc.exe
2010-04-03 16:27 . 2010-04-03 16:27        110696        ----a-w-        c:\windows\system32\nvmctray.dll
2010-04-02 14:54 . 2009-12-03 14:58        600680        ----a-w-        c:\windows\system32\NVUNINST.EXE
2010-03-31 16:00 . 2010-03-31 16:00        910845        ----a-w-        c:\users\m.c.rezi\Cnc3Time-Collaps1-6-0-4.zip
2010-03-30 13:40 . 2010-03-30 13:40        98304        ----a-w-        c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-03-30 13:40 . 2010-03-30 13:40        765952        ----a-w-        c:\programdata\NexonUS\NGM\NGMDll.dll
2010-03-30 13:40 . 2010-03-30 13:40        401408        ----a-w-        c:\programdata\NexonUS\NGM\NGMResource.dll
2010-03-30 13:40 . 2010-03-30 13:40        258352        ----a-w-        c:\programdata\NexonUS\NGM\unicows.dll
2010-03-30 13:40 . 2010-03-30 13:40        172032        ----a-w-        c:\programdata\NexonUS\NGM\NGM.exe
2010-03-30 13:40 . 2010-03-30 13:40        126976        ----a-w-        c:\programdata\NexonUS\NGM\nxgameus.dll
2010-03-24 14:57 . 2010-01-24 14:55        713312        ----a-w-        c:\windows\system32\ijjiSetup.exe
2010-03-24 14:56 . 2010-01-24 14:55        62048        ----a-w-        c:\windows\system32\ijjiProcessRestarter.exe
2010-03-24 14:56 . 2010-01-24 14:55        57952        ----a-w-        c:\windows\system32\ijjiPlugin2.dll
2010-03-24 14:56 . 2010-01-24 14:55        86624        ----a-w-        c:\windows\system32\ijjiChannelingPlugin.dll
2010-03-16 09:59 . 2010-01-24 14:55        61440        ----a-w-        c:\windows\system32\uc_atlantica_launching.dll
2010-03-16 09:59 . 2010-01-24 14:55        53248        ----a-w-        c:\windows\system32\uc_luminary_launching.dll
2010-03-16 09:59 . 2009-12-17 17:18        75264        ----a-w-        c:\windows\system32\uc_holybeast_launching.dll
2010-03-16 09:59 . 2009-12-17 17:17        64000        ----a-w-        c:\windows\system32\uc_sfighters_launching.dll
2010-03-16 09:59 . 2009-12-15 16:21        427008        ----a-w-        c:\windows\system32\uc_wepic_launching.dll
2010-03-16 09:59 . 2009-03-11 17:20        208384        ----a-w-        c:\windows\system32\uc_rohan_launching.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"ATI Drivers"="c:\users\m.c.rezi\AppData\Local\ATI Drivers\ATI_graphics.exe" [2010-05-20 39424]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-02 1004136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-14 4399104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
backup=c:\windows\pss\GamersFirst LIVE!.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^m.c.rezi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk]
path=c:\users\m.c.rezi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hamachi.lnk
backup=c:\windows\pss\hamachi.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-12-20 11:47        323392        ----a-w-        c:\users\m.c.rezi\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intel Pro Motherboard]
2010-05-20 12:47        39424        ----a-w-        c:\users\m.c.rezi\AppData\Local\Intel Pro\inetl_pro_wireless.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-12-05 12:19        1232896        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-03-13 10:55        1822720        ----a-w-        c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WaitingDog]
2007-08-30 19:38        60416        ----a-w-        c:\windows\StiD1210.exe

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 136176]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-06 3482384]
R3 XDva341;XDva341;c:\windows\system32\XDva341.sys [x]
R3 XDva342;XDva342;c:\windows\system32\XDva342.sys [x]
R3 XDva346;XDva346;c:\windows\system32\XDva346.sys [x]
R3 XDva347;XDva347;c:\windows\system32\XDva347.sys [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-04-03 240232]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
.
Inhalt des "geplante Tasks" Ordners

