|
Trojan.Win32/Alureon.BT Hallo Zusammen, leider hat es mich nun scheibar auch erwischt. Dumm ist nur, dass ich mich in diesem Metier überhaupt nicht auskenne. gegooget habe ich ich schon und den folgenden Link gefunden, wobei ich hier nur Bahnhof verstehe. http://board.protecus.de/t38454-4.htm Irgendentwas hat mein Sicherheitscenter deaktiviert und das bekomme ich auch nicht mehr zum laufen. Wenn ichu den Windows Defender laufen lasse öffnet sich ein Warnfenster mit den Hinweis "Trojan.Win32/Alureon.BT" und einer schwerwiegenden Warnstufe. Er bitte mir zwar die Möglichkeit das Ding zu entfernen, aber das hilft nicht. Beim nächsten Scan ist das wieder da. Antivir findet nicht. Auf dem Desktop sind 2 Icons erschienen. "Malware Defense" und "Malware Defense Support" Über rechte Maustaste und Eigenschaften sehe ich das die Verknüpfungen in den Pfad "Progrm Files(x86)\Malware Defense\mdefense.exe" geht. Aber übern Explorer finde ich dieses Versichnis nicht. Ich bin am verzweifeln. Es stellt sich natürlich für mich die Frage wie das passieren konnte. Gestern habe ich im Mediamarkt einen Lappi für meine Eltern gekauft. Den habe ich in meinen Wlan Netzwerk integriert um updates zu machen. Gleichzeitig habe ich an meinem rechner auch updates durchgeführt. das war es eigentlich. Ich hoffe ihr könnt mir helfen. aber wie angedeutet: ich bin ein newbee |
ich bin schon mal ein bissel weiter. es scheint sich ja um dieses Malware Defense zu handeln. Ich habe Malware drüber laufen lassen, wobei eine Menge gefunden wurde. Was ich anschließend gelöscht habe. Der Scanbericht sah wie folgt aus: Malwarebytes' Anti-Malware 1.43 Datenbank Version: 3499 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18865 06.01.2010 15:58:06 mbam-log-2010-01-06 (15-58-06).txt Scan-Methode: Vollständiger Scan (A:\|B:\|C:\|D:\|) Durchsuchte Objekte: 354310 Laufzeit: 1 hour(s), 2 minute(s), 7 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 6 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 1 Infizierte Dateien: 11 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-leech alnn (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@anti-leech.com/anti-leech plugin,version=1.0.2.3 (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\Users\bedlam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Users\bedlam\AppData\Local\Temp\settdebugx.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Programme1\Anti-Leech\ALNN\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. C:\Programme1\Anti-Leech\ALNN\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. C:\Programme1\Anti-Leech\ALNN\setup2.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Programme1\Mozilla Firefox\plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. C:\Programme1\Mozilla Firefox\plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully. C:\Users\bedlam\Desktop\Malware Defense.lnk (Rogue.MalwareDefense) -> Quarantined and deleted successfully. C:\Users\bedlam\Desktop\Malware Defense Support.lnk (Rogue.MalwareDefense) -> Quarantined and deleted successfully. C:\Users\bedlam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Malware Defense.lnk (Rogue.MalwareDefense) -> Quarantined and deleted successfully. die verknüpfungen auf dem desktop sind schonmal weg. aber das sicherheitscenter funktioniert immer noch nicht. Ich glaube dieses Alurfeon.bt Ding ist immer noch drauf Wenn ich mal wüsste was das da alles sein soll. P.S. wie kann ich den den ersten Beitrag editieren. Da ist ja ein Link drin, der so nicht reingehört |
Hi, schauen wir mal nach... Der Rootkit sollte eigentlich weg sein, da der Reg.-Eintrag von MAM entfernt wurde... Dafür spricht auch, dass Du MAM starten kannst... RSIT Random's System Information Tool (RSIT) von random/random liest Systemdetails aus und erstellt ein aussagekräftiges Logfile. * Lade Random's System Information Tool (RSIT) herunter http://filepony.de/download-rsit/ * speichere es auf Deinem Desktop. * Starte mit Doppelklick die RSIT.exe. * Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren. * Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren. * In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept". * Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen. * Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage. * Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet. * Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread. Gmer: http://www.trojaner-board.de/74908-anleitung-gmer-rootkit-scanner.html Den Downloadlink findest Du links oben (http://www.gmer.net/#files), dort dann auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken). Starte gmer und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein. chris |
Hi Chris, anbei die Log-Files. Was meinst du mit "minimiert"??? Ich vermute mal nur den ersten Teil Bei Gmer waren bei mir nicht alle Haken auf der rechten Seite angekreuzt. Nur "Services, Registry und Files". in der Anleitung ist ja alles angehakt.... RSIT Info.txt info.txt logfile of random's system information tool 1.06 2010-01-06 20:22:50 ======Uninstall list====== -->"C:\Program Files (x86)\Creative Installation Information\CHANGE_TAG_FORMAT\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\CLEANUP_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\CONVERT_MUSIC_FORMAT\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\CREATIVE_MEDIASOURCE_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\CTCMSGO\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\E-CENTER_NET_CONTENT_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\E-CENTER_PLUGIN_CDBURNER_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\E-CENTER_PLUGIN_MINIDISC_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\E-CENTER_PLUGIN_ONLINESTORE_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\EDIT_MUSIC_TAGS\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\EQUALIZE_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\MANAGE_RECORDING_SCHEDULE\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\MEDIA_TOOLBOX_X\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\MEDIASOURCE_PLAYER_SKINPACK_U\Setup.exe" /remove /nolog/l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\NORMALIZE_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\Organize_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\RECORD_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\Program Files (x86)\Creative Installation Information\SPLITUP_MUSIC\Setup.exe" /remove /l0x0007 -->"C:\programme1\Creative\Sound Blaster X-Fi\Program\SETUP.EXE" /S /U /W /L:GER -->C:\Programme1\DivX\DivXConverterUninstall.exe /CONVERTER -->C:\Programme1\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL -->C:\Windows\UNNeroBackItUp.exe /UNINSTALL -->C:\Windows\UNNeroMediaHome.exe /UNINSTALL -->C:\Windows\UNNeroShowTime.exe /UNINSTALL -->C:\Windows\UNNeroVision.exe /UNINSTALL -->C:\Windows\UNRecode.exe /UNINSTALL -->MsiExec /X{74224F8D-4A17-4816-9EDB-7BB854DE532C} -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x7 /remove -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x7 /remove -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x7 /remove -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 /remove -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x7 /remove -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x7 -->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x7 /remove Adobe AIR-->c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723} Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.4 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A81300000003} Adobe® Photoshop® Album Starter Edition 3.2-->MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61} Anno 1701-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{A2433A63-5F5D-40E5-B529-9123C2B3E734}\setup.exe" -l0x7 -removeonly Apple Application Support-->MsiExec.exe /I{3FA365DF-2D68-45ED-8F83-8C8A33E65143} Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033} Avira AntiVir Personal - Free Antivirus-->C:\Programme1\Avira\AntiVir Desktop\setup.exe /REMOVE AVM FRITZ!WLAN-->C:\Program Files (x86)\avmwlanstick\instwcli.exe -d1 BlindWrite 6-->"C:\Programme1\DVD\BlindWrite6\unins000.exe" CCleaner-->"C:\Programme1\CCleaner\uninst.exe" CDex extraction audio-->"C:\Programme1\CDex_170b2\uninstall.exe" CloneDVD2-->"C:\Programme1\DVD\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Programme1\DVD\CloneDVD2" Company of Heroes-->MsiExec.exe /X{EAF636A9-F664-4703-A659-85A894DA264F} Creative ALchemy-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x7 /remove Creative Audio-Systemsteuerung-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x7 /remove Creative Media Toolbox 6 (Shared Components)-->C:\Program Files (x86)\Common Files\Creative Labs Shared\Uninstall\Creative Media Toolbox 6\B4736000\UninstApplet.exe /uninstall Creative Media Toolbox 6-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F1A14CB2-A048-45A6-AFDA-3571296E1D76}\setup.exe" -l0x7 /remove Creative MediaSource 5-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}\SETUP.EXE" -l0x7 /remove Creative Software AutoUpdate-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\setup.exe" -l0x7 /remove Creative Sound Blaster Properties x64 Edition-->"C:\Program Files (x86)\Creative Installation Information\SBCONTROL64\Setup.exe" /remove /l0x0007 Creative WaveStudio 7-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x7 /remove Creative-Diagnose-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x7 /remove CyberLink PowerDVD 8-->"C:\Program Files (x86)\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\setup.exe" /z-uninstall DivX Codec-->C:\Programme1\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Programme1\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Programme1\DivX\DivXPlayerUninstall.exe /PLAYER DivX Plus DirectShow Filters-->C:\Programme1\DivX\DivXDSFiltersUninstall.exe /DSFILTERS DivX Web Player-->C:\Programme1\DivX\DivXWebPlayerUninstall.exe /PLUGIN DVD Decrypter (Remove Only)-->"C:\Programme1\DVD\DVD Decrypter\uninstall.exe" DVD-CLONER V6.00 Build 978-->"C:\Programme1\DVD\Dvd-cloner\unins000.exe" DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0-->"C:\Programme1\DVD\DVDFab 5 v5110\unins000.exe" HijackThis 2.0.2-->"C:\Program Files (x86)\trend micro\HijackThis.exe" /uninstall Host OpenAL-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x7 /remove Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT="" HyperSnap 6-->C:\Programme1\HyperSnap 6\HprUnInst.exe Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF} Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} K-Lite Codec Pack 3.8.0 Full-->"C:\programme1\K-Lite Codec Pack\unins000.exe" Lightroom-->MsiExec.exe /I{D4134B0B-EA9B-4835-A77A-60BEE6277101} Malwarebytes' Anti-Malware-->"C:\Programme1\Malwarebytes' Anti-Malware\unins000.exe" Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669} Microsoft Games for Windows - LIVE-->MsiExec.exe /X{A1C962E2-2426-49C6-A38B-9A07E40D607C} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {E64BA721-2310-4B55-BE5A-2925F9706192} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {E64BA721-2310-4B55-BE5A-2925F9706192} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0407-1000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0407-1000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B} Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE} Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE} Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE} Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE} Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE} Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE} Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE} Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE} Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2} Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2} Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE} Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE} Microsoft Office Visio 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585} Microsoft Office Visio 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0054-0407-0000-0000000FF1CE} /uninstall {60CC0F2D-BFA0-4851-903D-809D876DD87B} Microsoft Office Visio MUI (German) 2007-->MsiExec.exe /X{90120000-0054-0407-0000-0000000FF1CE} Microsoft Office Visio Professional 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISPRO /dll OSETUP.DLL Microsoft Office Visio Professional 2007-->MsiExec.exe /X{90120000-0051-0000-0000-0000000FF1CE} Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE} Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2005 