Trojaner-Board - TR/Atraps.Gen festgestellt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/Atraps.Gen festgestellt (https://www.trojaner-board.de/114298-tr-atraps-gen-festgestellt.html)

TR/Atraps.Gen festgestellt

Guten Tag

seit Kurzem habe ich den Trojaner TR/Atraps.Gen durch das Programm Avira festgestellt und komme erst jetzt dazu gegen ihn etwas zu unternehmen (PC wird auch von anderen benutzt)

Der Trojaner hat einige Tage nichts getan, aber jetzt funktioniert der PC nicht mehr richtig (ich schreibe gerade über Laptop).

-Windows braucht länger zum Starten.
-Internet funktioniert gar nicht mehr auf dem PC.
-Anti-Viren-Programme werden geblockt.

System: Vista 32-bit
Jetzt wollte ich eine Hilfsanfrage starten und habe wie gefordert zuerst die drei Schritte (defogger, dds, Gmer) gemacht. Leider funktionerte nur ersteres. dds startet erst gar nicht und Gmer stürzt mitten im Scan ab.

Daher im Anhang nur der Bericht von defogger. Ansonsten noch ein Bericht über einen kompletten Scan von Avira sowie ein kompletter Scan von Malwarebytes.

Keine Ahnung warum im Avira Bericht der Trojaner nicht drin steht wo er doch 3 Dateien infiziert hatte.

C:\Windows\System32\aptwx5day.dll
C:\Windows\System32\d3dytd1vd.dll
C:\Windows\System32\xptn0r8k.dll

hatte er befallen.

Hoffe ich habe alles soweit.
Vielen Dank für eine schnelle Antwort

MfG

hi,
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Erstmal vielen Dank, dass du dich hier meldest

Hier OTL.txt:OTL Logfile:

Code:

OTL logfile created on: 30.04.2012 19:04:10 - Run 1

OTL by OldTimer - Version 3.2.42.2     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19088)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 64,63% Memory free

10,72 Gb Paging File | 9,59 Gb Available in Paging File | 89,51% Paging File free

Paging file location(s): c:\pagefile.sys 8000 8000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 293,33 Gb Total Space | 37,09 Gb Free Space | 12,64% Space Free | Partition Type: NTFS

Drive D: | 293,08 Gb Total Space | 109,62 Gb Free Space | 37,40% Space Free | Partition Type: NTFS

Drive E: | 1,78 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive N: | 3,71 Gb Total Space | 3,55 Gb Free Space | 95,65% Space Free | Partition Type: FAT32

 

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.30 18:56:28 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

PRC - [2012.04.20 10:33:24 | 000,497,152 | ---- | M] (LOL Replay) -- C:\Programme\LOLReplay\LOLRecorder.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.31 09:56:34 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.31 09:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 09:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 09:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.10.15 10:53:00 | 001,328,960 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe

PRC - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2009.04.11 00:28:16 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE

PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.06.06 19:17:16 | 000,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvraidservice.exe

PRC - [2008.03.26 15:21:30 | 005,369,856 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) -- C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

PRC - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) -- C:\Windows\System32\lxbkcoms.exe

PRC - [2008.01.25 19:49:04 | 000,269,448 | ---- | M] (CyberLink) -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2007.12.19 19:09:22 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

PRC - [2007.12.18 11:13:54 | 000,132,560 | ---- | M] (United Internet AG) -- C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe

PRC - [2007.10.17 11:38:20 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

PRC - [2007.09.10 15:28:18 | 000,057,344 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.20 10:33:22 | 000,265,728 | ---- | M] () -- C:\Programme\LOLReplay\LOLUtils.dll

MOD - [2012.03.05 14:45:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll

MOD - [2012.01.31 12:37:24 | 012,907,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\03c1786328450d3eb3129a6ee9c161d0\System.Windows.Forms.ni.dll

MOD - [2012.01.31 12:37:17 | 001,653,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6abcaa7df5e346b0912197bcf7fcab15\System.Drawing.ni.dll

MOD - [2012.01.31 12:37:10 | 005,764,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\1d2279b148a6fb152f2a45b7d31fff2d\System.Xml.ni.dll

MOD - [2012.01.31 12:37:06 | 001,016,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\0360226da2794a6b15a262f3e48709ef\System.Configuration.ni.dll

MOD - [2012.01.31 12:37:04 | 008,367,616 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b9b3afa5f4ba74c561f0fa1bfceba7e0\System.ni.dll

MOD - [2012.01.31 12:35:58 | 015,424,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\3cdbdfe526ccd9eef32943313ea0231d\PresentationFramework.ni.dll

MOD - [2012.01.31 12:35:44 | 013,094,912 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\4861ab3c08650851bc270cebd6745e99\PresentationCore.ni.dll

MOD - [2012.01.31 12:35:32 | 003,568,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6a17ee74a7d2abf0a25e989efe881f3c\WindowsBase.ni.dll

MOD - [2012.01.31 12:32:16 | 002,517,504 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\5f3a699a62a098beef04f48514c47a58\System.Core.ni.dll

MOD - [2012.01.29 14:10:59 | 000,406,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6cd5c2f950025f574dde718eb20af161\PresentationFramework.Aero.ni.dll

MOD - [2009.08.21 16:47:12 | 004,361,056 | ---- | M] () -- C:\Programme\Microsoft Office\Office14\1033\GrooveIntlResource.dll

MOD - [2009.03.29 22:42:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll

MOD - [2009.03.29 22:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.04.20 17:08:32 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.31 09:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 09:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.11.12 19:08:16 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Stopped] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service)

SRV - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2009.08.21 16:47:14 | 030,510,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2009.08.21 16:39:22 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.08.21 16:36:08 | 004,639,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.07.26 06:43:14 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- d:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)

SRV - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)

SRV - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbkcoms.exe -- (lxbk_device)

SRV - [2008.01.25 19:49:04 | 000,269,448 | ---- | M] (CyberLink) [Auto | Running] -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)

SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.21 04:23:24 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2008.01.21 04:23:24 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2007.12.19 19:09:22 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)

SRV - [2007.12.18 11:13:54 | 000,132,560 | ---- | M] (United Internet AG) [Auto | Running] -- C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe -- (SmartSurferManager)

SRV - [2007.10.17 11:38:20 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)

SRV - [2007.09.10 15:28:18 | 000,057,344 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)

SRV - [2005.09.23 17:45:46 | 000,315,392 | ---- | M] (AVM Berlin) [On_Demand | Stopped] -- C:\Programme\Common Files\AVM\De_serv.exe -- (de_serv)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)

DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012.01.31 09:56:33 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.01.31 09:56:33 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.10.15 10:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.08 01:21:28 | 000,139,880 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2010.10.13 08:00:27 | 000,078,848 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\SSHDRV85.sys -- (SSHDRV85)

DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.31 13:15:51 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.07.31 13:15:50 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.01.15 19:36:52 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2008.12.25 13:02:13 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PzWDM.sys -- (PzWDM)

DRV - [2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2008.06.07 12:13:40 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2008.02.12 04:42:38 | 000,232,472 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)

DRV - [2008.02.05 02:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)

DRV - [2007.11.18 04:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2007.11.06 10:30:48 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\zntport.sys -- (zntport)

DRV - [2007.11.06 10:30:46 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TVicPort.sys -- (tvicport)

DRV - [2007.07.07 15:13:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

DRV - [2007.07.03 04:05:20 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)

DRV - [2007.05.07 03:00:00 | 000,537,600 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fpcibase.sys -- (FPCIBASE)

DRV - [2007.05.07 03:00:00 | 000,064,512 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)

DRV - [2005.09.23 17:38:44 | 000,316,928 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Netfritz.sys -- (NETFRITZ)

DRV - [2004.05.24 14:35:06 | 000,059,520 | ---- | M] (AVM Berlin) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\avmport.sys -- (AVMPORT)

DRV - [2003.01.14 11:41:10 | 000,273,664 | ---- | M] (AGFEO GmbH & Co. KG) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\AGFUCAPI.sys -- (agfucapi)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! Deutschland

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland

IE - HKLM\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Acer.com Worldwide - Select your local country or region [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=19764&mntrId=2cec11f30000000000000007776409320932

IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.09 10:26:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.15 18:39:29 | 000,000,000 | ---D | M]

 

[2011.03.06 11:49:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2012.04.27 19:21:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions

[2012.03.03 11:19:07 | 000,000,000 | ---D | M] (WOT) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.04.27 17:16:56 | 000,000,000 | ---D | M] (uTorrentBar_DE Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}

[2011.04.03 19:35:01 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\engine@conduit.com

[2011.09.30 15:05:00 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\ffxtlbr@babylon.com

[2011.11.15 18:05:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8NS316PJ.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI

() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8NS316PJ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012.04.09 10:26:34 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.03.06 13:14:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.04.09 10:26:32 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.24 17:54:18 | 000,002,291 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2012.04.09 10:26:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.04.09 10:26:32 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.09 10:26:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.09 10:26:32 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.09 10:26:32 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.30.0\bh\BabylonToolbar.dll (Babylon BHO)

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll̀ File not found

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.30.0\BabylonToolbarTlbr.dll (Babylon Ltd.)

O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Se&nd to OneNote - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FC76DB2-719C-4570-9177-8E5A30E0FE49}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3059536D-C6FF-4A7F-BBB5-ED3FF977FDCB}: NameServer = 192.168.120.252,192.168.120.253

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2012.01.06 17:31:24 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2012.01.06 17:55:32 | 000,806,912 | R--- | M] (Ion Storm) - E:\Autorun.exe -- [ CDFS ]

O33 - MountPoints2\{4e8aca29-e32b-11dd-9a8c-0021853ffcbf}\Shell - "" = AutoRun

O33 - MountPoints2\{4e8aca29-e32b-11dd-9a8c-0021853ffcbf}\Shell\AutoRun\command - "" = K:\Setup.exe

O33 - MountPoints2\{73852072-12c9-11e1-adbc-9c3512d860d1}\Shell - "" = AutoRun

O33 - MountPoints2\{73852072-12c9-11e1-adbc-9c3512d860d1}\Shell\AutoRun\command - "" = N:\AutoRun.exe

O33 - MountPoints2\{880e8c92-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell - "" = AutoRun

O33 - MountPoints2\{880e8c92-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell\AutoRun\command - "" = J:\PopCDRun.exe

O33 - MountPoints2\{880e8c95-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell - "" = AutoRun

O33 - MountPoints2\{880e8c95-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell\AutoRun\command - "" = L:\SETUP.EXE

O33 - MountPoints2\{880e8c97-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell - "" = AutoRun

O33 - MountPoints2\{880e8c97-6c2f-11e0-9dbb-e7d0c706d8ea}\Shell\AutoRun\command - "" = M:\SETUP.EXE

O33 - MountPoints2\{b176a6b2-8a2c-11dd-ac62-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{b176a6b2-8a2c-11dd-ac62-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2012.01.06 17:55:32 | 000,806,912 | R--- | M] (Ion Storm)

O33 - MountPoints2\{ce9aac69-fba5-11de-9c88-0021853ffcbf}\Shell\AutoRun\command - "" = avira.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.30 19:03:06 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.27 17:54:05 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.04.27 17:53:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.27 17:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.27 17:53:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.27 17:53:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.04.27 17:53:00 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.60.0.1800.exe

[2012.04.20 19:44:15 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Thief - Deadly Shadows

[2012.04.20 19:43:35 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Thief - Deadly Shadows

[2012.04.20 19:39:51 | 000,000,000 | ---D | C] -- C:\Program Files\Thief - Deadly Shadows

[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.30 19:07:13 | 000,690,600 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.30 19:07:13 | 000,647,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.30 19:07:13 | 000,152,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.30 19:07:13 | 000,125,216 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.30 18:58:19 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.30 18:58:19 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.30 18:58:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.30 18:56:28 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.28 21:42:09 | 000,428,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.04.28 20:09:14 | 000,002,855 | ---- | M] () -- C:\Users\***\Desktop\dds.PIF