2010-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 11:57]

2010-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-16 11:57]
.
.
------- Zusätzlicher Suchlauf -------
.
FF - ProfilePath - c:\users\m.c.rezi\AppData\Roaming\Mozilla\Firefox\Profiles\eomakf88.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\m.c.rezi\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-Sound Settings Service - c:\users\m.c.rezi\AppData\Roaming\sounds.exe
HKCU-Run-bZE165UrdWubConcffD - c:\windows\system\sounds.exe
HKCU-Run-LK4Verx5FJxOvJr7n - c:\users\m.c.rezi\AppData\Roaming\updateservice.exe
MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
MSConfigStartUp-bZE165UrdWubConcffD - c:\windows\system\sounds.exe
MSConfigStartUp-G7yARTVYT2FHoHsb0 - c:\users\m.c.rezi\AppData\Roaming\updateservice.exe
MSConfigStartUp-HKLM - c:\windows\system32\default\msnmsgr.exe
MSConfigStartUp-LK4Verx5FJxOvJr7n - c:\users\m.c.rezi\AppData\Roaming\updateservice.exe
MSConfigStartUp-LogMeIn Hamachi Ui - c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
MSConfigStartUp-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-Pando Media Booster - c:\program files\Pando Networks\Media Booster\PMB.exe
ActiveSetup-{W41680AS-73V3-T2GP-813Q-552YY6C5SP8C} - c:\windows\system32\default\msnmsgr.exe
ActiveSetup-{B1ADDD9F-BD72-1CFF-CBFD-DEBF6DCB5DBB} - c:\users\m.c.rezi\AppData\Roaming\sounds.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-09 16:10
Windows 6.0.6000  NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Zeit der Fertigstellung: 2010-06-09  16:12:24
ComboFix-quarantined-files.txt  2010-06-09 14:12

Vor Suchlauf: 12 Verzeichnis(se), 18.170.564.608 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 18.099.355.648 Bytes frei

- - End Of File - - 1026E5471006D39A2D2A8A3B57FC81D5
--- --- ---

markusg 09.06.2010 15:27
start, programme, zubehör, editor.
kopiere rein:

Killall::
Folder::
c:\users\m.c.rezi\AppData\Roaming\spynet

datei speichern unter, typ, alle dateien, name
cfscript.txt
speicherort, dort wo sich combofix.exe befindet.
ziehe cfscript auf combofix, programm startet, log posten.

M.C.rezi 10.06.2010 13:23
ich habe den editor ertsellt und ihn zu combifix gesteckt auf die exe gezogen und combofix hat gestartet. Combofix startete und hat den ordner entert danach hat mein pc neugestartet und ich hatte ein blackscreen. ich musste den explorer neustarten danach hatte sich auch kein logfile von combofix geöffnet. habe ich etwas falsch gemacht?

markusg 10.06.2010 13:32
passiert das immernoch nach neustart?
öffne mal arbeitsplatz, laufwerk c: qoobox, quarantäne. dort ist eine combofix3.txt, sollte die aktuellste sein, die posten bitte.

M.C.rezi 10.06.2010 13:36
nein das passierte mir zum ersten mal. in qoobox, quarantine ist keine combofix3.
nur im ordner qoobox ist eine combofix2 und das ist dan wohl die alte

markusg 10.06.2010 13:41
probiere das script mal erneut.

M.C.rezi 10.06.2010 13:53
da ist das selbe von eben wieder passiert. blackscreen kein logfile da steht aber das er den script benutzt hat

markusg 10.06.2010 14:08
kannst du mal den inhalt der quarantained files.txt posten.