SP1 CRT Redistributable-->MsiExec.exe /I{CC038D57-788A-4544-BF8F-179E5CF50D2F} Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989} Mozilla Firefox (3.5.6)-->C:\Programme1\Mozilla Firefox\uninstall\helper.exe MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC} Need for Speed™ Most Wanted-->D:\Games\Need for Speed - Most wanted\EAUninstall.exe Need for Speed™ ProStreet-->MsiExec.exe /X{2E1A71D5-7897-4F3F-B0E3-B412C86A646D} Nero 8-->MsiExec.exe /X{8410B358-107A-4FB7-AB2B-6FD952F15A8F} neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NVIDIA PhysX v8.04.25-->MsiExec.exe /X{74224F8D-4A17-4816-9EDB-7BB854DE532C} OpenAL-->"C:\Program Files (x86)\OpenAL\oalinst.exe" /U pdf24-->"C:\Programme1\pdf24\unins000.exe" QuickTime-->MsiExec.exe /I{1451DE6B-ABE1-4F62-BE9A-B363A17588A2} Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08} Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08} Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F} Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE} Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0} Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D} Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E} Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF} Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF} Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C} Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC} Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC} Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D} Sound Blaster X-Fi-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0C9D0200-FA32-44B7-BBB3-7C03F700C4A0}\SETUP.EXE" -l0x7 /remove Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} TomTom HOME 2.7.3.1894-->C:\programme1\TomTom HOME 2\Uninstall TomTom HOME.exe TomTom HOME Visual Studio Merge Modules-->MsiExec.exe /I{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533} TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D} Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7} Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331} Update for Outlook 2007 Junk Email Filter (kb976884)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FB60F280-C70F-4174-BADB-471412AA42F0} Update für Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF} Update für Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0407-0000-0000000FF1CE} /uninstall {F6828576-6F79-470D-AB50-69D1BBADBD30} Update für Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {EA160DA3-E9B5-4D03-A518-21D306665B96} Update für Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {38472199-D7B6-4833-A949-10E4EE6365A1} VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B} VideoLAN VLC media player 0.8.4a-->C:\Programme1\VLC\uninstall.exe Winamp-->"C:\Programme1\Winamp\UninstWA.exe" Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} WinRAR-->C:\Programme1\winrar\uninstall.exe RSIT log.txt Logfile of random's system information tool 1.06 (written by random/random) Run by bedlam at 2010-01-06 20:22:41 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 146 GB (61%) free of 238 GB Total RAM: 8190 MB (75% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:22:49, on 06.01.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18865) Boot mode: Normal Running processes: C:\Windows\system\w98eject.exe C:\Windows\SysWOW64\rundll32.exe C:\Programme1\Java\jre6\bin\jusched.exe C:\Programme1\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Programme1\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\avmwlanstick\WLanGUI.exe C:\Programme1\Mozilla Firefox\firefox.exe C:\Users\bedlam\Desktop\Virusbekämpfung\RSIT.exe C:\Program Files (x86)\trend micro\bedlam.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ftd.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\programme1\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme1\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme1\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme1\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme1\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme1\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme1\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [AVMWlanClient] "C:\Program Files (x86)\avmwlanstick\wlangui.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\programme1\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme1\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\programme1\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKCU\..\Run: [AnyDVD] C:\Programme1\DVD\AnyDVD\AnyDVDtray.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: w98Eject.lnk = C:\Windows\system\w98eject.exe O4 - Global Startup: WISO Mein Sparbuch heute.lnk = C:\Programme1\WISO\Sparbuch 2010\meinsparbuchheute.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PR37B0~1\MSOFFI~1\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PR37B0~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PR37B0~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PR37B0~1\MICROS~1\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\programme1\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme1\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme1\Avira\AntiVir Desktop\avguard.exe O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe O23 - Service: Creative Media Toolbox 6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme1\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: TomTomHOMEService - TomTom - C:\programme1\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: Windows Media Player-Netzwerkfreigabedienst (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 8653 bytes Gmer: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-06 20:34:36 Windows 6.0.6002 Service Pack 2 Running: k7pl1pjq.exe ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme1\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x34 0x65 0x5B 0x2E ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x11 0xFD 0xEE 0xB5 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x25 0x6D 0xAC 0x44 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme1\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x34 0x65 0x5B 0x2E ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x11 0xFD 0xEE 0xB5 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x07 0xC9 0x26 0xD1 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme1\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x34 0x65 0x5B 0x2E ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x11 0xFD 0xEE 0xB5 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x07 0xC9 0x26 0xD1 ... ---- EOF - GMER 1.0.15 ---- |
Hi, da liegt aber einiges im Argen... Ist das ein 64-Bit System? Dann läuft Combofix nicht und wir müssen uns was anderes überlegen... Combofix Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop. Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen. chris |
jetzt machste mir eion bissel angst :heulen: combofix geht leider nicht. "error - win32 only" ich habe Vista als 64 bitversion |
Hi, das dachte ich mir fast und das macht die Sache unheimlich komplex, weil fast kein vernünftiges Tool unter 64Bit läuft... Daher hat auch der Rootkit versagt, er hat aber noch irgendwas in Deinem System zumindest "teilzerstört" und einige Teile der nachgezogenen Malware funktioniert (auch nur teilweise)... Noch mal Gmer mit allen Häckchen wie beschrieben laufen lassen, vorher bitte die Daemontools deinstallieren... Wir probieren mal Prevx: http://www.prevx.com/freescan.asp Falls das Tool was findet, nicht das Log posten sondern einen Screenshot des dann angezeigten Fensters... chris |
Bei Gmer kann ich die Haken nicht setzen. dei sind so grau hinterlegt. Muss ich da vorher noch irgendwas anderes im Programm selbst freischalten? Daemon tool habe ich deinstalliert |
Hi, bist du auf dem Reiter "Rookit"Maleware" und hast Du ihn unter "Adminrechten" ausgeführt? chris |
Liste der Anhänge anzeigen (Anzahl: 1) Hi, hier mal der screenshot von Prevx. Soll ich mal auf "cleanup now" drücken? Obwohl, ich habe diese Programm schon lange (<3 jahre) Gmer starte ich als Admin und bin auch in dem entsprechenden reiter |
Hi, kann das sein, das ein Sprachkurs verseucht ist? Oder hast Du ihn Dir aus zweifelhafter Quelle "besorgt"? Die gefundenen Dateien bei Virustotal.com prüfen lassen, Log posten... Dateien Online überprüfen lassen:
chris |
Hi, das programm ist sauber. es sei denn, es hat sich was von gestern zu heut egeändert. ich versuche jetzt erstmal deine anleitung durchzugehen. Welche Dateien soll ich hochladen? Die, die auch im screenshot angezeigt werden? |
Ich hab die Dateien hochgeladen. Es erscheint eine liste mit Virenscaner. Wobei nur hier Prevex sagt: "High Risk Cloaked Malware" Was soll ich jetzt machen? Ich werde das Programm einfach mal deinstallieren |
Hi, Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
chris |
Okay, habe ich ich gemacht Vorher nochwas: Ich wollte das Sprachprogramm deinstallieren, glaubst du ich bekomme das hin. nirgendes eine uninstalldatei. Kann ich das Programm auch einfach so löschen???? :confused: OTL.TXT OTL logfile created on: 06.01.2010 21:45:18 - Run 1 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Users\bedlam\Desktop\Virusbekämpfung 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18865) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 72,00% Memory free 16,00 Gb Paging File | 14,00 Gb Available in Paging File | 86,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,88 Gb Total Space | 142,71 Gb Free Space | 61,28% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 24,60 Gb Free Space | 10,56% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM Current User Name: bedlam Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\bedlam\Desktop\Virusbekämpfung\OTL.exe (OldTimer Tools) PRC - C:\Programme1\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme1\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Programme1\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme1\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\SysWOW64\conime.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) PRC - C:\Programme1\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) PRC - C:\Programme1\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme1\TuneUp Utilities 2008\RegistryCleaner.exe (TuneUp Software GmbH) PRC - C:\Programme1\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) PRC - C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.) PRC - C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\bedlam\Desktop\Virusbekämpfung\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV:64bit: - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx) SRV:64bit: - (FontCache) -- C:\Windows\SysNative\FntCache.dll (Microsoft Corporation) SRV:64bit: - (TuneUp.Defrag) -- C:\Windows\SysNative\TuneUpDefragService.exe (TuneUp Software GmbH) SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software GmbH) SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs) SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs) SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs) SRV - (TomTomHOMEService) -- C:\Programme1\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (AntiVirService) -- C:\Programme1\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme1\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) SRV - (Microsoft Office Groove Audit Service) -- C:\programme1\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (NMIndexingService) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) SRV - (Nero BackItUp Scheduler 3) -- C:\Programme1\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software GmbH) SRV - (PLFlash DeviceIoControl Service) -- C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.) SRV - (MSDTC) -- C:\Windows\SysWOW64\Msdtc [2006.11.02 14:34:14 | 00,000,000 | ---D | M] SRV - (vds) -- C:\Windows\SysWOW64\wbem\vds.mof () SRV - (VSS) -- C:\Windows\SysWOW64\wbem\vss.mof () SRV - (MDM) -- C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) SRV - (IDriverT) -- C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (pxrts) -- C:\Windows\SysNative\drivers\pxrts.sys (Prevx) DRV:64bit: - (pxscan) -- C:\Windows\SysNative\drivers\pxscan.sys (Prevx) DRV:64bit: - (pxkbf) -- C:\Windows\SysNative\drivers\pxkbf.sys (Prevx) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH) DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek ) DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\Drivers\AnyDVD.sys (SlySoft, Inc.) DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (t3) -- C:\Windows\SysNative\drivers\t3.sys (Creative Technology Ltd.) DRV:64bit: - (ezplay) -- C:\Windows\SysNative\Drivers\ezplay.sys (VSO Software) DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\Drivers\pcouffin.sys (VSO Software) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\Drivers\sptd.sys () DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\DRIVERS\fwlanusb.sys (AVM GmbH) DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin) DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation) DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (mpsdrv) -- C:\Windows\SysWOW64\wbem\mpsdrv.mof () DRV - ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) -- C:\Programme1\PowerDVD8\PowerDVD8\000.fcl (Cyberlink Corp.) DRV - (Tcpip) -- C:\Windows\SysWOW64\wbem\tcpip.mof () DRV - (ElbyCDIO) -- C:\Windows\SysWOW64\drivers\ElbyCDIO.sys (Elaborate Bytes AG) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ftd.