[2012.04.28 19:59:19 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable

[2012.04.28 17:05:08 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job

[2012.04.27 17:55:04 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.27 17:53:23 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.60.0.1800.exe

[2012.04.20 16:52:15 | 000,001,782 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk

[2012.04.20 16:52:15 | 000,001,690 | ---- | M] () -- C:\Users\Public\Desktop\LOL Recorder.lnk

[2012.04.17 19:58:48 | 000,140,800 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012.04.17 19:58:39 | 000,283,304 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr

[2012.04.17 19:58:25 | 000,280,904 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0

[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.04.28 21:41:57 | 000,428,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.04.28 20:09:14 | 000,002,855 | ---- | C] () -- C:\Users\***\Desktop\dds.PIF

[2012.04.28 19:59:02 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable

[2012.04.27 17:53:44 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.31 22:40:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2011.12.31 22:39:59 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.05.31 08:39:50 | 000,058,368 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll

[2011.05.31 08:38:18 | 000,015,360 | ---- | C] () -- C:\Windows\System32\bdmjpeg.dll

[2011.04.21 18:45:32 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll

[2011.04.21 18:45:32 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll

[2011.04.21 18:45:32 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll

[2011.04.21 18:18:10 | 000,070,308 | ---- | C] () -- C:\Windows\DIIUnin.dat

[2011.04.14 11:30:01 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe

[2011.02.17 18:50:02 | 000,040,960 | ---- | C] () -- C:\Windows\System32\psfind.dll

[2010.11.20 19:49:45 | 000,001,356 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2010.10.30 20:18:57 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE

[2010.10.13 08:00:27 | 000,078,848 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV85.sys

[2010.06.20 18:01:57 | 000,000,674 | ---- | C] () -- C:\Windows\eReg.dat

 
 ========== LOP Check ==========

 

[2010.04.22 16:04:41 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#

[2011.08.12 18:29:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.minecraft

[2011.09.24 17:54:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Babylon

[2011.06.18 09:06:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Bioshock2

[2010.08.29 10:50:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2010.10.17 11:14:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.18 17:14:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2010.06.19 10:10:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools

[2012.01.13 13:44:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2010.06.19 10:10:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Pro

[2009.04.23 19:00:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FFSJ

[2011.04.09 13:22:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Firefly Studios

[2011.09.24 17:21:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FRITZ!

[2012.01.13 14:22:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GlarySoft

[2008.12.25 20:22:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Leadertech

[2011.06.08 09:53:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient

[2010.11.27 18:27:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.11.11 20:07:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin

[2011.12.04 15:06:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RIFT

[2010.05.07 18:05:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\runic games

[2010.09.07 17:39:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SEGA Corporation

[2012.01.13 10:53:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SmartSurfer

[2011.04.10 20:04:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Stardock

[2011.04.08 13:14:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\The Creative Assembly

[2011.04.06 19:00:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ubisoft

[2012.01.13 13:44:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent

[2011.05.30 19:56:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\wargaming.net

[2008.12.30 14:42:11 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WEBDE

[2012.04.28 17:05:08 | 000,000,318 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job

[2012.04.28 17:08:52 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%. >

 
 < %PROGRAMFILES%.exe >

 
 < %LOCALAPPDATA%.exe >

 
 < %systemroot%. mp s >

 
 < md5start >

 
 < userinit.exe >

 
 < eventlog.dll >

 
 < scecli.dll >

 
 < netlogon.dll >

 
 < cngaudit.dll >

 
 < ws2ifsl.sys >

 
 < sceclt.dll >

 
 < ntelogon.dll >

 
 < winlogon.exe >

 
 < logevent.dll >

 
 < user32.DLL >

 
 < explorer.exe >

 
 < iaStor.sys >

 
 < nvstor.sys >

 
 < atapi.sys >

 
 < IdeChnDr.sys >

 
 < viasraid.sys >

 
 < AGP440.sys >

 
 < vaxscsi.sys >

 
 < nvatabus.sys >

 
 < viamraid.sys >

 
 < nvata.sys >

 
 < nvgts.sys >

 
 < iastorv.sys >

 
 < ViPrt.sys >

 
 < eNetHook.dll >

 
 < ahcix86.sys >

 
 < KR10N.sys >

 
 < nvstor32.sys >

 
 < ahcix86s.sys >

 
 < md5stop >

 
 < %systemroot%system32drivers.sys lockedfiles >

 
 < %systemroot%System32config.sav >

 
 < %systemroot%system32.dll lockedfiles >

 
 < %USERPROFILE%. >

 
 < %USERPROFILE%Local SettingsTemp.exe >

 
 < %USERPROFILE%Local SettingsTemp.dll >

 
 < %USERPROFILE%Application Data.exe >

 
 < HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerSubSystemsWindows rs >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 56044 bytes -> C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM

@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
 

< End of report >

--- --- ---

Und hier Extras.txt:OTL Logfile:

Code:

OTL Extras logfile created on: 30.04.2012 19:04:10 - Run 1

OTL by OldTimer - Version 3.2.42.2     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19088)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 64,63% Memory free

10,72 Gb Paging File | 9,59 Gb Available in Paging File | 89,51% Paging File free

Paging file location(s): c:\pagefile.sys 8000 8000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 293,33 Gb Total Space | 37,09 Gb Free Space | 12,64% Space Free | Partition Type: NTFS

Drive D: | 293,08 Gb Total Space | 109,62 Gb Free Space | 37,40% Space Free | Partition Type: NTFS

Drive E: | 1,78 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive N: | 3,71 Gb Total Space | 3,55 Gb Free Space | 95,65% Space Free | Partition Type: FAT32

 

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.)

"C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption -- ( Egis Incorporated.)

"C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption -- ( Egis Incorporated.)

"C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr

"C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.)

"C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu -- (Egis Incorporated.)

"C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption

"C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption

"C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr

"C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe" = C:\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr -- (Egis Incorporated.)

"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe

"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe

"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]

"D:\Program Files\Combat Arms EU\CombatArms.exe" = D:\Program Files\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)

"D:\Program Files\Combat Arms EU\Engine.exe" = D:\Program Files\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0395D966-5124-478E-BB1A-8B4013589898}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 

"{0B074541-DCE1-4E13-A596-68BEED113198}" = lport=445 | protocol=6 | dir=in | app=system | 

"{10F249D5-4925-42C8-80D6-3CF020C64A26}" = rport=139 | protocol=6 | dir=out | app=system | 

"{1B4B318C-5D00-4B7C-B555-5AD364E35294}" = lport=138 | protocol=17 | dir=in | app=system | 

"{253E8AC0-9FE5-41DA-AB24-217766B9A325}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 

"{4D1D05ED-B8D4-46B4-A374-AF5EFA0F132D}" = rport=138 | protocol=17 | dir=out | app=system | 

"{5B392386-BE32-4967-9959-93E3011523ED}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{5E8CFE6B-AC05-4145-A698-38C3CD790973}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{742E9F08-44F0-4629-9A0F-A77D6FEDD002}" = lport=139 | protocol=6 | dir=in | app=system | 

"{7809D06C-8CE5-4D82-979B-A094B276F251}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{8832AD9B-0AB8-435D-81D8-3960A46C167F}" = rport=445 | protocol=6 | dir=out | app=system | 

"{8BEBDF46-68CA-4FF4-9CDC-881FC3E70293}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{A6E254F5-51E1-4ABF-982E-68C7F9662FA2}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 

"{AD8B79A8-420B-48F1-9D32-0781539D8C9F}" = lport=137 | protocol=17 | dir=in | app=system | 

"{B4043FFD-6C9B-4150-9810-E0BA7C5443C7}" = rport=137 | protocol=17 | dir=out | app=system | 

"{FE759ACE-AE52-42DB-BEAD-6D18B099C819}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{039C1103-3FC4-4AD5-896B-1219957CD743}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 

"{08E48ED4-342A-45C8-BC40-EAE14BA7B2ED}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"{0B277B2C-D8AC-48CA-8679-7E5D77C52124}" = protocol=6 | dir=in | app=c:\program files\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{0D69C4EF-4967-4C70-A4BA-3DB7665E6ADD}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{0FEF0ED0-299A-4D82-A366-C1E60F52F52F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\farcry2.exe | 

"{1103BF39-4F8C-485D-B751-F72419842DAD}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{11AC2C7A-3E65-4336-9A71-DD3CE55CE40E}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 

"{1253CDD9-4F31-4E22-BEB9-92EAD6A26237}" = protocol=17 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire entrenchment.exe | 

"{131D4B7F-5AB1-4D73-8755-ADA03C1BAADD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"{15B13F34-82D0-4BAD-8CA3-1051C3D21046}" = protocol=6 | dir=in | app=d:\program files\thq\gas powered games\supreme commander\bin\supremecommander.exe | 

"{1997CB96-7552-494E-BAA8-467343A8C1E9}" = protocol=17 | dir=in | app=d:\program files\dragon age\daoriginslauncher.exe | 

"{19C85426-B25C-4597-9CC4-9F3D53524B1D}" = protocol=17 | dir=in | app=c:\program files\origin games\battlefield 3\bf3.exe | 

"{1B50BEE7-6785-4CB6-92CE-8038E30918A0}" = protocol=6 | dir=in | app=c:\windows\system32\lxbkcoms.exe | 

"{1D463E1B-9315-4D0A-A66F-C845DC330165}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{2A730283-FE19-4920-944E-460DC4831394}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 

"{2EF8AE37-3F12-4733-ACE7-7ADDF31B0815}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 

"{3832F267-0C1A-42F7-83A7-F828F250BF5B}" = protocol=6 | dir=in | app=c:\program files\origin games\battlefield 3\bf3.exe | 

"{3B24459D-2515-4813-8297-46673257B304}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe | 

"{3B468A51-7935-4C53-AAA4-EA22421CA4BC}" = protocol=17 | dir=in | app=d:\program files\thq\gas powered games\supreme commander\bin\supremecommander.exe | 

"{3DFFA4A8-816F-4402-A5F9-7851407B1FD1}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{3FDBA2EF-A5A1-493E-9145-42CD5C964550}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{40BD987E-FE24-4487-96D8-04AF788401F8}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{43BC04D6-FD7A-48BD-921F-8B9100060A01}" = protocol=17 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire diplomacy.exe | 

"{45D91E8A-1E30-4360-A413-1E3ACAD9D493}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 

"{47570617-57E5-48BE-9234-DA55A32B318C}" = protocol=17 | dir=in | app=d:\program files\electronic arts\crytek\crysis\bin32\crysis.exe | 

"{51CEB41A-2E02-43C5-B7F8-E9AE03D67C93}" = protocol=17 | dir=in | app=c:\windows\system32\lxbkcoms.exe | 

"{541EFD1F-1790-495B-8AD0-FFBD29A4E14A}" = protocol=17 | dir=in | app=d:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 

"{550F0D9C-2759-4034-B1C3-01B51E52FC4A}" = protocol=6 | dir=in | app=d:\program files\dragon age\bin_ship\daorigins.exe | 

"{595C85C0-B813-4C14-A99D-1AD49240EA1D}" = protocol=17 | dir=in | app=c:\nexon\vindictus eu\en-eu\nmservice.exe | 

"{59C549CD-F2FA-495F-B7BE-B49821FBB645}" = protocol=6 | dir=in | app=d:\program files\dragon age\daoriginslauncher.exe | 

"{5B8C4E44-0F97-4F04-A232-0A465A807757}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 

"{5F4F4A9E-5999-400C-858C-E9A722D22980}" = protocol=17 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\blackprophecy.exe | 

"{5F78F51E-243A-4197-90F6-3D17CDC36086}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{62131C02-BEE1-46DC-BA2C-4B0691537111}" = protocol=17 | dir=in | app=d:\program files\2k games\bioshock 2\sp\builds\binaries\bioshock2.exe | 

"{678054F7-B923-4565-945D-BFECFA7AAD1A}" = protocol=6 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\launcher.exe | 

"{6A0918DD-2C36-466D-B99F-C59C6816E7B4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"{7215D894-967B-4F77-A690-302DCD0D5E35}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 