M.C.rezi 10.06.2010 14:12
da sind zwei .txt datein drinne beide heißen catchme und nur eine hat nen text:

-------- 2010-06-09 - 16:03:05 -------------

error: 31

-------- 2010-06-10 - 14:06:14 -------------

error: 31

-------- 2010-06-10 - 14:44:04 -------------

error: 31

oder meinst du die txt datein im ganzen ordner qoobox?

markusg 10.06.2010 14:14
da gibts auch ne quarantained files.txt

M.C.rezi 10.06.2010 14:17
achso tut mir leid ich hab es falsch verstanden hier ist das richtige:
2010-06-09 14:11:53 . 2010-06-09 14:11:53 191 ----a-w- C:\Qoobox\Quarantine\Registry_backups\ActiveSetup-{B1ADDD9F-BD72-1CFF-CBFD-DEBF6DCB5DBB}.reg.dat
2010-06-09 14:11:53 . 2010-06-09 14:11:53 194 ----a-w- C:\Qoobox\Quarantine\Registry_backups\ActiveSetup-{W41680AS-73V3-T2GP-813Q-552YY6C5SP8C}.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 944 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Pando Media Booster.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 924 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-msnmsgr.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 964 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-LogMeIn Hamachi Ui.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-LK4Verx5FJxOvJr7n.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 856 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-HKLM.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-G7yARTVYT2FHoHsb0.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 892 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-bZE165UrdWubConcffD.reg.dat
2010-06-09 14:11:50 . 2010-06-09 14:11:50 1,044 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-AdobeCS4ServiceManager.reg.dat
2010-06-09 14:11:44 . 2010-06-09 14:11:44 159 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-LK4Verx5FJxOvJr7n.reg.dat
2010-06-09 14:11:44 . 2010-06-09 14:11:44 136 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-bZE165UrdWubConcffD.reg.dat
2010-06-09 14:11:44 . 2010-06-09 14:11:44 157 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Sound Settings Service.reg.dat
2010-06-09 14:09:32 . 2010-06-09 14:09:32 5,811 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2010-06-09 14:03:05 . 2010-06-09 14:04:48 62 ----a-w- C:\Qoobox\Quarantine\catchme.log
2010-06-01 12:41:48 . 2010-06-09 12:43:05 24,818 ----a-w- C:\Qoobox\Quarantine\C\Users\m.c.rezi\AppData\Roaming\data.dat.vir
2010-05-21 15:21:14 . 2010-05-21 15:21:14 0 ----a-w- C:\Qoobox\Quarantine\C\Users\m.c.rezi\AppData\Roaming\chrtmp.vir
2010-03-11 15:51:37 . 2010-01-14 03:32:48 60,416 ----a-w- C:\Qoobox\Quarantine\C\Program Files\Cheat Engine\dbk32.sys.vir
2006-04-28 14:14:05 . 2010-06-08 15:45:08 101,346 ----a-w- C:\Qoobox\Quarantine\C\Users\m.c.rezi\AppData\Roaming\cglogs.dat.vir

markusg 10.06.2010 14:21
ok. öffne arbeitsplatz, dort wähle _otl
rechtsklick, zu otl.zip oder rar hinzufügen wählen und das archiv hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html
unter punkt2.
wenn du damit fertig bist, melde dich, berichte wie der pc läuft.

M.C.rezi 10.06.2010 14:25
so erledigt

markusg 10.06.2010 14:27
nu sag mir noch wie er läuft.

M.C.rezi 10.06.2010 14:28
also mein internetexplorer hat sich nicht wieder geöffnet und sonst keine fehlfunktionen alles super

M.C.rezi 10.06.2010 14:42
danke für deine hilfe :)

markusg 10.06.2010 14:52
wir sind noch nicht fertig. damit alle programme, auch dein antivirus programm richtig laufen, muss dein system aktuell sein, beginne mit windows updates. erst sp1, dann sp2, dann restliche updates + internet explorer 8. melde dich wenn fertig.

M.C.rezi 10.06.2010 14:54
geht klar bin beim updaten

M.C.rezi 11.06.2010 13:12
update erledigt

markusg 11.06.2010 13:17
avira

avira so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

M.C.rezi 11.06.2010 13:40
ich habe schon avira und spybot

markusg 11.06.2010 13:49
du sollst prüfen, ob du avira 10 hast, wenn nein, instalieren, wenn ja, konfigurieren wie in der anleitung, dann updaten, dann lokaler schutz, lokale laufwerke, ein scan startet, funde in quarantäne, log posten.