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.ftd.de" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Programme1\Mozilla Firefox\components [2009.12.25 20:54:59 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Programme1\Mozilla Firefox\plugins [2010.01.06 15:58:06 | 00,000,000 | ---D | M] [2008.10.03 19:05:35 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Extensions [2008.10.03 19:05:35 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2010.01.06 20:30:49 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Firefox\Profiles\jte5xmi8.default\extensions O1 HOSTS File: (761 bytes) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme1\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme1\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme1\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme1\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme1\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme1\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [GrooveMonitor] C:\programme1\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Programme1\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SPIRunE] C:\Windows\SysWow64\SpiRunE.dll (Creative Technology Ltd.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme1\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AnyDVD] C:\Programme1\DVD\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [TomTomHOME.exe] C:\programme1\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme1\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme1\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme1\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.50.140.248 195.50.140.114 192.168.0.1 O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme1\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme1\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{40b7dd3f-9174-11dd-bb49-001d7da643aa}\Shell\AutoRun\command - "" = M:\InstallTomTomHOME.exe -- File not found O33 - MountPoints2\{5f60b683-ec83-11dc-bfb1-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{5f60b683-ec83-11dc-bfb1-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe -- File not found O33 - MountPoints2\{65a957bb-0651-11dd-9bb5-001d7da643aa}\Shell - "" = AutoRun O33 - MountPoints2\{65a957bb-0651-11dd-9bb5-001d7da643aa}\Shell\AutoRun\command - "" = G:\start.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - comfile [open] -- "%1" %* File not found 64bit: O35 - exefile [open] -- "%1" %* File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.01.06 21:02:40 | 00,044,944 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys [2010.01.06 21:02:40 | 00,034,656 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys [2010.01.06 21:02:39 | 00,022,296 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys [2010.01.06 21:02:39 | 00,000,000 | ---D | C] -- C:\Programme\Prevx [2010.01.06 21:01:52 | 00,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI [2010.01.06 20:47:28 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW [2010.01.06 20:22:41 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\trend micro [2010.01.06 20:22:41 | 00,000,000 | ---D | C] -- C:\rsit [2010.01.06 16:17:21 | 00,000,000 | ---D | C] -- C:\Users\bedlam\Desktop\Virusbekämpfung [2010.01.06 14:53:41 | 00,000,000 | ---D | C] -- C:\Users\bedlam\AppData\Roaming\Malwarebytes [2010.01.06 14:53:38 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.01.06 14:53:37 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.01.06 14:53:36 | 00,022,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2009.12.25 21:07:46 | 00,010,488 | ---- | C] (Sonic Solutions) -- C:\Windows\SysNative\drivers\cdralw2k.sys [2009.12.25 21:07:46 | 00,010,488 | ---- | C] (Sonic Solutions) -- C:\Windows\SysNative\drivers\cdr4_xp.sys [2009.12.25 20:54:50 | 00,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2009.12.14 23:41:18 | 00,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll [2009.12.14 23:41:18 | 00,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll [2009.12.14 23:41:18 | 00,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll [2009.12.14 23:41:18 | 00,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll [2009.12.14 23:41:17 | 05,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll [2009.12.14 23:41:17 | 05,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll [2009.12.14 23:41:17 | 02,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll [2009.12.14 23:41:17 | 01,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll [2009.12.14 23:41:16 | 00,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll [2009.12.14 23:41:16 | 00,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll [2009.12.14 23:41:15 | 02,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll [2009.12.14 23:41:15 | 00,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll [2009.12.14 23:41:11 | 00,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll [2009.12.14 23:41:11 | 00,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll [2009.12.14 23:41:05 | 00,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll [2009.12.14 23:41:05 | 00,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll [2009.12.14 23:41:04 | 00,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll [2009.12.14 23:41:04 | 00,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll [2009.12.14 23:41:03 | 00,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll [2009.12.14 23:41:03 | 00,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll [2009.12.14 23:41:02 | 00,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll [2009.12.14 23:41:02 | 00,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll [2009.12.14 23:41:00 | 00,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll [2009.12.14 23:41:00 | 00,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll [2009.12.14 23:41:00 | 00,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll [2009.12.14 23:41:00 | 00,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll [2009.12.14 23:40:59 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll [2009.12.14 23:40:59 | 00,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll [2009.12.09 21:20:11 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshhttp.dll [2009.12.09 21:20:11 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshhttp.dll [2009.12.09 21:20:09 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\httpapi.dll [2009.12.09 21:20:09 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\httpapi.dll [2009.12.09 21:13:52 | 02,334,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll [2009.12.09 21:13:52 | 00,916,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2009.12.09 21:13:51 | 01,538,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2009.12.09 21:13:51 | 01,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2009.12.09 21:13:51 | 01,147,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll [2009.12.09 21:13:51 | 00,700,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2009.12.09 21:13:51 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2009.12.09 21:13:51 | 00,459,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll [2009.12.09 21:13:51 | 00,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iedkcs32.dll [2009.12.09 21:13:51 | 00,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2009.12.09 21:13:51 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll [2009.12.09 21:13:51 | 00,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2009.12.09 21:13:51 | 00,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2009.12.09 21:13:51 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2009.12.09 21:13:51 | 00,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe [2009.12.09 21:13:51 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2009.12.09 21:13:51 | 00,162,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2009.12.09 21:13:51 | 00,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2009.12.09 21:13:51 | 00,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2009.12.09 21:13:51 | 00,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2009.12.09 21:13:51 | 00,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2009.12.09 21:13:51 | 00,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2009.12.09 21:13:51 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll [2009.12.09 21:13:51 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2009.12.09 21:13:51 | 00,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2009.12.09 21:13:51 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2009.12.09 21:13:51 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll [2009.12.09 21:13:51 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll [2009.12.09 21:13:51 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsproxy.dll [2009.12.09 21:13:51 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2009.12.09 21:13:51 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2009.12.09 21:13:12 | 00,280,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rastls.dll [2009.12.09 21:13:12 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rastls.dll [2008.12.30 12:44:27 | 00,118,400 | ---- | C] (VSO Software) -- C:\Users\bedlam\AppData\Roaming\ezplay.sys [2008.06.06 19:24:03 | 00,082,816 | ---- | C] (VSO Software) -- C:\Users\bedlam\AppData\Roaming\pcouffin.sys [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.01.06 21:47:00 | 00,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{AB09B86F-21F9-4501-8762-62EDA0FDF34B}.job [2010.01.06 21:44:59 | 02,883,584 | ---- | M] () -- C:\Users\bedlam\NTUSER.DAT [2010.01.06 21:20:20 | 00,004,176 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.01.06 21:20:20 | 00,004,176 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.01.06 21:02:40 | 00,044,944 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys [2010.01.06 21:02:40 | 00,034,656 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys [2010.01.06 21:02:39 | 00,022,296 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys [2010.01.06 21:02:34 | 00,000,051 | ---- | M] () -- C:\Windows\wininit.ini [2010.01.06 19:27:41 | 01,427,212 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.01.06 19:27:41 | 00,621,714 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.01.06 19:27:41 | 00,589,884 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.01.06 19:27:41 | 00,123,452 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.01.06 19:27:41 | 00,101,896 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.01.06 19:21:01 | 00,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib [2010.01.06 19:20:42 | 00,034,990 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.01.06 19:20:41 | 00,034,990 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.01.06 19:20:21 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.01.06 19:20:16 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.01.06 19:19:10 | 00,524,288 | -HS- | M] () -- C:\Users\bedlam\NTUSER.DAT{e77957ec-ae5a-11de-8519-001a4f473cab}.TMContainer00000000000000000001.regtrans-ms [2010.01.06 19:19:10 | 00,065,536 | -HS- | M] () -- C:\Users\bedlam\NTUSER.DAT{e77957ec-ae5a-11de-8519-001a4f473cab}.TM.blf [2010.01.06 19:19:07 | 02,944,562 | -H-- | M] () -- C:\Users\bedlam\AppData\Local\IconCache.db [2010.01.06 16:18:45 | 00,001,559 | ---- | M] () -- C:\Users\bedlam\Desktop\CCleaner.lnk [2010.01.06 14:53:41 | 00,000,719 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.06 13:45:19 | 00,001,460 | ---- | M] () -- C:\Users\bedlam\AppData\Local\d3d9caps64.dat [2010.01.06 11:41:31 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2010.01.06 10:53:35 | 00,000,008 | ---- | M] () -- C:\ProgramData\sysReserve.ini [2010.01.05 17:25:37 | 00,000,885 | ---- | M] () -- C:\Windows\wiso.ini [2010.01.05 17:18:03 | 00,001,790 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk [2010.01.05 17:18:03 | 00,001,709 | ---- | M] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk [2010.01.05 15:44:26 | 00,466,456 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2010.01.05 15:44:26 | 00,444,952 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2010.01.05 15:44:26 | 00,122,904 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysNative\OpenAL32.dll [2010.01.05 15:44:26 | 00,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysWow64\OpenAL32.dll [2010.01.05 15:42:32 | 00,000,959 | RH-- | M] () -- C:\Windows\ctfile.rfc [2010.01.03 21:40:39 | 00,026,276 | ---- | M] () -- C:\Users\bedlam\Desktop\Analyse.xlsx [2010.01.02 18:23:46 | 00,089,600 | ---- | M] () -- C:\Users\bedlam\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.12.30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2009.12.30 14:55:06 | 00,022,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2009.12.25 21:09:02 | 00,001,788 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk [2009.12.25 21:07:43 | 00,001,869 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom.lnk [2009.12.25 20:54:54 | 00,001,627 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2009.12.11 20:49:04 | 00,001,770 | ---- | M] () -- C:\Windows\ShowSetup.mif [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.01.06 21:01:52 | 00,000,051 | ---- | C] () -- C:\Windows\wininit.ini [2010.01.06 16:18:45 | 00,001,559 | ---- | C] () -- C:\Users\bedlam\Desktop\CCleaner.lnk [2010.01.06 14:53:41 | 00,000,719 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.06 10:53:35 | 00,000,008 | ---- | C] () -- C:\ProgramData\sysReserve.ini [2010.01.05 17:20:40 | 00,436,332 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistMSI3A35.txt [2010.01.05 17:20:40 | 00,011,698 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistUI3A35.txt [2010.01.05 17:18:03 | 00,001,790 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk [2010.01.05 17:18:03 | 00,001,709 | ---- | C] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk [2010.01.05 15:50:54 | 00,034,990 | ---- | C] () -- C:\ProgramData\nvModes.dat [2010.01.05 15:50:54 | 00,034,990 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.12.25 21:07:43 | 00,001,869 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom.lnk [2009.12.25 20:54:54 | 00,001,627 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2009.12.05 18:16:50 | 00,000,306 | ---- | C] () -- C:\Windows\game.ini [2009.11.06 10:58:04 | 00,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.10.22 13:53:41 | 00,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2009.09.11 19:25:21 | 00,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll [2009.09.11 19:24:43 | 00,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.07.22 21:39:45 | 00,069,632 | ---- | C] () -- C:\Windows\SysWow64\xmltok.dll [2009.07.22 21:39:45 | 00,036,864 | ---- | C] () -- C:\Windows\SysWow64\xmlparse.dll [2009.06.05 08:22:31 | 00,024,226 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\UserTile.png [2009.03.22 17:28:33 | 00,421,730 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistMSI0BCF.txt [2009.03.22 17:28:33 | 00,011,482 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistUI0BCF.txt [2009.03.11 17:13:38 | 00,809,368 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_NET_Framework35_LangPack_MSI24EE.txt [2009.03.11 17:13:22 | 00,036,032 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_depcheck_NETFX_EXP_35.txt [2009.03.11 17:13:16 | 00,078,574 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx35install_lp.txt [2009.03.11 17:13:16 | 00,000,002 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx35error_lp.txt [2009.02.03 21:55:04 | 00,000,038 | ---- | C] () -- C:\Windows\avisplitter.INI [2009.01.14 02:47:24 | 00,001,436 | ---- | C] () -- C:\Windows\CfgHPSp.ini [2009.01.14 02:47:24 | 00,001,434 | ---- | C] () -- C:\Windows\Cfg05Sp.ini [2009.01.14 02:47:24 | 00,001,434 | ---- | C] () -- C:\Windows\Cfg04Sp.ini [2009.01.14 02:47:24 | 00,001,091 | ---- | C] () -- C:\Windows\Cfg03Sp.ini [2009.01.14 02:47:24 | 00,001,091 | ---- | C] () -- C:\Windows\Cfg02Sp.ini [2009.01.14 02:47:24 | 00,001,000 | ---- | C] () -- C:\Windows\Cfg01Sp.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\CfgHPHp.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\CfgHPDO.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\Cfg05DO.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\Cfg04DO.ini [2009.01.14 02:47:24 | 00,000,930 | ---- | C] () -- C:\Windows\Cfg05Hp.ini [2009.01.14 02:47:24 | 00,000,930 | ---- | C] () -- C:\Windows\Cfg04Hp.ini [2009.01.14 02:47:24 | 00,000,818 | ---- | C] () -- C:\Windows\Cfg01APR.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg03Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg03DO.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg02Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg02DO.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg01Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg01DO.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPRMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPRLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPFMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPDI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05RMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05RLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05FMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05DI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04RMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04RLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04FMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04DI.ini [2008.12.30 13:06:39 | 00,056,340 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_depcheckdotnetfx30.txt [2008.12.30 13:06:35 | 00,064,802 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx3install.txt [2008.12.30 13:06:35 | 00,007,102 | ---- | C] () -- C:\Users\bedlam\AppData\Local\uxeventlog.txt [2008.12.30 13:06:35 | 00,001,434 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx3error.txt [2008.12.30 12:44:55 | 00,000,034 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.log [2008.12.30 12:44:27 | 00,007,833 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.cat [2008.12.30 12:44:27 | 00,001,126 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.inf [2008.12.30 12:44:27 | 00,000,125 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.ini [2008.10.17 01:33:50 | 00,150,016 | ---- | C] () -- C:\Windows\SysWow64\OemSpiE.dll [2008.06.14 14:37:57 | 00,099,384 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezpinst.exe [2008.06.07 12:26:31 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008.06.06 19:24:27 | 00,000,034 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.log [2008.06.06 19:24:03 | 00,099,384 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\inst.exe [2008.06.06 19:24:03 | 00,007,859 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.cat [2008.06.06 19:24:03 | 00,001,167 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.inf [2008.05.25 22:19:17 | 00,002,048 | ---- | C] () -- C:\Windows\SysWow64\syscvchk.dll [2008.05.25 22:16:27 | 00,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini [2008.05.12 16:09:53 | 00,000,245 | ---- | C] () -- C:\Windows\BUHL.INI [2008.05.12 11:13:23 | 00,000,253 | ---- | C] () -- C:\Windows\tm.ini [2008.05.05 20:05:24 | 00,007,867 | ---- | C] () -- C:\Windows\Irremote.ini [2008.05.04 15:30:54 | 00,000,162 | ---- | C] () -- C:\Windows\ODBC.INI [2008.04.12 18:33:39 | 00,000,178 | ---- | C] () -- C:\Windows\Clony2.ini [2008.04.12 12:53:06 | 00,215,144 | ---- | C] () -- C:\Windows\patchw32.dll [2008.04.04 16:10:43 | 01,491,338 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2008.03.16 17:53:18 | 00,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2008.03.16 17:53:16 | 00,755,027 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2008.03.16 17:53:16 | 00,159,839 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2008.03.16 17:53:15 | 00,007,680 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2008.03.16 17:53:15 | 00,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest [2008.03.15 14:38:41 | 00,000,885 | ---- | C] () -- C:\Windows\wiso.ini [2008.03.15 13:04:13 | 00,004,626 | ---- | C] () -- C:\Windows\SysWow64\AudioDrv.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03RMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03RLI.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03FMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03DI.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02RMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02RLI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02FMi.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02DI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01Mic.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01LI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01DI.ini [2008.03.15 13:03:04 | 00,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2008.03.15 13:03:04 | 00,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2008.03.12 19:10:39 | 00,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.03.08 07:19:18 | 00,089,600 | ---- | C] () -- C:\Users\bedlam\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.03.07 22:12:50 | 00,000,680 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d9caps.dat [2008.03.07 21:56:13 | 00,000,552 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d8caps.dat [2008.03.07 21:27:06 | 00,001,460 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d9caps64.dat [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll [2002.06.28 10:43:44 | 00,438,272 | ---- | C] () -- C:\Windows\SysWow64\xvid.dll [2002.05.16 00:38:40 | 00,091,136 | ---- | C] () -- C:\Windows\SysWow64\mp4fil32.dll [2002.05.04 14:19:00 | 00,049,152 | ---- | C] () -- C:\Windows\SysWow64\avisynthEx.dll < End of report > |
und hier die EXTRAS.TXT OTL Extras logfile created on: 06.01.2010 21:45:18 - Run 1 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Users\bedlam\Desktop\Virusbekämpfung 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18865) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 72,00% Memory free 16,00 Gb Paging File | 14,00 Gb Available in Paging File | 86,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,88 Gb Total Space | 142,71 Gb Free Space | 61,28% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 24,60 Gb Free Space | 10,56% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM Current User Name: bedlam Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Programme1\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\programme1\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\programme1\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PR37B0~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Programme1\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Programme1\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Programme1\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "C:\programme1\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\programme1\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PR37B0~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Programme1\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Programme1\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Programme1\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = 12 6F 77 B2 5A BF C8 01 [binary data] "VistaSp2" = 2D 8A 3D F4 80 33 CA 01 [binary data] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "oobe_av" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Programme1\BitTorrent\bittorrent.exe" = C:\Programme1\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- () "C:\Programme1\BitTorrent\bittorrent.exe" = C:\Programme1\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- () ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0FFE2066-9206-427F-9B4B-07DD925142E9}" = lport=138 | protocol=17 | dir=in | app=system | "{3D6D722E-0581-4C79-B890-90AD7171503D}" = lport=139 | protocol=6 | dir=in | app=system | "{6088A66B-3C96-4ED3-BAF3-44FC805C1B0D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{62AA8F8B-1A0E-48F1-BC9F-86CDEB2600AA}" = lport=445 | protocol=6 | dir=in | app=system | "{66077CCA-AA5D-4B15-B4B3-C783D1289AC0}" = rport=445 | protocol=6 | dir=out | app=system | "{9DF1B6CB-CAF3-4629-9A96-D23B3F2BC590}" = rport=138 | protocol=17 | dir=out | app=system | "{A246011E-7C8C-4747-8D36-3D4732D25DDE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{A2F7C4D3-2FEE-43D3-8845-8B90810E04A2}" = rport=137 | protocol=17 | dir=out | app=system | "{ABCD7E20-E4CD-4A55-A149-C665BB14403F}" = rport=139 | protocol=6 | dir=out | app=system | "{DE6219D4-B24C-423B-997F-D40F896528F6}" = lport=137 | protocol=17 | dir=in | app=system | "{F41A69BA-1D00-4B30-A50D-31D28B1D4E93}" = lport=6004 | protocol=17 | dir=in | app=c:\programme1\microsoft office\office12\outlook.