"{72C1AC9B-2689-4A51-926D-FAC9F6055B1C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\dawn of war 2\dow2.exe | 

"{73B7353A-B379-4A54-AF13-FECEA99D5C96}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 

"{7624909E-7878-44ED-9203-F1C94E410B91}" = protocol=17 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\launcher.exe | 

"{76B9D823-7611-40A7-9A8B-F72E5E5305BF}" = protocol=6 | dir=in | app=d:\program files\rockstar games\eflc\launcheflc.exe | 

"{778F3C38-07A5-467C-B8CE-E47B284D329C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 

"{782E9C2C-1C57-4E41-924F-BB981004259E}" = protocol=17 | dir=in | app=d:\program files\2k games\bioshock 2\mp\builds\binaries\bioshock2.exe | 

"{79E1F77C-80EA-4D7C-9E67-33AFB1C6290A}" = protocol=6 | dir=in | app=d:\program files\rockstar games\eflc\eflc.exe | 

"{7AA113C5-3152-47BA-BC28-41F4A16098B3}" = protocol=17 | dir=in | app=d:\program files\rockstar games\eflc\launcheflc.exe | 

"{7F388A50-DEE1-4D6C-897A-0C62CD1097E4}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbkpswx.exe | 

"{84245EDF-A8E6-47C1-AB7B-BDBA4787D5F3}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 

"{845F6259-2F67-4530-9F6C-F023D8EB7738}" = protocol=17 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\patcher.exe | 

"{84A116CE-8287-4ECA-9E9F-5F826164DB8F}" = protocol=17 | dir=in | app=d:\program files\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | 

"{8BFBD4C6-3B61-4522-9A8C-6F22E5B5953C}" = protocol=6 | dir=in | app=d:\program files\2k games\bioshock 2\sp\builds\binaries\bioshock2.exe | 

"{8C8CDF9D-029F-4AEE-8E95-0E035F88C0CD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{8E2D8158-45EE-49BC-BC9A-8182D43B67AE}" = protocol=6 | dir=in | app=d:\program files\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 

"{95561682-1890-4704-A8B9-F77323AD4182}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbkpswx.exe | 

"{98833D45-2301-4C74-92C1-9EBB8C5ED320}" = protocol=6 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\patcher.exe | 

"{989B4984-63C8-4D00-B907-279B216C1DC4}" = protocol=6 | dir=in | app=d:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 

"{99F92906-07D2-4DB2-A25F-505A0A24412D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{9BD1C6DF-F6DA-41FB-BE31-D0D6755E994A}" = protocol=6 | dir=in | app=d:\program files\electronic arts\crytek\crysis\bin32\crysis.exe | 

"{9E07DAD7-1696-4603-A3AD-80B17E6A793D}" = protocol=17 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 

"{9FEFF40F-2749-4BA5-BDB9-79C053D953D6}" = protocol=17 | dir=in | app=d:\program files\combat arms eu\nmservice.exe | 

"{A12A4BF5-1F09-42A9-B2EA-CCE3B13C1F72}" = protocol=6 | dir=in | app=c:\nexon\vindictus eu\en-eu\nmservice.exe | 

"{A37A02E1-E77A-4D76-BE10-C28206868CA8}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 

"{A44EB374-80E8-4870-B089-840883709F32}" = protocol=6 | dir=in | app=d:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 

"{ABAE2BA1-34DE-49CE-9BE6-8F340DCEB44D}" = protocol=6 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire entrenchment.exe | 

"{AD6BBDD6-E5F0-40E0-AFF9-F95A78513F51}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\dawn of war 2\dow2.exe | 

"{B3AC6BCD-064E-40D2-B58D-5664911D3ACE}" = protocol=17 | dir=in | app=d:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 

"{B8D8B61B-C60E-4414-B1D1-B999AFC9938A}" = protocol=6 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 

"{B921883F-F2B0-4737-A7C0-448097BAA241}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sid meier's civilization v\launcher.exe | 

"{BB1B4D66-0268-43DA-ACC4-E9A296A90BC1}" = protocol=6 | dir=in | app=d:\program files\dragon age\bin_ship\daupdatersvc.service.exe | 

"{BC2C7675-A3C9-4404-B507-BC12B442ED1E}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 

"{BF8D7381-1CAC-4536-ABF9-BBE643D5445C}" = protocol=17 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire.exe | 

"{C00FD3C5-4BC7-4880-A82F-9A48F7ABA477}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe | 

"{C06F3282-ADAD-44EB-9CF0-09D22259CB68}" = protocol=6 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire.exe | 

"{C0C6188A-9971-4C9D-B87B-8721CB2C5C73}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{C4F9D52A-509C-4B91-B73E-098F9B14CE50}" = protocol=6 | dir=in | app=d:\program files\kalypso\sins of a solar empire\sins of a solar empire diplomacy.exe | 

"{C50969D3-EFC4-41A4-970E-3D413C3E757B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{C7236144-A2B3-4047-A2BF-3754EA89DA77}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{C8193F27-1869-4179-A128-73F41FD6B798}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 

"{CC9CFEB2-EC4D-41BA-A7E0-A116226A8247}" = protocol=17 | dir=in | app=d:\program files\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 

"{D095E801-56C6-4D0B-9313-73952CA1A3F5}" = protocol=17 | dir=in | app=d:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 

"{D4BFACC7-FC45-4912-A5A2-B680BB76ABB3}" = protocol=17 | dir=in | app=d:\program files\dragon age\bin_ship\daorigins.exe | 

"{D64B9BE2-AD71-472C-9DB8-D2D6810FAB82}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe | 

"{DDE41A50-73A3-4609-9220-D46869DB953E}" = protocol=17 | dir=in | app=c:\program files\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{DF693DEC-C2D3-4B98-B119-C1D715DF5CBB}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 

"{E35E42A5-AA14-4A89-9FCD-533FB37AF8DC}" = protocol=17 | dir=in | app=d:\program files\rockstar games\eflc\eflc.exe | 

"{E3F4D504-2189-49BA-B5E6-87D292B49AE0}" = protocol=17 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2launcher.exe | 

"{E46C46D3-12F1-4EA2-9A38-889B27F4A025}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{E5A54859-9308-45D7-AD37-575F2A1A37CB}" = protocol=6 | dir=in | app=d:\program files\combat arms eu\nmservice.exe | 

"{E9D1C5E7-BD9D-4F38-83BA-518A07D81B9D}" = protocol=6 | dir=in | app=d:\program files\gamigo\black prophecy\bin\win32\blackprophecy.exe | 

"{F02DC6E8-4781-4672-B9D0-105D98D8B775}" = protocol=6 | dir=in | app=d:\program files\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe | 

"{F2A0DCA4-DD2A-40A2-AD26-9937CFD318F5}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 

"{F5FE6640-9394-4816-B83C-4B6437EFE7E4}" = protocol=6 | dir=in | app=c:\program files\ubisoft\far cry 2\bin\fc2editor.exe | 

"{F610FEF9-52B1-46A8-B803-5247BBDAE6A0}" = protocol=6 | dir=in | app=d:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 

"{F86EDB41-43F4-4A78-B7BC-3563BF63EC75}" = protocol=17 | dir=in | app=d:\program files\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 

"{F9CCC119-6AD7-46BA-8C2E-C64A8A25846D}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 

"{FBFDED03-C66D-421D-947B-6AE0877045EE}" = protocol=6 | dir=in | app=d:\program files\2k games\bioshock 2\mp\builds\binaries\bioshock2.exe | 

"{FC2AB6EB-CC82-45BA-B5D4-27A1F3A7E087}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 

"TCP Query User{029A61C0-ACAC-4212-8EC7-4F478732E2E1}C:\program files\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files\lolreplay\lolreplay.exe | 

"TCP Query User{043BD321-CE6C-4640-910C-DB86B853F2F6}C:\program files\frozen synapse\frozensynapse.exe" = protocol=6 | dir=in | app=c:\program files\frozen synapse\frozensynapse.exe | 

"TCP Query User{0465769C-4FAB-49FE-90A4-352DB536A932}C:\program files\electronic arts\der herr der ringe® - die eroberung™\conquest.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\der herr der ringe® - die eroberung™\conquest.exe | 

"TCP Query User{452ECE8F-ABEC-43B0-8835-63212324EF3B}C:\program files\steam\steamapps\pcftw333\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\pcftw333\team fortress 2\hl2.exe | 

"TCP Query User{5B25FB28-0650-4EBA-AB8B-C246EF8F9823}D:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=6 | dir=in | app=d:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe | 

"TCP Query User{8170F916-555C-49EC-8D72-3CCEE083855B}D:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 

"TCP Query User{83360715-7875-4E12-8793-889BA8CF0625}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 

"TCP Query User{8E497A54-DCE9-4DA6-A8D2-11AC938F0FF3}C:\program files\defcon\defcon (2).exe" = protocol=6 | dir=in | app=c:\program files\defcon\defcon (2).exe | 

"TCP Query User{8F274C24-81E0-40B1-AF16-FEA02AF085D9}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"TCP Query User{8FF86361-C44C-4894-BAC1-DB56FDAD0217}D:\program files\stunlock studios\bloodline champions\binary\bloodlinechampions.exe" = protocol=6 | dir=in | app=d:\program files\stunlock studios\bloodline champions\binary\bloodlinechampions.exe | 

"TCP Query User{90EF570A-9779-4689-8DB1-5936C09A852D}D:\programme\r.u.s.e\r.u.s.e\uplaybrowser\uplaybrowser.exe" = protocol=6 | dir=in | app=d:\programme\r.u.s.e\r.u.s.e\uplaybrowser\uplaybrowser.exe | 

"TCP Query User{941725AC-8AEB-4DAB-B229-BA54DCA20C0E}D:\programme\thq\company of heroes\reliccoh.exe" = protocol=6 | dir=in | app=d:\programme\thq\company of heroes\reliccoh.exe | 

"TCP Query User{989714AC-C7AD-4911-97C4-4DA41857C7D2}C:\users\***\desktop\world of warcraft\wow-3.3.3.11685-to-3.3.3.11723-dede-downloader.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\world of warcraft\wow-3.3.3.11685-to-3.3.3.11723-dede-downloader.exe | 

"TCP Query User{A7BF466F-2F30-4491-8E95-A91873A89050}D:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=d:\games\world_of_tanks\worldoftanks.exe | 

"TCP Query User{A9CEEB4A-5DB2-4C79-BB2D-106488A5343B}D:\program files\combat arms eu\engine.exe" = protocol=6 | dir=in | app=d:\program files\combat arms eu\engine.exe | 

"TCP Query User{AF6C71AA-8274-4619-B604-FAA0ABF2E414}C:\soldat\soldat.exe" = protocol=6 | dir=in | app=c:\soldat\soldat.exe | 

"TCP Query User{B1D7CAFA-635D-4750-9743-08F8FFBC00B7}C:\program files\defcon\defcon.exe" = protocol=6 | dir=in | app=c:\program files\defcon\defcon.exe | 

"TCP Query User{B8785842-9A50-41E7-AE7B-9911EBAC0EBB}D:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=d:\games\world_of_tanks\wotlauncher.exe | 

"TCP Query User{BCEB1D43-6598-4C28-9886-CFAA21210F93}D:\program files\ccp\eve\bin\exefile.exe" = protocol=6 | dir=in | app=d:\program files\ccp\eve\bin\exefile.exe | 

"TCP Query User{BEF1A818-E3C7-4BDC-AC4C-629DE0E607B7}D:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 

"TCP Query User{D1621A1C-5231-47B2-A48D-ED4EC4680496}D:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=d:\games\world_of_tanks\worldoftanks.exe | 

"TCP Query User{E1576CF9-6384-47BD-9C92-57571CDB2E0D}C:\program files\littlefighter2\lf2_v2.0a\lf2.exe" = protocol=6 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0a\lf2.exe | 

"TCP Query User{E38BF9B6-E7F5-4E00-91B9-D0348227FEBF}D:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=d:\games\world_of_tanks\wotlauncher.exe | 