M.C.rezi 11.06.2010 13:49
okay mach ich

M.C.rezi 11.06.2010 16:57
scan fertig hat ziemlich lang gedauert:


Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Freitag, 11. Juni 2010 15:07

Es wird nach 2205030 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : m.c.rezi
Computername : MCREZI-PC

Versionsinformationen:
BUILD.DAT : 10.0.0.567 Bytes 19.04.2010 15:50:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 20.04.2010 12:35:06
AVSCAN.DLL : 10.0.3.0 56168 Bytes 20.04.2010 12:35:06
LUKE.DLL : 10.0.2.3 104296 Bytes 07.03.2010 17:32:59
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 10:59:47
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 08:05:36
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 18:27:49
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 16:37:42
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 15:37:42
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 10:29:03
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 10:51:46
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 12:05:21
VBASE007.VDF : 7.10.7.219 2048 Bytes 02.06.2010 12:05:22
VBASE008.VDF : 7.10.7.220 2048 Bytes 02.06.2010 12:05:22
VBASE009.VDF : 7.10.7.221 2048 Bytes 02.06.2010 12:05:22
VBASE010.VDF : 7.10.7.222 2048 Bytes 02.06.2010 12:05:22
VBASE011.VDF : 7.10.7.223 2048 Bytes 02.06.2010 12:05:22
VBASE012.VDF : 7.10.7.224 2048 Bytes 02.06.2010 12:05:22
VBASE013.VDF : 7.10.8.37 270336 Bytes 10.06.2010 12:08:33
VBASE014.VDF : 7.10.8.38 2048 Bytes 10.06.2010 12:08:33
VBASE015.VDF : 7.10.8.39 2048 Bytes 10.06.2010 12:08:33
VBASE016.VDF : 7.10.8.40 2048 Bytes 10.06.2010 12:08:33
VBASE017.VDF : 7.10.8.41 2048 Bytes 10.06.2010 12:08:33
VBASE018.VDF : 7.10.8.42 2048 Bytes 10.06.2010 12:08:33
VBASE019.VDF : 7.10.8.43 2048 Bytes 10.06.2010 12:08:33
VBASE020.VDF : 7.10.8.44 2048 Bytes 10.06.2010 12:08:33
VBASE021.VDF : 7.10.8.45 2048 Bytes 10.06.2010 12:08:33
VBASE022.VDF : 7.10.8.46 2048 Bytes 10.06.2010 12:08:34
VBASE023.VDF : 7.10.8.47 2048 Bytes 10.06.2010 12:08:34
VBASE024.VDF : 7.10.8.48 2048 Bytes 10.06.2010 12:08:34
VBASE025.VDF : 7.10.8.49 2048 Bytes 10.06.2010 12:08:34
VBASE026.VDF : 7.10.8.50 2048 Bytes 10.06.2010 12:08:34
VBASE027.VDF : 7.10.8.51 2048 Bytes 10.06.2010 12:08:34
VBASE028.VDF : 7.10.8.52 2048 Bytes 10.06.2010 12:08:34
VBASE029.VDF : 7.10.8.53 2048 Bytes 10.06.2010 12:08:34
VBASE030.VDF : 7.10.8.54 2048 Bytes 10.06.2010 12:08:34
VBASE031.VDF : 7.10.8.59 34304 Bytes 11.06.2010 12:08:34
Engineversion : 8.2.2.6
AEVDF.DLL : 8.1.2.0 106868 Bytes 26.04.2010 13:22:46
AESCRIPT.DLL : 8.1.3.31 1352058 Bytes 02.06.2010 12:01:39
AESCN.DLL : 8.1.6.1 127347 Bytes 15.05.2010 17:30:58
AESBX.DLL : 8.1.3.1 254324 Bytes 26.04.2010 13:22:46
AERDL.DLL : 8.1.4.6 541043 Bytes 17.04.2010 10:51:51
AEPACK.DLL : 8.2.1.1 426358 Bytes 26.03.2010 14:00:30
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 15.05.2010 17:30:58
AEHEUR.DLL : 8.1.1.33 2724214 Bytes 05.06.2010 12:05:24
AEHELP.DLL : 8.1.11.5 242038 Bytes 02.06.2010 12:01:36
AEGEN.DLL : 8.1.3.10 377205 Bytes 02.06.2010 12:01:36
AEEMU.DLL : 8.1.2.0 393588 Bytes 26.04.2010 13:22:45
AECORE.DLL : 8.1.15.3 192886 Bytes 15.05.2010 17:30:57
AEBB.DLL : 8.1.1.0 53618 Bytes 26.04.2010 13:22:45
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 10:59:10
AVPREF.DLL : 10.0.0.0 44904 Bytes 14.01.2010 10:59:07
AVREP.DLL : 10.0.0.8 62209 Bytes 18.02.2010 15:47:40
AVREG.DLL : 10.0.3.0 53096 Bytes 20.04.2010 12:35:06
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 20.04.2010 12:35:06
AVARKT.DLL : 10.0.0.14 227176 Bytes 20.04.2010 12:35:06
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 26.01.2010 08:53:25
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:57:53
AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 14:38:54
NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 13:40:55
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 12:10:08
RCTEXT.DLL : 10.0.53.0 98152 Bytes 20.04.2010 12:35:06