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{05442CE2-6CC5-44A1-95C0-3001BD395928}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{0B2952FD-FA0F-4D3B-BD1B-0DBEF3871548}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{0B321BFB-D03D-4E30-BB0B-EAE437DC45DE}" = protocol=6 | dir=in | app=c:\programme1\microsoft office\office12\groove.exe | "{0B7C24CD-644D-40F0-8685-1BFD54B5A545}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{1549FA57-191E-4332-BFBD-89B0C138E0DA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{24C8F9E9-5574-480A-824B-E6F3BB282905}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{29B51075-146E-4A36-8D6B-702AC3101F77}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{3664D5D1-C848-4C4C-A25C-F10FB2523F83}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{37A99FA8-B258-497E-BDB8-D5B894381FCC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{414C2FF3-5FEF-4EA2-B59C-AF4121A54BDB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{4A9AF30A-CA1F-4332-B309-854588F40499}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{4ADC1526-DC3B-44F7-8C49-808A46A13C92}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{4D9F432B-72B2-4655-AF06-DD556B7F778E}" = dir=in | app=c:\programme1\powerdvd8\powerdvd8\powerdvd8.exe | "{5067FB17-3FE3-4CE6-A92E-AF0816027769}" = protocol=6 | dir=in | app=d:\games\frontlines-fuel of war\binaries\ffow.exe | "{660C4D2D-E43F-4785-80BD-AD31B874FC8A}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe | "{67F54B06-36F7-4059-8735-A00E3C9F8B0C}" = protocol=6 | dir=in | app=c:\programme1\microsoft office\office12\onenote.exe | "{88A11D09-93B9-47C6-AFFB-E828C5B950B0}" = protocol=17 | dir=in | app=d:\games\wolfenstein\mp\wolf2mp.exe | "{891B19EB-0197-4DA9-AABC-DD26B5C2FC8C}" = protocol=17 | dir=in | app=c:\programme1\microsoft office\office12\groove.exe | "{8B41753A-71BC-4737-A86D-44AE14CA3296}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{8F51C838-09C9-47C6-A6C9-02D2732815F1}" = protocol=17 | dir=in | app=c:\programme1\microsoft office\office12\onenote.exe | "{9A5A5D0F-16B4-43A9-B047-D4AD5F582CDF}" = protocol=6 | dir=in | app=d:\games\wolfenstein\mp\wolf2mp.exe | "{9C1ADC5F-61FB-4A80-8125-09489393E039}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{A2D360F4-AE94-48A4-B0B1-6525228345D9}" = protocol=17 | dir=in | app=d:\games\frontlines-fuel of war\binaries\ffow.exe | "{A74B8D76-4700-4D3C-8092-EC67A41F13AD}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{AB295F27-037E-4573-9CB2-D477E76D39B1}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{B1B4B484-C644-4F55-AA8E-57EE414CB48D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{B61A9EC0-6B18-427B-875D-0724A0DF0A7F}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{BF6E71C9-F210-46D1-B133-EACB63871F93}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{C1AB149B-E08D-4E75-B198-52FA9322F3B8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CE352407-7AE8-49E9-A64C-BD95D671DB83}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{D3989362-0308-4AF2-8B2A-C7B3BBD63496}" = protocol=17 | dir=in | app=d:\games\wolfenstein\mp\wolf2mplite.exe | "{DF9269C0-68E0-4D10-84EE-B6A859B6E52A}" = protocol=6 | dir=in | app=d:\games\wolfenstein\mp\wolf2mplite.exe | "{EDE53454-C792-44E2-BE83-C4956A02DCB7}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{F32F2354-19C0-4022-AABB-CFEB78E12455}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{F6CF4633-A0DE-4175-A31B-4566BFB21645}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "TCP Query User{1C36892A-0745-4DF7-BF2E-4CD7EEAB9026}C:\users\bedlam\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\bedlam\program files (x86)\dna\btdna.exe | "TCP Query User{2B650136-D11E-47C2-BED1-EC141AE07D89}D:\games\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=d:\games\tmnationsforever\tmforever.exe | "TCP Query User{341A452C-A640-4F6C-8768-599B296EEDFF}C:\programme1\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\programme1\bittorrent\bittorrent.exe | "TCP Query User{3E5AC615-CFBF-48EC-811F-6DE6E15A722B}C:\programme1\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\programme1\mozilla firefox\firefox.exe | "TCP Query User{4A42383B-8AEC-4CE3-ACC3-A4BEFC5B51D1}C:\programme1\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\programme1\mozilla firefox\firefox.exe | "TCP Query User{4AC9C163-BC05-4677-BD16-D5A399565B7B}D:\games\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=d:\games\anno 1701\anno1701.exe | "TCP Query User{5961EB1C-E589-43CF-AD90-A662EBA2D055}D:\games\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=6 | dir=in | app=d:\games\brothers in arms - hell's highway\binaries\biahh.exe | "TCP Query User{7185B1C9-6DA0-4CDD-8397-263FDE6A84DC}D:\games\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=d:\games\far cry 2\bin\farcry2.exe | "TCP Query User{73AB98E5-F074-4653-ADA0-E60BAE51EA03}C:\games\call of duty - world at war\codwaw.unpacked.exe" = protocol=6 | dir=in | app=c:\games\call of duty - world at war\codwaw.unpacked.exe | "TCP Query User{8B8ED92E-ADB5-486C-85E7-E79C2EDB03DA}C:\programme1\mozilla firefox\plugins\alhlp.exe" = protocol=6 | dir=in | app=c:\programme1\mozilla firefox\plugins\alhlp.exe | "TCP Query User{8C2FA9B0-F999-43D2-8646-3D729940B1CA}C:\users\bedlam\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\bedlam\program files (x86)\dna\btdna.exe | "TCP Query User{A0940C07-A479-4295-AE4B-5404FE087C8C}C:\program files (x86)\common files\nero\nero web\setupx.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\nero\nero web\setupx.exe | "TCP Query User{B65695BF-8B3D-44AC-8D27-96BEFE6FAFE8}D:\games\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=6 | dir=in | app=d:\games\brothers in arms - hell's highway\binaries\biahh.exe | "TCP Query User{CD60E8A4-6F60-4268-9B96-6932F0AF7B67}C:\users\bedlam\appdata\local\temp\onlineupdate8\setupxu.exe" = protocol=6 | dir=in | app=c:\users\bedlam\appdata\local\temp\onlineupdate8\setupxu.exe | "TCP Query User{D2B2D552-0E3F-4E99-AD07-27866A904CA8}D:\games\medal of honor pacific assault\mohpa.exe" = protocol=6 | dir=in | app=d:\games\medal of honor pacific assault\mohpa.exe | "TCP Query User{E2D5FC53-545E-48C6-B864-92C2EFDA34B3}C:\programme1\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\programme1\bittorrent\bittorrent.exe | "TCP Query User{EEBA12A4-8FEC-43A5-9926-7CD61E5C1D9B}D:\games\kane and lynch dead men\kaneandlynch.exe" = protocol=6 | dir=in | app=d:\games\kane and lynch dead men\kaneandlynch.exe | "UDP Query User{1D441E34-C9D7-465F-A3AA-9D359826233F}D:\games\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=d:\games\tmnationsforever\tmforever.exe | "UDP Query User{2E5C6599-8D8B-4125-A1E4-860F5E75F3A5}C:\programme1\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\programme1\mozilla firefox\firefox.exe | "UDP Query User{37C3C8C1-80B8-4860-A244-6B86B9B56E78}C:\program files (x86)\common files\nero\nero web\setupx.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\nero\nero web\setupx.exe | "UDP Query User{3E3A2C39-C1E1-4974-B229-DD5954914374}C:\programme1\mozilla firefox\plugins\alhlp.exe" = protocol=17 | dir=in | app=c:\programme1\mozilla firefox\plugins\alhlp.exe | "UDP Query User{438C72E9-FD32-4E26-868E-1527F0BE0AD4}C:\users\bedlam\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\bedlam\program files (x86)\dna\btdna.exe | "UDP Query User{6523BCA4-D041-479D-9B11-E5415E6C4AFD}C:\users\bedlam\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\bedlam\program files (x86)\dna\btdna.exe | "UDP Query User{70A710CE-E336-44D9-B5AA-8BF64ABC65F2}D:\games\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=17 | dir=in | app=d:\games\brothers in arms - hell's highway\binaries\biahh.exe | "UDP Query User{78D8A71B-F403-4DD5-8370-CFD7B046C0E5}C:\programme1\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\programme1\bittorrent\bittorrent.exe | "UDP Query User{78DE3C9B-8BE3-4063-9922-442D6036BB17}D:\games\brothers in arms - hell's highway\binaries\biahh.exe" = protocol=17 | dir=in | app=d:\games\brothers in arms - hell's highway\binaries\biahh.exe | "UDP Query User{7E1D0893-A490-4B14-9308-F47E5CD3A871}D:\games\medal of honor pacific assault\mohpa.exe" = protocol=17 | dir=in | app=d:\games\medal of honor pacific assault\mohpa.exe | "UDP Query User{9B826BE1-4FE8-45C7-BAE3-DFBEAC59DC96}D:\games\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=d:\games\anno 1701\anno1701.exe | "UDP Query User{A42B2FB9-46E5-41D6-B9C1-BE78F0A47D59}C:\users\bedlam\appdata\local\temp\onlineupdate8\setupxu.exe" = protocol=17 | dir=in | app=c:\users\bedlam\appdata\local\temp\onlineupdate8\setupxu.exe | "UDP Query User{ACC85AE1-CA8B-474D-8B6B-8FFEC6F33D7F}C:\programme1\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\programme1\mozilla firefox\firefox.exe | "UDP Query User{C5A1EA7E-A2BD-462C-B3B3-930FCB48E9A0}C:\programme1\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\programme1\bittorrent\bittorrent.exe | "UDP Query User{F0171DFC-4DAD-4EC9-A24F-9100368BFE0F}D:\games\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=d:\games\far cry 2\bin\farcry2.exe | "UDP Query User{FB15FC86-2460-41EE-AD60-06C16988F64F}D:\games\kane and lynch dead men\kaneandlynch.exe" = protocol=17 | dir=in | app=d:\games\kane and lynch dead men\kaneandlynch.exe | "UDP Query User{FE8BEC90-7DA2-492B-9371-01046572D961}C:\games\call of duty - world at war\codwaw.unpacked.exe" = protocol=17 | dir=in | app=c:\games\call of duty - world at war\codwaw.unpacked.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007 "{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007 "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "NVIDIA Drivers" = NVIDIA Drivers "PCSI" = Prevx [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{005E738B-5A0A-4483-A900-877D183A8F45}_is1" = BlindWrite 6 "{00C58EBE-223E-4AB6-8AE9-38F27F4420BD}" = WISO Sparbuch 2009 "{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable "{0C9D0200-FA32-44B7-BBB3-7C03F700C4A0}" = Sound Blaster X-Fi "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11 "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}" = Need for Speed™ ProStreet "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support "{46B70DEB-97B3-4E38-B746-EC16905E6A8F}" = WISO Sparbuch 2010 "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008 "{5EDB9281-1F84-4195-9CDD-85985D17DDC7}" = WISO Sparbuch 2007 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{74224F8D-4A17-4816-9EDB-7BB854DE532C}" = NVIDIA PhysX v8.04.25 "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec "{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = pdf24 "{8410B358-107A-4FB7-AB2B-6FD952F15A8F}" = Nero 8 "{86798B9C-A97F-47FB-B3DD-740551F33EF7}" = WISO Sparbuch 2007 - Multimedia-Erweiterung "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002A-0000-1000-0000000FF1CE}_VISPRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002A-0407-1000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007 "{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2) "{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007 "{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{60CC0F2D-BFA0-4851-903D-809D876DD87B}" = Microsoft Office Visio 2007 Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A1973A71-BC23-4A8C-A0A0-2B0497B7EAF4}" = WISO Sparbuch 2008 "{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE "{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701 "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2 "{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8 "{ADE91A13-434D-4229-00BC-182BAD607303}" = Need for Speed™ Most Wanted "{AEBC4CA2-B05F-47E3-8680-B2CDB6E12006}" = WISO Sparbuch 2006 "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5 "{CC038D57-788A-4544-BF8F-179E5CF50D2F}" = Microsoft Visual C++ 2005 SP1 CRT Redistributable "{D4134B0B-EA9B-4835-A77A-60BEE6277101}" = Lightroom "{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes "{F1A14CB2-A048-45A6-AFDA-3571296E1D76}" = Creative Media Toolbox 6 "{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2 "ALchemy" = Creative ALchemy "AudioCS" = Creative Audio-Systemsteuerung "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AVMWLANCLI" = AVM FRITZ!WLAN "CCleaner" = CCleaner "CDex" = CDex extraction audio "CloneDVD2" = CloneDVD2 "Creative Software AutoUpdate" = Creative Software AutoUpdate "Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition "Diagnostics 4_5" = Creative-Diagnose "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters "DVD Decrypter" = DVD Decrypter (Remove Only) "DVD-CLONER VI_is1" = DVD-CLONER V6.00 Build 978 "DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0 "ENTERPRISE" = Microsoft Office Enterprise 2007 "HijackThis" = HijackThis 2.0.2 "Host OpenAL" = Host OpenAL "HyperSnap 6" = HyperSnap 6 "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}" = Wolfenstein "KLiteCodecPack_is1" = K-Lite Codec Pack 3.8.0 Full "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Mozilla Firefox (3.5.6)" = Mozilla Firefox (3.5.6) "OpenAL" = OpenAL "TomTom HOME" = TomTom HOME 2.7.3.1894 "Uninstaller_B4736000_Creative Media Toolbox 6" = Creative Media Toolbox 6 (Shared Components) "VISPRO" = Microsoft Office Visio Professional 2007 "VLC media player" = VideoLAN VLC media player 0.8.4a "WaveStudio 7" = Creative WaveStudio 7 "Winamp" = Winamp "WinRAR archiver" = WinRAR ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BitTorrent" = BitTorrent "BitTorrent DNA" = DNA ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 06.01.2010 11:00:42 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 11:00:42 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnap.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 11:00:45 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero Toolkit\DiscSpeed.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Error - 06.01.2010 14:17:53 | Computer Name = Dom | Source = VSS | ID = 8194 Description = Error - 06.01.2010 14:20:51 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 14:20:51 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 14:20:51 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnap.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 14:20:51 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero PhotoSnap\PhotoSnap.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Error - 06.01.2010 14:20:52 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero Toolkit\DiscSpeed.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. Error - 06.01.2010 14:20:52 | Computer Name = Dom | Source = SideBySide | ID = 16842830 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Programme1\Nero\Nero8\Nero Toolkit\DiscSpeed.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion. Die widersprüchlichen Komponenten sind: Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest. [ OSession Events ] Error - 08.07.2008 15:11:06 | Computer Name = Mannheim | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 69 seconds with 0 seconds of active time. This session ended with a crash. Error - 09.04.2009 07:17:54 | Computer Name = Mannheim | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 771 seconds with 420 seconds of active time. This session ended with a crash. Error - 29.06.2009 15:54:32 | Computer Name = Mannheim | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9216 seconds with 0 seconds of active time. This session ended with a crash. Error - 19.07.2009 13:04:08 | Computer Name = Mannheim | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 06.01.2010 09:01:14 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 09:01:14 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 09:26:59 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 09:26:59 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 11:01:47 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 11:01:47 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 11:27:33 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 11:27:33 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 14:21:52 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = Error - 06.01.2010 14:21:52 | Computer Name = Dom | Source = Service Control Manager | ID = 7000 Description = < End of report > |
Hmm, einige Mainfeste von Nero beschädigt, sonst ist eigentlich ausser einige Kleinigkeiten nichts zu finden (DANKE an den OTL-Fachmann!)... Werde mich mal mit Kollegen beraten.... So, das SecurityCenter ist ausgeschaltet: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 Wenn Du Dich mit Regedit auskennst, kannst Du den Wert von cval auf 1 setzen (der ist lt. OTL auf 0 gesetzt, damit läuft es nicht). Sonst basteln wir uns morgen dafür was (ich mach jetzt die Fliege ins Bett)... chris |
Hi, Backup der Registry erstellen mit ERUNT: * Lade Dir ERUNT von folgender Adresse: http://aumha.org/freeware/freeware.php * Wähle die Installationsversion von ERUNT (nicht die gepackte) und installiere es auf deutsch * Nach der Installation startet er gleich, alle Auswahlen so lassen * Backup durchführen Note: Um das Backup der Registry wieder einzuspielen, wechsele per commandline in das Backupverzeichns und starte ERDNT.exe (falls was schief gehen sollte, allerdings nur auf ausdrückliche Anweisung!) Hier ein Script für OTL: OTL starten, den Text in das Feld unten bei OTL reinkopieren (steht custom scans/fixes drüber) und dann "Run Fixes" oben links anklicken... Log posten! Code: :reg |
hey, gestern abend war ich dann auch fix und fertig, nachdem ich den ganzen tag vorm pc saß. und den rechner fast :killpc: Im momment bin ich noch um büro. ich meld emich dann heute abend wieder mit den ergebissen. Hast du noch ne idee, was ich mit dem sprachprogramm machen soll. Ich kann das ganz normal starten, bekomme es aber nicht deinstalliert. Das ist schon so ewig auf meinem rechner. das ich es aus den augen verloren hatte. :heilig: |
Hi, lass die von Prevx angegebenen Dateien bei Virustotal.com überprüfen, Prevx ist ein guter Scanner (beseitigt als Free-Edition leider nichts), neigt aber auch zu Fehlalarm. Wenn keine Deinstallationsanwendung "greifbar" ist und Du es nicht brauchst, einfach löschen (oder als Backup vorher packen)... chris |
Hi, ich habe zuerst den Wert 0 auf 1 gesetzt in der regedit "cval". Das hat aber nix gebracht. :mad: Hier mal der log von OTL nach dem ich dein script eingegeben habe.: OTL logfile created on: 07.01.2010 19:07:31 - Run 2 OTL by OldTimer - Version 3.1.21.0 Folder = C:\Users\bedlam\Desktop\Virusbekämpfung 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18865) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 7,00 Gb Available Physical Memory | 82,00% Memory free 16,00 Gb Paging File | 15,00 Gb Available in Paging File | 90,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,88 Gb Total Space | 143,23 Gb Free Space | 61,50% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 24,69 Gb Free Space | 10,60% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM Current User Name: bedlam Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\bedlam\Desktop\Virusbekämpfung\OTL.exe (OldTimer Tools) PRC - C:\Programme1\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme1\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Programme1\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Programme1\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme1\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) PRC - C:\Programme1\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) PRC - C:\Programme1\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme1\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) PRC - C:\Programme1\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) PRC - C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.) PRC - C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) PRC - C:\Windows\system\w98eject.exe (Sigmatel) ========== Modules (SafeList) ========== MOD - C:\Users\bedlam\Desktop\Virusbekämpfung\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV:64bit: - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx) SRV:64bit: - (FontCache) -- C:\Windows\SysNative\FntCache.dll (Microsoft Corporation) SRV:64bit: - (TuneUp.Defrag) -- C:\Windows\SysNative\TuneUpDefragService.exe (TuneUp Software GmbH) SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software GmbH) SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs) SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs) SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs) SRV - (TomTomHOMEService) -- C:\Programme1\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (AntiVirService) -- C:\Programme1\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme1\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) SRV - (Microsoft Office Groove Audit Service) -- C:\programme1\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (NMIndexingService) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) SRV - (Nero BackItUp Scheduler 3) -- C:\Programme1\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software GmbH) SRV - (PLFlash DeviceIoControl Service) -- C:\Windows\SysWOW64\IoctlSvc.exe (Prolific Technology Inc.) SRV - (MSDTC) -- C:\Windows\SysWOW64\Msdtc [2006.11.02 14:34:14 | 00,000,000 | ---D | M] SRV - (vds) -- C:\Windows\SysWOW64\wbem\vds.mof () SRV - (VSS) -- C:\Windows\SysWOW64\wbem\vss.mof () SRV - (MDM) -- C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) SRV - (IDriverT) -- C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (pxrts) -- C:\Windows\SysNative\drivers\pxrts.sys (Prevx) DRV:64bit: - (pxscan) -- C:\Windows\SysNative\drivers\pxscan.sys (Prevx) DRV:64bit: - (pxkbf) -- C:\Windows\SysNative\drivers\pxkbf.sys (Prevx) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH) DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek ) DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\Drivers\AnyDVD.sys (SlySoft, Inc.) DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (t3) -- C:\Windows\SysNative\drivers\t3.sys (Creative Technology Ltd.) DRV:64bit: - (ezplay) -- C:\Windows\SysNative\Drivers\ezplay.sys (VSO Software) DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\Drivers\pcouffin.sys (VSO Software) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\Drivers\sptd.sys () DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\DRIVERS\fwlanusb.sys (AVM GmbH) DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin) DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation) DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (mpsdrv) -- C:\Windows\SysWOW64\wbem\mpsdrv.mof () DRV - ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) -- C:\Programme1\PowerDVD8\PowerDVD8\000.fcl (Cyberlink Corp.) DRV - (Tcpip) -- C:\Windows\SysWOW64\wbem\tcpip.mof () DRV - (ElbyCDIO) -- C:\Windows\SysWOW64\drivers\ElbyCDIO.sys (Elaborate Bytes AG) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ftd.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.ftd.de" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Programme1\Mozilla Firefox\components [2009.12.25 20:54:59 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Programme1\Mozilla Firefox\plugins [2010.01.06 15:58:06 | 00,000,000 | ---D | M] [2008.10.03 19:05:35 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Extensions [2008.10.03 19:05:35 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2010.01.06 20:30:49 | 00,000,000 | ---D | M] -- C:\Users\bedlam\AppData\Roaming\mozilla\Firefox\Profiles\jte5xmi8.default\extensions O1 HOSTS File: (761 bytes) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme1\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme1\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme1\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme1\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme1\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme1\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [GrooveMonitor] C:\programme1\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Programme1\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SPIRunE] C:\Windows\SysWow64\SpiRunE.dll (Creative Technology Ltd.