"TCP Query User{E45E443E-7D8E-4C28-A005-3B26735B7E8B}C:\program files\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\counter-strike source\hl2.exe | 

"TCP Query User{E5B8197E-BA10-4000-92E7-1F0491F0239A}C:\users\***\desktop\world of warcraft\repair.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\world of warcraft\repair.exe | 

"TCP Query User{EA7F38C1-3CB8-41FD-A183-D6EF9B1F5815}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 

"UDP Query User{01A068DB-7E74-4F1D-892E-0D5B3A79949E}D:\programme\r.u.s.e\r.u.s.e\uplaybrowser\uplaybrowser.exe" = protocol=17 | dir=in | app=d:\programme\r.u.s.e\r.u.s.e\uplaybrowser\uplaybrowser.exe | 

"UDP Query User{1B90522C-A771-4D5C-B119-EF405CE17E33}C:\program files\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\counter-strike source\hl2.exe | 

"UDP Query User{1CB2256E-4A91-496F-8FE3-FF3B30AF1010}D:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=d:\games\world_of_tanks\worldoftanks.exe | 

"UDP Query User{340801C1-0314-495C-8610-D9D14F626040}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 

"UDP Query User{4911193B-D101-4BB3-A7E9-2908890099EF}D:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=d:\games\world_of_tanks\wotlauncher.exe | 

"UDP Query User{56C708EC-F91D-4A65-A693-57E7E80E31F1}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 

"UDP Query User{70BBFE8B-9737-44B3-9826-A7F70B238F69}D:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=d:\games\world_of_tanks\wotlauncher.exe | 

"UDP Query User{7528C4CE-B7C1-4C5C-9E6D-4C437024689B}C:\program files\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files\lolreplay\lolreplay.exe | 

"UDP Query User{84B52E3C-3667-48A2-BC89-DC7988DF5AF2}C:\program files\steam\steamapps\pcftw333\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\pcftw333\team fortress 2\hl2.exe | 

"UDP Query User{895FC838-40BC-4F07-9680-D0A081C563B1}D:\program files\stunlock studios\bloodline champions\binary\bloodlinechampions.exe" = protocol=17 | dir=in | app=d:\program files\stunlock studios\bloodline champions\binary\bloodlinechampions.exe | 

"UDP Query User{89A6AC7A-6D5B-4B8A-B306-6615B121F8B3}C:\program files\electronic arts\der herr der ringe® - die eroberung™\conquest.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\der herr der ringe® - die eroberung™\conquest.exe | 

"UDP Query User{8BE9652E-9D57-4C29-9F60-303D1537D6B4}C:\program files\defcon\defcon.exe" = protocol=17 | dir=in | app=c:\program files\defcon\defcon.exe | 

"UDP Query User{94DE0A5A-A223-4F58-BB7A-7B71FE5F9A4C}C:\users\***\desktop\world of warcraft\repair.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\world of warcraft\repair.exe | 

"UDP Query User{98276506-1E2D-4E76-8185-F10966BA3556}D:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=17 | dir=in | app=d:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe | 

"UDP Query User{9FDA8560-9621-45B5-8D91-6C4A2C18FDD4}D:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 

"UDP Query User{AC2320E8-85BF-4055-9C71-D72031036690}C:\program files\frozen synapse\frozensynapse.exe" = protocol=17 | dir=in | app=c:\program files\frozen synapse\frozensynapse.exe | 

"UDP Query User{ADFF1377-669B-4252-9A2F-C3B55C4508E1}C:\program files\defcon\defcon (2).exe" = protocol=17 | dir=in | app=c:\program files\defcon\defcon (2).exe | 

"UDP Query User{B8877521-C136-4092-9766-E9ABA6DD725E}D:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=d:\games\world_of_tanks\worldoftanks.exe | 

"UDP Query User{BCFD42F1-F777-4B89-B130-36EB50F2786E}D:\program files\combat arms eu\engine.exe" = protocol=17 | dir=in | app=d:\program files\combat arms eu\engine.exe | 

"UDP Query User{CDDA0730-3594-4EDA-AAEF-75D583076612}C:\program files\littlefighter2\lf2_v2.0a\lf2.exe" = protocol=17 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0a\lf2.exe | 

"UDP Query User{D03B47B5-D1D7-4317-A706-ED9EB43891AD}D:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=d:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 

"UDP Query User{D0AF568D-2AD3-47F1-B054-53AC294F468B}D:\program files\ccp\eve\bin\exefile.exe" = protocol=17 | dir=in | app=d:\program files\ccp\eve\bin\exefile.exe | 

"UDP Query User{E013F960-8DC9-4F40-8663-B241E8E94D9A}C:\soldat\soldat.exe" = protocol=17 | dir=in | app=c:\soldat\soldat.exe | 

"UDP Query User{E7FAEFC8-D3E2-4FC0-A54F-AAAAF3F275AE}C:\users\***\desktop\world of warcraft\wow-3.3.3.11685-to-3.3.3.11723-dede-downloader.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\world of warcraft\wow-3.3.3.11685-to-3.3.3.11723-dede-downloader.exe | 

"UDP Query User{F74E6033-3798-4196-85D3-088C62B2F51C}D:\programme\thq\company of heroes\reliccoh.exe" = protocol=17 | dir=in | app=d:\programme\thq\company of heroes\reliccoh.exe | 

"UDP Query User{FFD36144-5F41-41F3-8965-9E57EE4BC523}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)

"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable

"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{06029DFB-9E17-410D-A1FE-7EB5F1A1E3FD}" = HOT ALBUM MYBOX

"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas

"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}" = Civilization III

"{0B6A9773-F8F8-4D3F-BCF0-029D2B87DB8A}" = Deus Ex - Invisible War

"{0D5FAD7E-C1A2-4753-8A28-346A5CD42813}" = Defense Grid: The Awakening

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series" = Canon MP550 series MP Drivers

"{11CA6E01-3992-4115-AB6E-D325552C166D}" = WEB.DE SmartSurfer AutoUpdate 5.2

"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect

"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI

"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker

"{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7

"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2

"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI

"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1

"{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}" = Morrowind

"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.6.4

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F61E0B1-1AB8-F15E-07C4-46D100A1D3F7}" = Borderlands

"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V

"{20140000-000F-0000-0000-0000000FF1CE}" = Microsoft Office Mondo 2010 (Beta)

"{20140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010 (Beta)

"{20140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010 (Beta)

"{20140000-0017-0409-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (English) 2010 (Beta)

"{20140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010 (Beta)

"{20140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010 (Beta)

"{20140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010 (Beta)

"{20140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010 (Beta)

"{20140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 (Beta)

"{20140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 (Beta)

"{20140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010 (Beta)

"{20140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010 (Beta)

"{20140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010 (Beta)

"{20140000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2010 (Beta)

"{20140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010 (Beta)

"{20140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010 (Beta)

"{20140000-00B4-0409-0000-0000000FF1CE}" = Microsoft Office Project MUI (English) 2010 (Beta)

"{20140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010 (Beta)

"{20140000-0102-0409-0000-0000000FF1CE}" = Microsoft Office MondoOnly MUI (English) 2010 (Beta)

"{20140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)

"{20140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010 (Beta)

"{20140000-011A-0000-0000-0000000FF1CE}" = Microsoft Office Send-a-Smile

"{20165891-91F8-45F9-A90A-307C7179C515}" = Sins of a Solar Empire - Trinity

"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI

"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24

"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager

"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquer™ Alarmstufe Rot 3

"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2

"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE

"{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}" = Rome - Total War - Gold Edition

"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI

"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2

"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest

"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD

"{433BF933-81D6-4646-A318-3DE5DB6108F2}" = Icewind Dale - Herz des Winters

"{47957648-B46A-4211-85E1-01A15B6A1B45}" = Ace of Spades

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A8B461A-9336-4CF9-98F4-14DD38E673F0}" = BioShock 2

"{4E2FAB2F-9004-40D6-8BF8-DB2F2DA16DEC}" = Crashday Patch#2

"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works

"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight

"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI

"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI

"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV

"{588C135F-0B15-4A02-8F2D-04697BE2904E}" = Icewind Dale II

"{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}" = TES Construction Set

"{5BDAA2F7-8E48-4AFF-AA92-B559D0CDF1AD}" = Serious Sam: The Second Encounter

"{607169F0-07F6-4797-99D2-D5E7C4715E20}" = Mega Manager

"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City

"{628C3D50-F524-4C49-A958-672CE7953756}" = Der Herr der Ringe® - Die Eroberung™

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre

"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI

"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6C90C4C4-559D-4FE8-A4BF-37550E74D1FC}" = Bloodline Champions

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2

"{71E6124C-FA50-447B-B044-47A682627C26}" = Anno 1404 (Demo)

"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)

"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™

"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver

"{7AF32AB1-CB97-11D4-9607-0050BA84F5F7}" = Baldur's Gate(TM) II - Schatten von Amn(TM)

"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI

"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX

"{8047C1BD-BB4D-4C64-A8EF-A34A45D71F04}" = Xpand Rally Xtreme

"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI

"{815050E5-F545-11D4-9569-004095812ACC}" = Serious Sam: Der erste Kontakt

"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2

"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3

"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI

"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster

"{99A37AC7-E724-4621-B167-500B5A52B69C}" = LastChaos

"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9C27ADE1-EAFB-4BB7-9FE3-5DD9BA9A3DD2}" = Crashday

"{9FB2CE8C-E86C-4368-B3C9-F472898F926E}" = Desert Storm

"{A174402A-2EE6-4B86-A930-7BC85A9933BD}" = Tom Clancy's Splinter Cell

"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management

"{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}" = Hitman Blood Money

"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology

"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch

"{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1

"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins

"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{B3620221-A9E3-43AD-BDB9-985C88E85AC1}" = Silent Storm

"{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator

"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4

"{B73B4A99-4173-4747-BBEC-0F05E966F9D2}" = Battlefield 1942: Secret Weapons of WWII

"{B785CA1C-3EA0-4EFC-91BC-330EC34555BA}" = GhostMaster

"{B7E68A6D-1C9B-4F18-B021-949115021714}" = COMPUTERBILD Vorteil-Center

"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI

"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War

"{C194D333-B84A-4BB7-B35E-060732D98DC4}" = GPGNet

"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™

"{C9E270CC-AE42-4BD8-B9C6-1EB3A8657FF5}" = Just Cause 1.00.0000

"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kanes Rache

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1

"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management

"{D0106CC2-E34B-4FA3-B6B6-91F0ACEA2CC3}" = Hearts of Iron III

"{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}" = Battlefield 1942: The Road To Rome

"{D37FE0E3-B1A9-4E41-AB5D-DA62E04D2C42}" = Alpha Protocol

"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management

"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI

"{D54049D3-256C-4E19-AAE9-861F6B00BF29}" = AGEIA GAME System Software

"{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT

"{D99DFFE0-EBB5-4A3E-8430-7995353E6870}" = Stranded 2

"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3

"{E074FB23-D61B-4C6A-AD15-AB9695ED2EF7}" = Red Faction® II

"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI

"{ECCA8FE7-767A-4C8A-9DAA-BAB60F877C41}" = Sins of a Solar Empire

"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Labor Basisversion

"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page

"{EFC97089-04D6-42CE-A707-A343B4A7D2CD}" = Ghost Recon Advanced Warfighter

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2

"{F428768A-BA63-43A5-86E9-7F0CFD174944}" = Command & Conquer 3 Tiberium Wars(TM) Worldbuilder

"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician

"{FC123EEA-330A-4685-911C-95B8F5E9DE68}" = Thief - Deadly Shadows

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Avira AntiVir Desktop" = Avira Free Antivirus

"BandiMPEG1" = Bandisoft MPEG-1 Decoder

"Black Prophecy_is1" = Black Prophecy

"Canon MP550 series Benutzerregistrierung" = Canon MP550 series Benutzerregistrierung

"CanonMyPrinter" = Canon Utilities My Printer

"CanonSolutionMenu" = Canon Utilities Solution Menu

"CCleaner" = CCleaner

"Clonk Planet" = Clonk Planet

"Combat Arms EU" = Combat Arms EU

"conduitEngine" = Conduit Engine

"Cossacks : Back To War" = Cossacks - Back To War

"Counter-Strike Source 1.9.1" = Counter-Strike Source 1.9.1

"Cultures - Die Entdeckung Vinlands" = Cultures - Die Entdeckung Vinlands

"Defcon_is1" = Defcon v1.6

"Diablo II" = Diablo II

"Divinity II - Ego Draconis_is1" = Divinity II - Ego Draconis

"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX

"ESN Sonar-0.70.4" = ESN Sonar

"EVE" = EVE Online (remove only)

"Fallout 2" = Fallout 2

"Fallout New Vegas_is1" = Fallout New Vegas

"Fraps" = Fraps (remove only)

"FRITZ! 2.0" = AVM FRITZ!