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 10
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch
Abweichende Gefahrenkategorien........: +PCK,+PFS,

Beginn des Suchlaufs: Freitag, 11. Juni 2010 15:07

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'taskmgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmplayer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'skypePM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATI_graphics.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'StiD1210.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '328' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\m.c.rezi\Downloads\FarCry2_v1.0_(v0.1.0.1)_Trainer+6.zip
[0] Archivtyp: ZIP
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
--> NFO viewer.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
C:\Users\m.c.rezi\Downloads\M2 MultiversionHack by banjo1 v3.91.rar
[0] Archivtyp: RAR
[FUND] Ist das Trojanische Pferd TR/Swisyn.afse.5
--> M2 MultiversionHack by banjo1 v3.91.exe
[FUND] Ist das Trojanische Pferd TR/Swisyn.afse.5
C:\Users\m.c.rezi\Downloads\Multihack Gex.rar
[0] Archivtyp: RAR
[FUND] Ist das Trojanische Pferd TR/Fakealert.8126
--> MULTIHACK-6.1.2.rar
[1] Archivtyp: RAR
--> MULTIHACK.exe
[FUND] Ist das Trojanische Pferd TR/Fakealert.8126
Beginne mit der Suche in 'D:\'
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.

Beginne mit der Desinfektion:
C:\Users\m.c.rezi\Downloads\Multihack Gex.rar
[FUND] Ist das Trojanische Pferd TR/Fakealert.8126
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '480bf982.qua' verschoben!
C:\Users\m.c.rezi\Downloads\M2 MultiversionHack by banjo1 v3.91.rar
[FUND] Ist das Trojanische Pferd TR/Swisyn.afse.5
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50d0d7ea.qua' verschoben!
C:\Users\m.c.rezi\Downloads\FarCry2_v1.0_(v0.1.0.1)_Trainer+6.zip
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '02398cf1.qua' verschoben!


Ende des Suchlaufs: Freitag, 11. Juni 2010 17:56
Benötigte Zeit: 2:49:08 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

21393 Verzeichnisse wurden überprüft
318778 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
318775 Dateien ohne Befall
1334 Archive wurden durchsucht
0 Warnungen
3 Hinweise
98275 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden

markusg 11.06.2010 17:07
bei der nutzung illegaler software kann ich dir leider nicht mehr weiter helfen.
formatieren, passwörter endern, auf solche software verzichten. das sind die letzten tipps die ich dir noch gebe.

M.C.rezi 12.06.2010 09:51
na ja danke für deine hilfe und alles andere :dankeschoen:


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:53 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131