"Glary Utilities_is1" = Glary Utilities 2.41.0.1358

"Greed Corp_is1" = Greed Corp

"Icewind Dale" = Icewind Dale

"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker

"InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7

"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2

"InstallShield_{8047C1BD-BB4D-4C64-A8EF-A34A45D71F04}" = Xpand Rally Xtreme

"InstallShield_{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT

"IrfanView" = IrfanView (remove only)

"JDownloader" = JDownloader

"Lexmark X1100 Series" = Lexmark X1100 Series

"Little Fighter 2" = Little Fighter 2 version 2.0a

"LOLReplay" = LOLReplay

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Mozilla Firefox 10.0.1 (x86 de)" = Mozilla Firefox 10.0.1 (x86 de)

"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Office14.MONDO" = Microsoft Office Mondo 2010

"OpenAL" = OpenAL

"Origin" = Origin

"Pflanzen gegen Zombies" = Pflanzen gegen Zombies

"PokerStars.net" = PokerStars.net

"Prototype_is1" = Prototype

"PunkBusterSvc" = PunkBuster Services

"Rekkaturvat" = Truck Dismount (remove only)

"RollerCoaster Tycoon Setup" = Roll

"S.T.A.L.K.E.R. - Shadow of Chernobyl_is1" = S.T.A.L.K.E.R. - Shadow of Chernobyl

"S4Uninst" = Die Siedler IV

"Sid Meier's Colonization" = Sid Meier's Colonization 1.0

"Soldat patch 1.4.2-1.5.0_is1" = Soldat 1.5.0

"Soldat_is1" = Soldat 1.4.2

"ST6UNST #1" = Defcon-5 WEP KeyGen

"ST6UNST #2" = Defcon-5 WEP KeyGen (C:\Program Files\WEP KeyGen\)

"ST6UNST #3" = Defcon-5 WEP KeyGen (C:\Program Files\WEP KeyGen\) #3

"StarCraft" = StarCraft

"Steam App 550" = Left 4 Dead 2

"The KMPlayer" = The KMPlayer (remove only)

"ThiefDeinstallKey" = Dark Project: Der Meisterdieb

"Thunder Brigade" = Thunder Brigade

"uTorrent" = µTorrent

"uTorrentBar_DE Toolbar" = uTorrentBar_DE Toolbar

"Vindictus EU" = Vindictus EU

"VLC media player" = VLC media player 1.1.11

"Warcraft III" = Warcraft III

"WEB.DE SmartSurfer" = WEB.DE SmartSurfer

"WinRAR archiver" = WinRAR archiver

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}" = Supreme Commander

"{31D95937-B237-405D-920C-A3EF4E482395}" = Supreme Commander - Forged Alliance

"{8D722BFA-5764-4A36-85D1-839F991CF641}" = Space Siege Demo

"{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103}" = Dark Messiah 

"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4

"Crysis WARHEAD(R)" = Crysis WARHEAD(R)

"Sins of a Solar Empire" = Sins of a Solar Empire

"Sins of a Solar Empire - Trinity" = Sins of a Solar Empire - Trinity

"StarOffice 7" = StarOffice 7

 
 ========== Last 10 Event Log Errors ==========

 

Error: Unable to start EventLog service!

 

< End of report >

--- --- ---

Mein Name wurde übrigens durch *** ersetzt.

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

:OTL

SRV - [2011.11.12 19:08:16 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Stopped] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found

 :Files

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
führe jetzt lsp fix aus:
LSPfix - Freeware - DE - Download.CHIP.eu
teste ob alle browser funktionieren.

Leider kam die Antwort ein wenig spät, sodass ich jenes erst am Sonntag ausführen kann.

Melde mich dann aber sofort

heut ist feiertag, das ist dir hoffendlich schon klar :-) da können antworten schon mal dauern.

wie könnte ich nur meinen Helfer anprangern, also ich bitte dich^^
sollte natürlich kein Vorwurf sein.

Hier der OTL-Bericht:

All processes killed
========== OTL ==========
Service Update-Service stopped successfully!
Service Update-Service deleted successfully!
C:\Windows\System32\UpdSvc.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000007\ deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: ***
->Flash cache emptied: 3130812 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 3,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ***
->Temp folder emptied: 41404 bytes
->Temporary Internet Files folder emptied: 1098260 bytes
->Java cache emptied: 1623987 bytes
->FireFox cache emptied: 49759010 bytes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 757760 bytes
%systemroot%\System32 .tmp files removed: 1598848 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 52,00 mb

OTL by OldTimer - Version 3.2.42.2 log created on 05062012_120724

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Und Lsp-Fix hat keine Probleme gefunden, aber dennoch gehen die Browser nicht (Firefox, IE), aber das liegt auch daran, dass allgemein der Rechner sich nicht mit dem Internet verbinden kann.

start ausführen, tippe:
cmd.exe
strg+shift+enter
nachfrage von uac bestätigen
netsh winsock reset
eingeben
enter
wenn keine fehlermeldung aufkommt:
exit
enter
neustart, internet testen.
ansonsten bescheid geben welche meldung auftritt

wenn ich netsh winsock reset eingebe, bräuchte ich erhöhte Rechte.

Aber bevor ich das ausprobiert hatte, ging das Internet wieder ganz normal. Gestern nach Lsp-Fix ging es noch nicht.

deswegen solltest du die eingabeaufforderung genauso starten, wie ichs gesagt hatte.
geht das internet für alle instalierten browser? internet explorer auch?

achso ich soll nach im Ausführen-Fenster Strg+Shift+Enter benutzen

diese Nachfrage von uac kam aber nicht. Und ja alle Browser funktionieren.

Jetzt kommt aber ein weiteres Problem dazu.
Ein neuer Trojaner namens TR/Crypt.ZPack.Gen2 wurde direkt nach dem Start gefunden.

Dabei hatte ich den PC nur dann an, wenn ich deinen Anweisungen gefolgt bin.

und woher soll ich wissen wo er gefunden wurde wenn edu es nicht schreibst?

achja sorry da war was.

Der Trojaner ist in der wie schon zuvor befallenen Datei

Windows/System32/xptn0r8k.tsp

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

So hier die Logfile:

Combofix Logfile:

Code:

ComboFix 12-05-08.01 - *** 08.05.2012   9:31.1.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1936 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\***\AppData\Roaming\.#

c:\users\***\AppData\Roaming\FFSJ

c:\users\***\AppData\Roaming\FFSJ\FFSJ.cfg

c:\windows\IsUn0407.exe

c:\windows\system32\Msvcrt.1

c:\windows\unin0407.exe

D:\install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-04-08 bis 2012-05-08  ))))))))))))))))))))))))))))))

.

.

2012-05-06 10:07 . 2012-05-06 10:07        --------        d-----w-        C:\_OTL

2012-04-27 15:54 . 2012-04-27 15:54        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2012-04-27 15:53 . 2012-04-27 15:53        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-27 15:53 . 2012-04-27 15:55        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-04-27 15:53 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-20 17:39 . 2012-04-20 17:43        --------        d-----w-        c:\program files\Thief - Deadly Shadows

2012-04-11 08:45 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{EAA02FE7-316E-4557-B32B-AE944BEB9E9F}\mpengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-17 17:58 . 2009-01-17 10:56        140800        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2012-04-17 17:58 . 2011-04-14 11:31        283304        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2012-04-17 17:58 . 2009-01-17 10:55        283304        ----a-w-        c:\windows\system32\PnkBstrB.exe

2012-04-17 17:58 . 2009-01-17 10:55        280904        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2012-02-23 08:18 . 2011-03-06 09:43        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-14 17:55 . 2011-03-09 08:57        235        ----a-w-        c:\windows\system32\nxEuUninstall.bat

2012-02-14 17:55 . 2011-03-09 08:57        446464        ----a-w-        c:\windows\NEXON_EU_DownloaderUpdater.exe

2012-02-14 10:27 . 2009-01-17 10:54        76888        ----a-w-        c:\windows\system32\PnkBstrA.exe

2012-02-14 10:24 . 2009-01-17 10:55        138056        ----a-w-        c:\users\***\AppData\Roaming\PnkBstrK.sys

2012-04-09 08:26 . 2011-04-03 07:30        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{c840e246-6b95-475e-9bd7-caa1c7eca9f2}"= "c:\program files\uTorrentBar_DE\tbuTor.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2010-12-09 11:51        3911776        ----a-w-        c:\program files\ConduitEngine\ConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]

2010-12-09 11:51        3911776        ----a-w-        c:\program files\uTorrentBar_DE\tbuTor.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{c840e246-6b95-475e-9bd7-caa1c7eca9f2}"= "c:\program files\uTorrentBar_DE\tbuTor.dll" [2010-12-09 3911776]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2}"= "c:\program files\uTorrentBar_DE\tbuTor.dll" [2010-12-09 3911776]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-03-04 22:38        121392        ----a-w-        c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 5369856]

"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-06-06 203296]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2009-08-17 85888]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2012-4-20 497152]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]

backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]

backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]

2008-01-09 17:43        326176        ----a-w-        c:\acer\Empowering Technology\SysMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]

2009-07-27 02:10        1983816        ----a-w-        c:\program files\Canon\MyPrinter\BJMYPRT.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]

2009-03-18 01:40        767312        ----a-w-        c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]

2008-03-04 22:38        526896        ----a-w-        c:\acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU]

2012-02-14 17:53        438272        ----a-w-        c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMMediaSharing]

2008-01-25 17:49        204908        ----a-w-        c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-10-29 13:49        249064        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]

2006-11-05 19:48        57344        ----a-w-        c:\acer\WR_PopUp\WarReg_PopUp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"Skytel"=Skytel.exe

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"lxbkbmgr.exe"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2008-01-25 269448]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Update-Service-Installer-Service        REG_MULTI_SZ           Update-Service-Installer-Service

Update-Service        REG_MULTI_SZ           Update-Service

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

.

Inhalt des "geplante Tasks" Ordners

.

2012-05-08 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2012-01-13 08:50]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://de.intl.acer.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{3059536D-C6FF-4A7F-BBB5-ED3FF977FDCB}: NameServer = 192.168.120.252,192.168.120.253

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\8ns316pj.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-AIRSTRIKE3D - c:\program files\Blimb Entertainment\AIRSTRIKE3D\uninstall.exe

AddRemove-Cultures - Die Entdeckung Vinlands - c:\windows\IsUn0407.exe

AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe

AddRemove-S4Uninst - c:\windows\IsUn0407.exe

AddRemove-ThiefDeinstallKey - c:\windows\IsUn0407.exe

AddRemove-Thunder Brigade - c:\windows\IsUn0407.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-05-08 09:38

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3751203636-424131746-382816556-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

@Allowed: (Read) (RestrictedCode)

"??"=hex:32,58,63,00,c1,45,a0,4f,5c,b9,36,61,c5,6b,64,cf,ee,63,f5,bf,da,2e,b5,

   af,f5,48,05,12,e4,63,9d,fe,85,79,7c,2b,e2,76,39,7d,67,05,d4,41,d9,05,e8,ac,\

"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49

.

[HKEY_USERS\S-1-5-21-3751203636-424131746-382816556-1000\Software\SecuROM\License information*]

"datasecu"=hex:1c,9f,db,22,e8,90,85,48,ce,ea,92,3d,2f,a0,2a,c9,c1,8a,ab,62,83,

   bc,ed,4d,37,98,e5,b0,3e,c9,95,90,07,ae,fb,05,4e,c7,b7,03,f2,73,52,15,ee,d7,\

"rkeysecu"=hex:09,59,1b,f3,86,2b,14,fd,c5,97,8f,90,41,c3,69,23

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(4944)

c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

c:\acer\Empowering Technology\eDataSecurity\x86\sysenv.dll

.

Zeit der Fertigstellung: 2012-05-08  09:41:34

ComboFix-quarantined-files.txt  2012-05-08 07:41

.

Vor Suchlauf: 24 Verzeichnis(se), 38.227.046.400 Bytes frei

Nach Suchlauf: 28 Verzeichnis(se), 38.640.611.328 Bytes frei

.

- - End Of File - - BD65581A823619650B99515CF6F00E16

--- --- ---

Nach dem Neustart kam keine Fehlermeldung

hi
1. poste mal die fundmeldung als text über die
xptn0r8k.tsp
2.

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Hier der Fund:

07.05.2012 16:53 [Echtzeit Scanner] Malware gefunden
In der Datei 'C:\Windows\System32\xptn0r8k.tsp'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern

und hier der Bericht von Malwarebytes

Malwarebytes Anti-Malware (Test) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.05.08.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19088
*** :: ***-PC [Administrator]

Schutz: Aktiviert

08.05.2012 17:32:47
mbam-log-2012-05-08 (17-32-47).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 557058
Laufzeit: 1 Stunde(n), 6 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

:OTL

C:\Windows\System32\xptn0r8k.tsp'

 :Files

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: ***
->Flash cache emptied: 456 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ***
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 1680477 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7319070 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 43 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 9,00 mb

OTL by OldTimer - Version 3.2.42.2 log created on 05082012_201216

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

poste mir noch mal ein frisches otl log bitte

ich hoffe du meinst sowasOTL Logfile:

Code:

OTL logfile created on: 08.05.2012 21:20:24 - Run 2

OTL by OldTimer - Version 3.2.42.2     Folder = C:\Users\Kleinod\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19088)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 61,60% Memory free

10,73 Gb Paging File | 9,44 Gb Available in Paging File | 87,95% Paging File free

Paging file location(s): c:\pagefile.sys 8000 8000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 293,33 Gb Total Space | 35,36 Gb Free Space | 12,05% Space Free | Partition Type: NTFS

Drive D: | 293,08 Gb Total Space | 109,62 Gb Free Space | 37,40% Space Free | Partition Type: NTFS

Drive E: | 1,78 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive N: | 3,71 Gb Total Space | 3,55 Gb Free Space | 95,52% Space Free | Partition Type: FAT32

 

Computer Name: KLEINOD-PC | User Name: Kleinod | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.08 17:28:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.05.08 17:28:18 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.08 17:28:18 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.08 17:28:18 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.04.30 18:56:28 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Kleinod\Desktop\OTL.exe

PRC - [2012.04.20 10:33:24 | 000,497,152 | ---- | M] (LOL Replay) -- C:\Programme\LOLReplay\LOLRecorder.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2011.10.15 10:53:00 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe

PRC - [2011.10.15 10:53:00 | 001,328,960 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe

PRC - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2009.04.11 00:28:16 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE

PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.06.06 19:17:16 | 000,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvraidservice.exe

PRC - [2008.03.26 15:21:30 | 005,369,856 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) -- C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

PRC - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) -- C:\Windows\System32\lxbkcoms.exe

PRC - [2008.01.25 19:49:04 | 000,269,448 | ---- | M] (CyberLink) -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.21 04:23:24 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdSync.exe

PRC - [2007.12.19 19:09:22 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

PRC - [2007.12.18 11:13:54 | 000,132,560 | ---- | M] (United Internet AG) -- C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe

PRC - [2007.10.17 11:38:20 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

PRC - [2007.09.10 15:28:18 | 000,057,344 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.20 10:33:22 | 000,265,728 | ---- | M] () -- C:\Programme\LOLReplay\LOLUtils.dll

MOD - [2012.03.05 14:45:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll

MOD - [2012.01.31 12:37:24 | 012,907,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\03c1786328450d3eb3129a6ee9c161d0\System.Windows.Forms.ni.dll

MOD - [2012.01.31 12:37:17 | 001,653,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6abcaa7df5e346b0912197bcf7fcab15\System.Drawing.ni.dll

MOD - [2012.01.31 12:37:10 | 005,764,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\1d2279b148a6fb152f2a45b7d31fff2d\System.Xml.ni.dll

MOD - [2012.01.31 12:37:06 | 001,016,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\0360226da2794a6b15a262f3e48709ef\System.Configuration.ni.dll

MOD - [2012.01.31 12:37:04 | 008,367,616 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b9b3afa5f4ba74c561f0fa1bfceba7e0\System.ni.dll

MOD - [2012.01.31 12:35:58 | 015,424,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\3cdbdfe526ccd9eef32943313ea0231d\PresentationFramework.ni.dll

MOD - [2012.01.31 12:35:44 | 013,094,912 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\4861ab3c08650851bc270cebd6745e99\PresentationCore.ni.dll

MOD - [2012.01.31 12:35:32 | 003,568,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6a17ee74a7d2abf0a25e989efe881f3c\WindowsBase.ni.dll

MOD - [2012.01.31 12:32:16 | 002,517,504 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\5f3a699a62a098beef04f48514c47a58\System.Core.ni.dll

MOD - [2012.01.29 14:10:59 | 000,406,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\6cd5c2f950025f574dde718eb20af161\PresentationFramework.Aero.ni.dll

MOD - [2009.08.21 16:47:12 | 004,361,056 | ---- | M] () -- C:\Programme\Microsoft Office\Office14\1033\GrooveIntlResource.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.05.08 17:28:19 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.08 17:28:18 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.04.20 17:08:32 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2009.08.21 16:47:14 | 030,510,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2009.08.21 16:39:22 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.08.21 16:36:08 | 004,639,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.07.26 06:43:14 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- d:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)

SRV - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)

SRV - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbkcoms.exe -- (lxbk_device)

SRV - [2008.01.25 19:49:04 | 000,269,448 | ---- | M] (CyberLink) [Auto | Running] -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)

SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.21 04:23:24 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2008.01.21 04:23:24 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2007.12.19 19:09:22 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)

SRV - [2007.12.18 11:13:54 | 000,132,560 | ---- | M] (United Internet AG) [Auto | Running] -- C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe -- (SmartSurferManager)

SRV - [2007.10.17 11:38:20 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)

SRV - [2007.09.10 15:28:18 | 000,057,344 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)

SRV - [2005.09.23 17:45:46 | 000,315,392 | ---- | M] (AVM Berlin) [On_Demand | Stopped] -- C:\Programme\Common Files\AVM\De_serv.exe -- (de_serv)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Kleinod\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - [2012.05.08 17:28:19 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.05.08 17:28:19 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.10.15 10:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.07.08 01:21:28 | 000,139,880 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2010.10.13 08:00:27 | 000,078,848 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\SSHDRV85.sys -- (SSHDRV85)

DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.31 13:15:51 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.07.31 13:15:50 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.01.15 19:36:52 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2008.12.25 13:02:13 | 000,015,172 | ---- | M] (Prassi Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PzWDM.sys -- (PzWDM)

DRV - [2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2008.06.07 12:13:40 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2008.02.12 04:42:38 | 000,232,472 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)

DRV - [2008.02.05 02:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)

DRV - [2007.11.18 04:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2007.11.06 10:30:48 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\zntport.sys -- (zntport)

DRV - [2007.11.06 10:30:46 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TVicPort.sys -- (tvicport)

DRV - [2007.07.07 15:13:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

DRV - [2007.07.03 04:05:20 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)

DRV - [2007.05.07 03:00:00 | 000,537,600 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fpcibase.sys -- (FPCIBASE)

DRV - [2007.05.07 03:00:00 | 000,064,512 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)

DRV - [2005.09.23 17:38:44 | 000,316,928 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Netfritz.sys -- (NETFRITZ)

DRV - [2004.05.24 14:35:06 | 000,059,520 | ---- | M] (AVM Berlin) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\avmport.sys -- (AVMPORT)

DRV - [2003.01.14 11:41:10 | 000,273,664 | ---- | M] (AGFEO GmbH & Co. KG) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\AGFUCAPI.sys -- (agfucapi)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland

IE - HKLM\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Acer.com Worldwide - Select your local country or region [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=19764&mntrId=2cec11f30000000000000007776409320932

IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-acer

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.09 10:26:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.15 18:39:29 | 000,000,000 | ---D | M]

 

[2011.03.06 11:49:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Extensions

[2012.04.27 19:21:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions

[2012.03.03 11:19:07 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.04.27 17:16:56 | 000,000,000 | ---D | M] (uTorrentBar_DE Community Toolbar) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}

[2011.04.03 19:35:01 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\engine@conduit.com

[2011.09.30 15:05:00 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Kleinod\AppData\Roaming\mozilla\Firefox\Profiles\8ns316pj.default\extensions\ffxtlbr@babylon.com

[2011.11.15 18:05:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

() (No name found) -- C:\USERS\KLEINOD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8NS316PJ.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI

() (No name found) -- C:\USERS\KLEINOD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8NS316PJ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012.04.09 10:26:34 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.03.06 13:14:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.04.09 10:26:32 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.24 17:54:18 | 000,002,291 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2012.04.09 10:26:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.04.09 10:26:32 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.04.09 10:26:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.04.09 10:26:32 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.04.09 10:26:32 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.05.08 09:38:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.30.0\bh\BabylonToolbar.dll (Babylon BHO)

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll̀ File not found

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.30.0\BabylonToolbarTlbr.dll (Babylon Ltd.)

O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)

O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar_DE Toolbar) - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Se&nd to OneNote - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FC76DB2-719C-4570-9177-8E5A30E0FE49}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3059536D-C6FF-4A7F-BBB5-ED3FF977FDCB}: NameServer = 192.168.120.252,192.168.120.253

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Kleinod\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Kleinod\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2012.01.06 17:31:24 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O32 - AutoRun File - [2012.01.06 17:55:32 | 000,806,912 | R--- | M] (Ion Storm) - E:\Autorun.exe -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player 5.2

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe - (Acer Inc.)

MsConfig - StartUpFolder: C:^Users^Kleinod^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()

MsConfig - StartUpReg: Acer Empowering Technology Monitor - hkey= - key= - C:\Acer\Empowering Technology\SysMonitor.exe ()

MsConfig - StartUpReg: CanonMyPrinter - hkey= - key= - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)

MsConfig - StartUpReg: CanonSolutionMenu - hkey= - key= - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)

MsConfig - StartUpReg: eDataSecurity Loader - hkey= - key= - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)

MsConfig - StartUpReg: KPeerNexonEU - hkey= - key= - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe (NEXON Inc.)

MsConfig - StartUpReg: PCMMediaSharing - hkey= - key= - C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: WarReg_PopUp - hkey= - key= - C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.08 09:41:36 | 000,000,000 | ---D | C] -- C:\Users\Kleinod\AppData\Local\temp

[2012.05.08 09:40:05 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.05.08 09:29:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.05.08 09:29:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.05.08 09:29:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.05.08 09:29:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.05.08 09:29:15 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.05.08 09:29:12 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.05.08 09:28:43 | 004,487,855 | R--- | C] (Swearware) -- C:\Users\Kleinod\Desktop\ComboFix.exe

[2012.05.06 12:13:24 | 000,186,880 | ---- | C] (CEXX.ORG) -- C:\Users\Kleinod\Desktop\LSPFix.exe

[2012.05.06 12:07:24 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.04.30 19:03:06 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Kleinod\Desktop\OTL.exe

[2012.04.27 17:54:05 | 000,000,000 | ---D | C] -- C:\Users\Kleinod\AppData\Roaming\Malwarebytes

[2012.04.27 17:53:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.27 17:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.27 17:53:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.27 17:53:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.04.27 17:53:00 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Kleinod\Desktop\mbam-setup-1.60.0.1800.exe

[2012.04.20 19:44:15 | 000,000,000 | ---D | C] -- C:\Users\Kleinod\Documents\Thief - Deadly Shadows

[2012.04.20 19:43:35 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Thief - Deadly Shadows

[2012.04.20 19:39:51 | 000,000,000 | ---D | C] -- C:\Program Files\Thief - Deadly Shadows

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.08 21:21:25 | 000,690,600 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.05.08 21:21:25 | 000,647,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.05.08 21:21:25 | 000,152,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.05.08 21:21:25 | 000,125,216 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.05.08 21:15:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.05.08 21:15:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.05.08 21:15:14 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job

[2012.05.08 21:14:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.05.08 17:28:19 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.05.08 17:28:19 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.05.08 09:38:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.05.08 07:19:00 | 004,487,855 | R--- | M] (Swearware) -- C:\Users\Kleinod\Desktop\ComboFix.exe

[2012.04.30 18:56:28 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Kleinod\Desktop\OTL.exe

[2012.04.28 21:42:09 | 000,428,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.04.28 20:09:14 | 000,002,855 | ---- | M] () -- C:\Users\Kleinod\Desktop\dds.PIF

[2012.04.28 19:59:19 | 000,000,020 | ---- | M] () -- C:\Users\Kleinod\defogger_reenable

[2012.04.27 17:55:04 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.27 17:53:23 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Kleinod\Desktop\mbam-setup-1.60.0.1800.exe

[2012.04.20 16:52:15 | 000,001,782 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk

[2012.04.20 16:52:15 | 000,001,690 | ---- | M] () -- C:\Users\Public\Desktop\LOL Recorder.lnk

[2012.04.17 19:58:48 | 000,140,800 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012.04.17 19:58:39 | 000,283,304 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr

[2012.04.17 19:58:25 | 000,280,904 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0

 
 ========== Files Created - No Company Name ==========

 

[2012.05.08 09:29:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.05.08 09:29:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.05.08 09:29:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.05.08 09:29:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.05.08 09:29:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.05.06 12:14:15 | 000,019,779 | ---- | C] () -- C:\Users\Kleinod\Desktop\Unit1.cpp

[2012.05.06 12:14:15 | 000,005,163 | ---- | C] () -- C:\Users\Kleinod\Desktop\LSPFix.bpr

[2012.05.06 12:14:15 | 000,002,612 | ---- | C] () -- C:\Users\Kleinod\Desktop\LSPFix.res

[2012.05.06 12:14:15 | 000,002,564 | ---- | C] () -- C:\Users\Kleinod\Desktop\Unit1.dfm

[2012.05.06 12:14:15 | 000,001,796 | ---- | C] () -- C:\Users\Kleinod\Desktop\Unit1.h

[2012.05.06 12:14:15 | 000,000,756 | ---- | C] () -- C:\Users\Kleinod\Desktop\LSPFix.cpp

[2012.05.06 12:13:24 | 000,011,445 | ---- | C] () -- C:\Users\Kleinod\Desktop\LSPFix-source.zip

[2012.04.28 21:41:57 | 000,428,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.04.28 20:09:14 | 000,002,855 | ---- | C] () -- C:\Users\Kleinod\Desktop\dds.PIF

[2012.04.28 19:59:02 | 000,000,020 | ---- | C] () -- C:\Users\Kleinod\defogger_reenable

[2012.04.27 17:53:44 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.31 22:40:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2011.12.31 22:39:59 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.05.31 08:39:50 | 000,058,368 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll

[2011.05.31 08:38:18 | 000,015,360 | ---- | C] () -- C:\Windows\System32\bdmjpeg.dll

[2011.04.21 18:45:32 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll

[2011.04.21 18:45:32 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll

[2011.04.21 18:45:32 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll

[2011.04.21 18:18:10 | 000,070,308 | ---- | C] () -- C:\Windows\DIIUnin.dat

[2011.04.14 11:30:01 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe

[2011.02.17 18:50:02 | 000,040,960 | ---- | C] () -- C:\Windows\System32\psfind.dll

[2010.11.20 19:49:45 | 000,001,356 | ---- | C] () -- C:\Users\Kleinod\AppData\Local\d3d9caps.dat

[2010.10.30 20:18:57 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE

[2010.10.13 08:00:27 | 000,078,848 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV85.sys

[2010.06.20 18:01:57 | 000,000,674 | ---- | C] () -- C:\Windows\eReg.dat

 
 ========== LOP Check ==========

 

[2011.08.12 18:29:16 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\.minecraft

[2011.09.24 17:54:18 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Babylon

[2011.06.18 09:06:31 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Bioshock2

[2010.08.29 10:50:35 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Canon

[2010.10.17 11:14:18 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.18 17:14:41 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2010.06.19 10:10:36 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\DAEMON Tools

[2012.01.13 13:44:21 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\DAEMON Tools Lite

[2010.06.19 10:10:33 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\DAEMON Tools Pro

[2011.04.09 13:22:37 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Firefly Studios

[2011.09.24 17:21:57 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\FRITZ!

[2012.01.13 14:22:25 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\GlarySoft

[2008.12.25 20:22:04 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Leadertech

[2011.06.08 09:53:03 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\LolClient

[2010.11.27 18:27:06 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\OpenOffice.org

[2011.11.11 20:07:34 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Origin

[2011.12.04 15:06:48 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\RIFT

[2010.05.07 18:05:15 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\runic games

[2010.09.07 17:39:50 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\SEGA Corporation

[2012.01.13 10:53:27 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\SmartSurfer

[2011.04.10 20:04:08 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Stardock

[2011.04.08 13:14:36 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\The Creative Assembly

[2011.04.06 19:00:29 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\Ubisoft

[2012.01.13 13:44:16 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\uTorrent

[2011.05.30 19:56:44 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\wargaming.net

[2008.12.30 14:42:11 | 000,000,000 | ---D | M] -- C:\Users\Kleinod\AppData\Roaming\WEBDE

[2012.05.08 21:15:14 | 000,000,318 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job

[2012.05.08 20:15:27 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2012.05.08 09:40:05 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2012.02.07 13:53:24 | 000,000,000 | ---D | M] -- C:\Ace of Spades

[2008.09.24 13:40:50 | 000,000,000 | ---D | M] -- C:\Acer

[2011.04.10 06:18:15 | 000,000,000 | ---D | M] -- C:\BDS

[2008.03.21 23:05:47 | 000,000,000 | ---D | M] -- C:\Book

[2011.12.31 23:02:33 | 000,000,000 | ---D | M] -- C:\Boot

[2012.05.08 09:41:37 | 000,000,000 | ---D | M] -- C:\ComboFix

[2009.05.09 10:34:50 | 000,000,000 | ---D | M] -- C:\CrashReport

[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2008.12.25 12:42:41 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2012.02.14 19:53:50 | 000,000,000 | ---D | M] -- C:\Download

[2009.01.10 18:19:24 | 000,000,000 | ---D | M] -- C:\drivers

[2008.09.24 22:21:49 | 000,000,000 | ---D | M] -- C:\DRV

[2008.12.25 12:55:51 | 000,000,000 | ---D | M] -- C:\EGIS_Drive

[2011.09.30 20:07:46 | 000,000,000 | ---D | M] -- C:\Fraps

[2011.09.30 20:59:43 | 000,000,000 | ---D | M] -- C:\Games

[2009.11.30 20:03:31 | 000,000,000 | R--D | M] -- C:\MSOCache

[2012.02.14 20:01:43 | 000,000,000 | ---D | M] -- C:\Nexon

[2011.12.31 22:30:25 | 000,000,000 | ---D | M] -- C:\NVIDIA

[2008.01.21 04:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.04.27 17:53:41 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.04.27 17:53:42 | 000,000,000 | ---D | M] -- C:\ProgramData

[2008.12.25 12:42:41 | 000,000,000 | -HSD | M] -- C:\Programme

[2012.05.08 09:41:37 | 000,000,000 | ---D | M] -- C:\Qoobox

[2011.06.08 09:25:35 | 000,000,000 | ---D | M] -- C:\Riot Games

[2012.05.08 21:15:21 | 000,000,000 | ---D | M] -- C:\SmartSurfer

[2010.11.10 21:04:02 | 000,000,000 | ---D | M] -- C:\Soldat

[2012.05.08 21:21:47 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2010.07.01 18:11:33 | 000,000,000 | ---D | M] -- C:\temp

[2011.12.31 22:37:05 | 000,000,000 | R--D | M] -- C:\Users

[2009.12.22 21:09:57 | 000,000,000 | ---D | M] -- C:\VivoxLogs

[2012.05.08 09:38:58 | 000,000,000 | ---D | M] -- C:\Windows

[2012.05.06 12:07:24 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe

[2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2005.10.12 06:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_2517c98a\iaStor.sys

[2005.10.12 06:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ef2f01d9\iaStor.sys

[2006.06.13 22:56:40 | 000,247,808 | ---- | M] (Intel Corporation) MD5=580BFEC487C55264BFE3D60C3C24EEE1 -- C:\Windows\System32\drivers\iaStor.sys

[2006.06.13 22:56:40 | 000,247,808 | ---- | M] (Intel Corporation) MD5=580BFEC487C55264BFE3D60C3C24EEE1 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_d8b4315a\iaStor.sys

[2006.06.13 22:56:40 | 000,247,808 | ---- | M] (Intel Corporation) MD5=580BFEC487C55264BFE3D60C3C24EEE1 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_101ee613\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2007.12.08 07:28:10 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=689A2160B851F8BF88F20728FD2F30BD -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_a5207023\nvstor32.sys

[2007.09.11 09:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_4b699c67\nvstor32.sys

[2007.09.11 09:19:18 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=AFD01721DC3297E6715C5F472DD8BCCD -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_8225a48e\nvstor32.sys

[2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D7B213299852D2026DBC90DAB77EF06C -- C:\DRV\RAID\NVIDIA\nvstor32.sys

[2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D7B213299852D2026DBC90DAB77EF06C -- C:\DRV\RaidV2\nvstor32.sys

[2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D7B213299852D2026DBC90DAB77EF06C -- C:\Windows\System32\drivers\nvstor32.sys

[2008.06.07 12:13:40 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D7B213299852D2026DBC90DAB77EF06C -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_52f8ebc7\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.03.21 23:08:02 | 013,115,392 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.03.21 23:07:55 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.03.21 23:08:02 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2008.03.21 23:08:10 | 017,629,184 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2008.03.21 23:08:11 | 006,639,616 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2011.07.12 17:37:57 | 000,009,746 | ---- | M] () -- C:\Users\Kleinod\Bewerbung DRK.odt

[2012.04.28 19:59:19 | 000,000,020 | ---- | M] () -- C:\Users\Kleinod\defogger_reenable

[2009.01.04 19:27:19 | 000,035,328 | ---- | M] () -- C:\Users\Kleinod\Neue Festplatte.vhd

[2012.05.08 21:20:17 | 003,670,016 | ---- | M] () -- C:\Users\Kleinod\NTUSER.DAT

[2012.01.13 14:36:06 | 003,932,160 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT.gbck

[2012.05.08 21:20:17 | 000,262,144 | -H-- | M] () -- C:\Users\Kleinod\ntuser.dat.LOG1

[2008.12.25 12:45:34 | 000,000,000 | -H-- | M] () -- C:\Users\Kleinod\ntuser.dat.LOG2

[2012.05.08 20:15:26 | 000,065,536 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{01f3e090-3dc4-11e1-9d6a-9b01e5082ad5}.TM.blf

[2012.05.08 20:15:26 | 000,524,288 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{01f3e090-3dc4-11e1-9d6a-9b01e5082ad5}.TMContainer00000000000000000001.regtrans-ms

[2012.01.13 15:25:46 | 000,524,288 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{01f3e090-3dc4-11e1-9d6a-9b01e5082ad5}.TMContainer00000000000000000002.regtrans-ms

[2012.01.13 14:36:06 | 000,065,536 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2012.01.13 14:36:06 | 000,524,288 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2011.12.29 13:26:41 | 000,524,288 | -HS- | M] () -- C:\Users\Kleinod\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms

[2008.12.25 12:45:34 | 000,000,020 | -HS- | M] () -- C:\Users\Kleinod\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 56044 bytes -> C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM

@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
 

< End of report >

--- --- ---

danke
gabs in der zwischenzeit noch meldungen?

ne ich hatte den pc bisher nicht weiter an
ich kann ja solange vom notebook aus agieren

bitte einschalten, rechtsklick avira schirm, updaten und scannen

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 11. Mai 2012 18:38

Es wird nach 3689313 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista (TM) Home Premium
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ***-PC

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 08.05.2012 15:28:18
AVSCAN.DLL : 12.3.0.15 66256 Bytes 08.05.2012 15:28:18
LUKE.DLL : 12.3.0.15 68304 Bytes 08.05.2012 15:28:19
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 08.05.2012 15:28:19
AVREG.DLL : 12.3.0.17 232200 Bytes 11.05.2012 16:36:31
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 07:56:15
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 07:56:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 16:13:57
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:40:30
VBASE005.VDF : 7.11.29.136 2166272 Bytes 10.05.2012 16:36:23
VBASE006.VDF : 7.11.29.137 2048 Bytes 10.05.2012 16:36:24
VBASE007.VDF : 7.11.29.138 2048 Bytes 10.05.2012 16:36:24
VBASE008.VDF : 7.11.29.139 2048 Bytes 10.05.2012 16:36:24
VBASE009.VDF : 7.11.29.140 2048 Bytes 10.05.2012 16:36:24
VBASE010.VDF : 7.11.29.141 2048 Bytes 10.05.2012 16:36:24
VBASE011.VDF : 7.11.29.142 2048 Bytes 10.05.2012 16:36:24
VBASE012.VDF : 7.11.29.143 2048 Bytes 10.05.2012 16:36:24
VBASE013.VDF : 7.11.29.144 2048 Bytes 10.05.2012 16:36:24
VBASE014.VDF : 7.11.29.145 2048 Bytes 10.05.2012 16:36:24
VBASE015.VDF : 7.11.29.146 2048 Bytes 10.05.2012 16:36:24
VBASE016.VDF : 7.11.29.147 2048 Bytes 10.05.2012 16:36:24
VBASE017.VDF : 7.11.29.148 2048 Bytes 10.05.2012 16:36:24
VBASE018.VDF : 7.11.29.149 2048 Bytes 10.05.2012 16:36:24
VBASE019.VDF : 7.11.29.150 2048 Bytes 10.05.2012 16:36:24
VBASE020.VDF : 7.11.29.151 2048 Bytes 10.05.2012 16:36:24
VBASE021.VDF : 7.11.29.152 2048 Bytes 10.05.2012 16:36:24
VBASE022.VDF : 7.11.29.153 2048 Bytes 10.05.2012 16:36:24
VBASE023.VDF : 7.11.29.154 2048 Bytes 10.05.2012 16:36:24
VBASE024.VDF : 7.11.29.155 2048 Bytes 10.05.2012 16:36:24
VBASE025.VDF : 7.11.29.156 2048 Bytes 10.05.2012 16:36:24
VBASE026.VDF : 7.11.29.157 2048 Bytes 10.05.2012 16:36:24
VBASE027.VDF : 7.11.29.158 2048 Bytes 10.05.2012 16:36:24
VBASE028.VDF : 7.11.29.159 2048 Bytes 10.05.2012 16:36:24
VBASE029.VDF : 7.11.29.160 2048 Bytes 10.05.2012 16:36:24
VBASE030.VDF : 7.11.29.161 2048 Bytes 10.05.2012 16:36:24
VBASE031.VDF : 7.11.29.196 101376 Bytes 11.05.2012 16:36:25
Engineversion : 8.2.10.64
AEVDF.DLL : 8.1.2.2 106868 Bytes 31.01.2012 07:55:38
AESCRIPT.DLL : 8.1.4.19 455034 Bytes 11.05.2012 16:36:31
AESCN.DLL : 8.1.8.2 131444 Bytes 10.03.2012 16:14:13
AESBX.DLL : 8.2.5.5 606579 Bytes 13.03.2012 14:13:37
AERDL.DLL : 8.1.9.15 639348 Bytes 31.01.2012 07:55:37
AEPACK.DLL : 8.2.16.13 807287 Bytes 11.05.2012 16:36:31
AEOFFICE.DLL : 8.1.2.28 201082 Bytes 27.04.2012 15:12:45
AEHEUR.DLL : 8.1.4.25 4788598 Bytes 11.05.2012 16:36:30
AEHELP.DLL : 8.1.21.0 254326 Bytes 11.05.2012 16:36:25
AEGEN.DLL : 8.1.5.28 422260 Bytes 27.04.2012 15:11:59
AEEXP.DLL : 8.1.0.36 82292 Bytes 11.05.2012 16:36:31
AEEMU.DLL : 8.1.3.0 393589 Bytes 31.01.2012 07:55:34
AECORE.DLL : 8.1.25.6 201078 Bytes 16.03.2012 14:35:06
AEBB.DLL : 8.1.1.0 53618 Bytes 31.01.2012 07:55:33
AVWINLL.DLL : 12.3.0.15 27344 Bytes 08.05.2012 15:28:18
AVPREF.DLL : 12.3.0.15 51920 Bytes 08.05.2012 15:28:18
AVREP.DLL : 12.3.0.15 179208 Bytes 08.05.2012 15:28:19
AVARKT.DLL : 12.3.0.15 211408 Bytes 08.05.2012 15:28:18
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 08.05.2012 15:28:18
SQLITE3.DLL : 3.7.0.1 398288 Bytes 08.05.2012 15:28:19
AVSMTP.DLL : 12.3.0.15 63440 Bytes 08.05.2012 15:28:18
NETNT.DLL : 12.3.0.15 17104 Bytes 08.05.2012 15:28:19
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 08.05.2012 15:28:18
RCTEXT.DLL : 12.3.0.15 98512 Bytes 08.05.2012 15:28:18

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +PFS,+SPR,

Beginn des Suchlaufs: Freitag, 11. Mai 2012 18:38

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD4
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'RacAgent.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'capuserv.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'eRecoveryService.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '7' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SmurfService.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxbkcoms.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'eDSService.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'MemCheck.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSServer.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'LOLRecorder.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmdSync.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvraidservice.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '157' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files\Counter-Strike Source\Counter-Strike Source Configurator 1.2.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files\Counter-Strike Source\uninst.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files\Truck Dismount\uninst.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
Die Registry wurde durchsucht ( '4644' Dateien ).

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <ACER>
C:\Fraps\uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\2K Games\Colonization\DOSBox-0.72\uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\ADLSoft UnCompressor\uninstaller.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\Counter-Strike Source\Counter-Strike Source Configurator 1.2.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files\Counter-Strike Source\uninst.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files\Electronic Arts\BattleForge\base\pak\bf1_effects01.cab
[WARNUNG] Der Archivheader ist defekt
C:\Program Files\Steam\SteamApps\common\sid meier's civilization v\B224406F-3138-42DE-9E3A-A8B5BBFE21D6
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\Steam\SteamApps\common\sid meier's civilization v\F0E9C6F9-F070-4561-866E-4EB8895F952E
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files\Truck Dismount\uninst.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files\WinRAR\rarnew.dat
[WARNUNG] Das Archiv ist unbekannt oder defekt
C:\Users\***\Downloads\avira_free_antivirus_de.exe
[WARNUNG] Die Datei ist kennwortgeschützt
Beginne mit der Suche in 'D:\' <DATA>
D:\Games\World_of_Tanks\Updates\wot_66.103118_65.95961_client_eu.patch
[WARNUNG] Die Komprimierungsmethode wird nicht unterstützt
D:\Games\World_of_Tanks\Updates\wot_67.118076_64.90724_launcher_eu.patch
[WARNUNG] Die Komprimierungsmethode wird nicht unterstützt
D:\Games\World_of_Tanks\Updates\wot_67.141320_launcher_eu.patch
[WARNUNG] Die Komprimierungsmethode wird nicht unterstützt
D:\Games\World_of_Tanks\Updates\wot_70.128081_67.109535_client_eu.patch
[WARNUNG] Dieses Archiv wird nicht unterstützt
D:\Games\World_of_Tanks\Updates\wot_71.145341_launcher_eu.patch
[WARNUNG] Die Komprimierungsmethode wird nicht unterstützt
D:\Program Files\Gamigo\Black Prophecy\DATA\CONFIG.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_0897a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_091.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_092.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_093.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_0951.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_10010.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_1004.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_1006.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_1009a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_101.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_101_2.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_101_2pts.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_101_3.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_102.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_102a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_102_1.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_102_2.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_102_3b.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110a_110h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110m.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110q.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110_1.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110_1a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_110_2.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120b.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120c.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120d.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120f.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120g.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\DATA_BP_120h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_0897e.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_0898.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_091.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_092.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_093.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_0941.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_095.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_096.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_10010.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_1004.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_1007.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_1009a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_101.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_102.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110a_110h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110m.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110p.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110q.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110_1.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_110_2.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120b.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120c.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120d.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120f.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120g.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\HUD_BP_120h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\DATA\XML.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\CHARACTERS.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\FX.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_0897a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_0897e.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_0898.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_091.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_092.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_093.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_0941.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_096.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_10010.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_101.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_102.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_102a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_110a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_120b.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_120d.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\GFX_BP_120f.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\HUD.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\SHIPS.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\SPACESTATIONS.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\STATIC.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\TEXTURES.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX\WEAPONS.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_110a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_110a_110h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_110m.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_110_1.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_120f.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_ADDON_01\GFX_01_BP_120g.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_WARZONES\GFX_WARZONES_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\GFX_WARZONES\GFX_WARZONES_BP_120h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\DIALOG.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\EFFECTS.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_0897e.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_092.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_101.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_110a.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_110a_110h.pkg
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Program Files\Gamigo\Black Prophecy\SFX\SFX_BP_120.pkg
[WARNUNG] Die Datei ist kennwortgeschützt

Ende des Suchlaufs: Freitag, 11. Mai 2012 21:00
Benötigte Zeit: 2:22:11 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

34511 Verzeichnisse wurden überprüft
1572843 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1572843 Dateien ohne Befall
21667 Archive wurden durchsucht
127 Warnungen
0 Hinweise
766285 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden

lass diesen test mal auf allen pcs im haushalt laufen:
Schnelltest: Neuer Virus, ahnungslose User seit Monaten infiziert! - Paules-PC-Forum.de
ergebniss posten

Mein Notebook ist ok

Beim Pc kam diese Meldung:

DLL im Lanmanworkstation Schlüssel:
Geladene DLL:
Signatur der DLL:
Rückgabe der Signaturermittlung: Das System kann die angegebene Datei nicht finden.

MD5 der DLL:

Der Lanmanworkstation Schlüssel konnte nicht ausgelesen werden oder ist nicht vorhanden!

(Avira war an bzw. auch einmal ausgeschaltet)

reg.reg runterladen:
File-Upload.net - reg.reg
doppelklicken, bestätigen, neustart und den schnelltest noch mal ausführen

ok hat funktioniert, auch der rechner ist sauber

poste mal das ergebniss, also noch mal ausführen bitte

DLL im Lanmanworkstation Schlüssel: %SystemRoot%\System32\wkssvc.dll
Geladene DLL: C:\Windows\System32\wkssvc.dll
Signatur der DLL: Microsoft Windows
Rückgabe der Signaturermittlung: Der Vorgang wurde erfolgreich beendet.

MD5 der DLL: 1DB69705B695B987082C8BAEC0C6B34F

Alles OK, der Rechner ist nicht vom Lanmanworkstation Trojaner befallen!

ok, bitte jetzt damit alle rechner die du noch hast checken.