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme1\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AnyDVD] C:\Programme1\DVD\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [TomTomHOME.exe] C:\programme1\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - Startup: C:\Users\bedlam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Programme1\ERUNT\AUTOBACK.EXE () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme1\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme1\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme1\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab (Creative Software AutoUpdate Support Package) O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme1\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme1\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{40b7dd3f-9174-11dd-bb49-001d7da643aa}\Shell\AutoRun\command - "" = M:\InstallTomTomHOME.exe -- File not found O33 - MountPoints2\{5f60b683-ec83-11dc-bfb1-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{5f60b683-ec83-11dc-bfb1-806e6f6e6963}\Shell\AutoRun\command - "" = E:\start.exe -- File not found O33 - MountPoints2\{65a957bb-0651-11dd-9bb5-001d7da643aa}\Shell - "" = AutoRun O33 - MountPoints2\{65a957bb-0651-11dd-9bb5-001d7da643aa}\Shell\AutoRun\command - "" = G:\start.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - comfile [open] -- "%1" %* File not found 64bit: O35 - exefile [open] -- "%1" %* File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.01.07 19:04:39 | 00,000,000 | ---D | C] -- C:\_OTL [2010.01.06 21:02:40 | 00,044,944 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys [2010.01.06 21:02:40 | 00,034,656 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys [2010.01.06 21:02:39 | 00,022,296 | ---- | C] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys [2010.01.06 21:02:39 | 00,000,000 | ---D | C] -- C:\Programme\Prevx [2010.01.06 21:01:52 | 00,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI [2010.01.06 20:47:28 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW [2010.01.06 20:22:41 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\trend micro [2010.01.06 20:22:41 | 00,000,000 | ---D | C] -- C:\rsit [2010.01.06 16:17:21 | 00,000,000 | ---D | C] -- C:\Users\bedlam\Desktop\Virusbekämpfung [2010.01.06 14:53:41 | 00,000,000 | ---D | C] -- C:\Users\bedlam\AppData\Roaming\Malwarebytes [2010.01.06 14:53:38 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.01.06 14:53:37 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.01.06 14:53:36 | 00,022,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2009.12.25 21:07:46 | 00,010,488 | ---- | C] (Sonic Solutions) -- C:\Windows\SysNative\drivers\cdralw2k.sys [2009.12.25 21:07:46 | 00,010,488 | ---- | C] (Sonic Solutions) -- C:\Windows\SysNative\drivers\cdr4_xp.sys [2009.12.25 20:54:50 | 00,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2009.12.14 23:41:18 | 00,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll [2009.12.14 23:41:18 | 00,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll [2009.12.14 23:41:18 | 00,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll [2009.12.14 23:41:18 | 00,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll [2009.12.14 23:41:17 | 05,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll [2009.12.14 23:41:17 | 05,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll [2009.12.14 23:41:17 | 02,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll [2009.12.14 23:41:17 | 01,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll [2009.12.14 23:41:16 | 00,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll [2009.12.14 23:41:16 | 00,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll [2009.12.14 23:41:15 | 02,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll [2009.12.14 23:41:15 | 00,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll [2009.12.14 23:41:11 | 00,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll [2009.12.14 23:41:11 | 00,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll [2009.12.14 23:41:05 | 00,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll [2009.12.14 23:41:05 | 00,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll [2009.12.14 23:41:04 | 00,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll [2009.12.14 23:41:04 | 00,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll [2009.12.14 23:41:03 | 00,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll [2009.12.14 23:41:03 | 00,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll [2009.12.14 23:41:02 | 00,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll [2009.12.14 23:41:02 | 00,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll [2009.12.14 23:41:00 | 00,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll [2009.12.14 23:41:00 | 00,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll [2009.12.14 23:41:00 | 00,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll [2009.12.14 23:41:00 | 00,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll [2009.12.14 23:40:59 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll [2009.12.14 23:40:59 | 00,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll [2009.12.09 21:20:11 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshhttp.dll [2009.12.09 21:20:11 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshhttp.dll [2009.12.09 21:20:09 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\httpapi.dll [2009.12.09 21:20:09 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\httpapi.dll [2009.12.09 21:13:52 | 02,334,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll [2009.12.09 21:13:52 | 00,916,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2009.12.09 21:13:51 | 01,538,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2009.12.09 21:13:51 | 01,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2009.12.09 21:13:51 | 01,147,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wininet.dll [2009.12.09 21:13:51 | 00,700,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2009.12.09 21:13:51 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2009.12.09 21:13:51 | 00,459,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iedkcs32.dll [2009.12.09 21:13:51 | 00,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iedkcs32.dll [2009.12.09 21:13:51 | 00,252,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2009.12.09 21:13:51 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll [2009.12.09 21:13:51 | 00,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2009.12.09 21:13:51 | 00,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2009.12.09 21:13:51 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2009.12.09 21:13:51 | 00,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe [2009.12.09 21:13:51 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2009.12.09 21:13:51 | 00,162,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2009.12.09 21:13:51 | 00,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2009.12.09 21:13:51 | 00,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2009.12.09 21:13:51 | 00,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2009.12.09 21:13:51 | 00,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2009.12.09 21:13:51 | 00,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2009.12.09 21:13:51 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll [2009.12.09 21:13:51 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2009.12.09 21:13:51 | 00,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2009.12.09 21:13:51 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2009.12.09 21:13:51 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll [2009.12.09 21:13:51 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsproxy.dll [2009.12.09 21:13:51 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsproxy.dll [2009.12.09 21:13:51 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2009.12.09 21:13:51 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2009.12.09 21:13:12 | 00,280,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rastls.dll [2009.12.09 21:13:12 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rastls.dll [2008.12.30 12:44:27 | 00,118,400 | ---- | C] (VSO Software) -- C:\Users\bedlam\AppData\Roaming\ezplay.sys [2008.06.06 19:24:03 | 00,082,816 | ---- | C] (VSO Software) -- C:\Users\bedlam\AppData\Roaming\pcouffin.sys [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.01.07 19:06:28 | 00,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{AB09B86F-21F9-4501-8762-62EDA0FDF34B}.job [2010.01.07 19:05:23 | 02,883,584 | ---- | M] () -- C:\Users\bedlam\NTUSER.DAT [2010.01.07 19:00:05 | 00,000,814 | ---- | M] () -- C:\Users\bedlam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2010.01.07 19:00:04 | 00,000,634 | ---- | M] () -- C:\Users\bedlam\Desktop\NTREGOPT.lnk [2010.01.07 19:00:04 | 00,000,615 | ---- | M] () -- C:\Users\bedlam\Desktop\ERUNT.lnk [2010.01.07 18:48:21 | 01,427,212 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.01.07 18:48:21 | 00,621,714 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.01.07 18:48:21 | 00,589,884 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.01.07 18:48:21 | 00,123,452 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.01.07 18:48:21 | 00,101,896 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.01.07 18:42:25 | 00,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib [2010.01.07 18:42:15 | 00,034,990 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.01.07 18:42:14 | 00,034,990 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.01.07 18:41:50 | 00,004,176 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.01.07 18:41:50 | 00,004,176 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.01.07 18:41:47 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.01.07 18:41:44 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.01.07 18:39:56 | 00,524,288 | -HS- | M] () -- C:\Users\bedlam\NTUSER.DAT{e77957ec-ae5a-11de-8519-001a4f473cab}.TMContainer00000000000000000001.regtrans-ms [2010.01.07 18:39:56 | 00,065,536 | -HS- | M] () -- C:\Users\bedlam\NTUSER.DAT{e77957ec-ae5a-11de-8519-001a4f473cab}.TM.blf [2010.01.07 18:39:52 | 03,633,321 | -H-- | M] () -- C:\Users\bedlam\AppData\Local\IconCache.db [2010.01.06 21:02:40 | 00,044,944 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxrts.sys [2010.01.06 21:02:40 | 00,034,656 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxscan.sys [2010.01.06 21:02:39 | 00,022,296 | ---- | M] (Prevx) -- C:\Windows\SysNative\drivers\pxkbf.sys [2010.01.06 21:02:34 | 00,000,051 | ---- | M] () -- C:\Windows\wininit.ini [2010.01.06 16:18:45 | 00,001,559 | ---- | M] () -- C:\Users\bedlam\Desktop\CCleaner.lnk [2010.01.06 14:53:41 | 00,000,719 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.06 13:45:19 | 00,001,460 | ---- | M] () -- C:\Users\bedlam\AppData\Local\d3d9caps64.dat [2010.01.06 11:41:31 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2010.01.06 10:53:35 | 00,000,008 | ---- | M] () -- C:\ProgramData\sysReserve.ini [2010.01.05 17:25:37 | 00,000,885 | ---- | M] () -- C:\Windows\wiso.ini [2010.01.05 17:18:03 | 00,001,790 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk [2010.01.05 17:18:03 | 00,001,709 | ---- | M] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk [2010.01.05 15:44:26 | 00,466,456 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2010.01.05 15:44:26 | 00,444,952 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2010.01.05 15:44:26 | 00,122,904 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysNative\OpenAL32.dll [2010.01.05 15:44:26 | 00,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysWow64\OpenAL32.dll [2010.01.05 15:42:32 | 00,000,959 | RH-- | M] () -- C:\Windows\ctfile.rfc [2010.01.03 21:40:39 | 00,026,276 | ---- | M] () -- C:\Users\bedlam\Desktop\Analyse.xlsx [2010.01.02 18:23:46 | 00,089,600 | ---- | M] () -- C:\Users\bedlam\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.12.30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2009.12.30 14:55:06 | 00,022,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2009.12.25 21:09:02 | 00,001,788 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk [2009.12.25 21:07:43 | 00,001,869 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom.lnk [2009.12.25 20:54:54 | 00,001,627 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2009.12.11 20:49:04 | 00,001,770 | ---- | M] () -- C:\Windows\ShowSetup.mif [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.01.07 19:00:05 | 00,000,814 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2010.01.07 19:00:04 | 00,000,634 | ---- | C] () -- C:\Users\bedlam\Desktop\NTREGOPT.lnk [2010.01.07 19:00:04 | 00,000,615 | ---- | C] () -- C:\Users\bedlam\Desktop\ERUNT.lnk [2010.01.06 21:01:52 | 00,000,051 | ---- | C] () -- C:\Windows\wininit.ini [2010.01.06 16:18:45 | 00,001,559 | ---- | C] () -- C:\Users\bedlam\Desktop\CCleaner.lnk [2010.01.06 14:53:41 | 00,000,719 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.06 10:53:35 | 00,000,008 | ---- | C] () -- C:\ProgramData\sysReserve.ini [2010.01.05 17:20:40 | 00,436,332 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistMSI3A35.txt [2010.01.05 17:20:40 | 00,011,698 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistUI3A35.txt [2010.01.05 17:18:03 | 00,001,790 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk [2010.01.05 17:18:03 | 00,001,709 | ---- | C] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk [2010.01.05 15:50:54 | 00,034,990 | ---- | C] () -- C:\ProgramData\nvModes.dat [2010.01.05 15:50:54 | 00,034,990 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.12.25 21:07:43 | 00,001,869 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom.lnk [2009.12.25 20:54:54 | 00,001,627 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2009.12.05 18:16:50 | 00,000,306 | ---- | C] () -- C:\Windows\game.ini [2009.11.06 10:58:04 | 00,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.10.22 13:53:41 | 00,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2009.09.11 19:25:21 | 00,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll [2009.09.11 19:24:43 | 00,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.07.22 21:39:45 | 00,069,632 | ---- | C] () -- C:\Windows\SysWow64\xmltok.dll [2009.07.22 21:39:45 | 00,036,864 | ---- | C] () -- C:\Windows\SysWow64\xmlparse.dll [2009.06.05 08:22:31 | 00,024,226 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\UserTile.png [2009.03.22 17:28:33 | 00,421,730 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistMSI0BCF.txt [2009.03.22 17:28:33 | 00,011,482 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_vcredistUI0BCF.txt [2009.03.11 17:13:38 | 00,809,368 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_NET_Framework35_LangPack_MSI24EE.txt [2009.03.11 17:13:22 | 00,036,032 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_depcheck_NETFX_EXP_35.txt [2009.03.11 17:13:16 | 00,078,574 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx35install_lp.txt [2009.03.11 17:13:16 | 00,000,002 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx35error_lp.txt [2009.02.03 21:55:04 | 00,000,038 | ---- | C] () -- C:\Windows\avisplitter.INI [2009.01.14 02:47:24 | 00,001,436 | ---- | C] () -- C:\Windows\CfgHPSp.ini [2009.01.14 02:47:24 | 00,001,434 | ---- | C] () -- C:\Windows\Cfg05Sp.ini [2009.01.14 02:47:24 | 00,001,434 | ---- | C] () -- C:\Windows\Cfg04Sp.ini [2009.01.14 02:47:24 | 00,001,091 | ---- | C] () -- C:\Windows\Cfg03Sp.ini [2009.01.14 02:47:24 | 00,001,091 | ---- | C] () -- C:\Windows\Cfg02Sp.ini [2009.01.14 02:47:24 | 00,001,000 | ---- | C] () -- C:\Windows\Cfg01Sp.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\CfgHPHp.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\CfgHPDO.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\Cfg05DO.ini [2009.01.14 02:47:24 | 00,000,932 | ---- | C] () -- C:\Windows\Cfg04DO.ini [2009.01.14 02:47:24 | 00,000,930 | ---- | C] () -- C:\Windows\Cfg05Hp.ini [2009.01.14 02:47:24 | 00,000,930 | ---- | C] () -- C:\Windows\Cfg04Hp.ini [2009.01.14 02:47:24 | 00,000,818 | ---- | C] () -- C:\Windows\Cfg01APR.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg03Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg03DO.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg02Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg02DO.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg01Hp.ini [2009.01.14 02:47:24 | 00,000,725 | ---- | C] () -- C:\Windows\Cfg01DO.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPRMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPRLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPFMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\CfgHPDI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05RMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05RLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05FMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg05DI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04RMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04RLI.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04FMi.ini [2009.01.14 02:47:24 | 00,000,453 | ---- | C] () -- C:\Windows\Cfg04DI.ini [2008.12.30 13:06:39 | 00,056,340 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_depcheckdotnetfx30.txt [2008.12.30 13:06:35 | 00,064,802 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx3install.txt [2008.12.30 13:06:35 | 00,007,102 | ---- | C] () -- C:\Users\bedlam\AppData\Local\uxeventlog.txt [2008.12.30 13:06:35 | 00,001,434 | ---- | C] () -- C:\Users\bedlam\AppData\Local\dd_dotnetfx3error.txt [2008.12.30 12:44:55 | 00,000,034 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.log [2008.12.30 12:44:27 | 00,007,833 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.cat [2008.12.30 12:44:27 | 00,001,126 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.inf [2008.12.30 12:44:27 | 00,000,125 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezplay.ini [2008.10.17 01:33:50 | 00,150,016 | ---- | C] () -- C:\Windows\SysWow64\OemSpiE.dll [2008.06.14 14:37:57 | 00,099,384 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\ezpinst.exe [2008.06.07 12:26:31 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008.06.06 19:24:27 | 00,000,034 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.log [2008.06.06 19:24:03 | 00,099,384 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\inst.exe [2008.06.06 19:24:03 | 00,007,859 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.cat [2008.06.06 19:24:03 | 00,001,167 | ---- | C] () -- C:\Users\bedlam\AppData\Roaming\pcouffin.inf [2008.05.25 22:19:17 | 00,002,048 | ---- | C] () -- C:\Windows\SysWow64\syscvchk.dll [2008.05.25 22:16:27 | 00,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini [2008.05.12 16:09:53 | 00,000,245 | ---- | C] () -- C:\Windows\BUHL.INI [2008.05.12 11:13:23 | 00,000,253 | ---- | C] () -- C:\Windows\tm.ini [2008.05.05 20:05:24 | 00,007,867 | ---- | C] () -- C:\Windows\Irremote.ini [2008.05.04 15:30:54 | 00,000,162 | ---- | C] () -- C:\Windows\ODBC.INI [2008.04.12 18:33:39 | 00,000,178 | ---- | C] () -- C:\Windows\Clony2.ini [2008.04.12 12:53:06 | 00,215,144 | ---- | C] () -- C:\Windows\patchw32.dll [2008.04.04 16:10:43 | 01,491,338 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2008.03.16 17:53:18 | 00,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2008.03.16 17:53:16 | 00,755,027 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2008.03.16 17:53:16 | 00,159,839 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2008.03.16 17:53:15 | 00,007,680 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2008.03.16 17:53:15 | 00,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest [2008.03.15 14:38:41 | 00,000,885 | ---- | C] () -- C:\Windows\wiso.ini [2008.03.15 13:04:13 | 00,004,626 | ---- | C] () -- C:\Windows\SysWow64\AudioDrv.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03RMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03RLI.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03FMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg03DI.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02RMi.ini [2008.03.15 13:03:13 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02RLI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02FMi.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg02DI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01Mic.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01LI.ini [2008.03.15 13:03:12 | 00,000,453 | R--- | C] () -- C:\Windows\Cfg01DI.ini [2008.03.15 13:03:04 | 00,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2008.03.15 13:03:04 | 00,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2008.03.12 19:10:39 | 00,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.03.08 07:19:18 | 00,089,600 | ---- | C] () -- C:\Users\bedlam\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.03.07 22:12:50 | 00,000,680 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d9caps.dat [2008.03.07 21:56:13 | 00,000,552 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d8caps.dat [2008.03.07 21:27:06 | 00,001,460 | ---- | C] () -- C:\Users\bedlam\AppData\Local\d3d9caps64.dat [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll [2007.07.23 08:03:32 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll [2007.07.23 08:03:30 | 00,053,248 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll [2002.06.28 10:43:44 | 00,438,272 | ---- | C] () -- C:\Windows\SysWow64\xvid.dll [2002.05.16 00:38:40 | 00,091,136 | ---- | C] () -- C:\Windows\SysWow64\mp4fil32.dll [2002.05.04 14:19:00 | 00,049,152 | ---- | C] () -- C:\Windows\SysWow64\avisynthEx.dll < End of report > |
so, ich habe einen Neustart durchgeführt. Das Sicherheistcenter lässt sich aber immer noch nicht aktivieren :headbang: Was soll ich den jetzt machen? brauchst du noch ein anderes logfile? |
Hi, seltsam... Sehe wir mal nach... Start->ins suchfeld eingeben msconfig enter, Reiter Dienste, dort den Dienst "Sicherheitscenter" suchen und prüfen ob er gestartet ist... Weiter auf den Reiter "Tools" navigieren, und dort "Sicherheitscenter" starten... chris |
Hi Chris, also der Entrag ist garnicht vorhanden. Das einzige was da so ungefähr passt ist "Sicherheistkonto-Manager" und das ist gestartet. |
Hi, nicht da? Test: Folgende Zeile in Start->Suchfeld kopieren und enter, das Sicherheitscenter sollte starten... Code: C:\Windows\System32\wscui.cpl |
jupp, das klappt jetzt. das programm öffnet sich. aber wenn ich auf "jetzt einschalten" gehe, sagt er mir "Der Sicherheitsdienst konnte nicht gestartet werden" P.S. Unten rechts in der Taskleiste neben der Uhr ist auch das entsprechende Sysmbol. Ich habe den Eintrag nur nicht in der config.sys unter dienste gesehen. Warum auch immer |
Stufe tiefer, next turn... Start->Suchfeld (kennst Du ja jetzt schon :rolleyes:) computerverwaltung enter. Navigieren auf "Dienste" (ziemlich weit unten im linken Bereich), draufklicken, jetzt im rechten Bereich "Sicherheitscenter" suchen, Doppelklick drauf machen. Im ersten Reiter des sich jetzt öffnenden Fensters "Starttyp" prüfen, sollte sein: "Automatisch (verzögerter Start)" Ansonsten liegt ein Berechtigungsproblem vor, das wäre der zweite Reiter "Anmelden", da verlassen wir aber dann mein "Gebiet" wo ich mich auskenne... Sollte sein "Lokaler Dienst", Passwort (keine Ahnung, Deines von der Anmeldung?)... chris Ps.: Gibt es auch eine Fehlernummer zur Meldung? |
Hi, das Security-Center wird von dem Teil gestoppt, der Dienst wird disabled. Wenn das vorhin nicht geklapt hat, wie folgt vorgehen: Öffne eine Commandline-Shell mit Adminrechten. Am Einfachsten Du erstellst eine entsprechende Verknüpfung auf dem Desktop. Ziel der Verknüpfung ist "C:\Windows\System32\cmd.exe". Ausführen als Administrator ankreuzen nicht vergessen... Dort reinschreiben: Code: sc config wscsvc start=autoCode: net start wscsvc%Temp%\wow64main.exe und %Temp%\wscsvc32.exe, Beide sind bei Dir nicht zu finden... In der Registry werden verschiedene Einträge modifiziert, die bis auf die Runanweisung nicht so kritisch sind... chris |
Hi, ich habe jetzt erstmal das gemacht, was du im vorhergehenden Beitrag geschrieben hast. Immerhin ist jetzt das Securitycenter wieder am laufen.:daumenhoc :applaus: :dankeschoen: Ich habe dann gleich nochmal MAM laufen lassen. Das hat noch einen Eintrag gefunden. "Malware.Trace c:\32788R22FWJFW\combo-Fix.sys" Soll ich das entfernen? Morgen lass ich Prevx und Antivir nochmal drüber laufen. Jetzt verschwinde ich aber erstmal in die Koje, bin hunde müde. |
Hi, nein, lass das stehen, das gehört zu Combofix (c:\32788R22FWJFW\combo-Fix.sys"). Deinstalliere Combofix bevor Du den Scan anstösst über: Start->combofix /u Wenn wieder was gefunden würde, dann hätten es wir mit einer neuen Variante zu tun... chris |
Hi, sag mal, wie kann ich das combofix deinstallieren? Ich glaiub ich stelle mich gerade etwas dappich an. Prevx hört bei mir nach 64% auf zu scannen und meldet ein sauberes System. Sollte das nicht bis 100% durchlaufen? |
Hi, combofix deinstallieren über Start, ins suchfeld combofix /unistall return eingeben... Wie ist der Stand, was macht das Sicherheitscenter bzw. der Treiber dazu? Prevx hört vorher auf... einfach so... Hmmm..... Deinstalliere Prevx wir schauen mal mit Dr. Web nach... http://www.trojaner-board.de/59299-anleitung-drweb-cureit.html chris |
Liste der Anhänge anzeigen (Anzahl: 1) So, da bin ich wieder. Das ist stand der dinge: Prevx findet nix mehr Antivir auch nicht Malwarebytes gibt eine Meldeung raus, die sich auch combofix bezieht. Das Programm bekomme ich aber weiterhin nicht deinstalliert. :-( Anbei mal ein Hypersnap vom Pfad mit den Dateien.Es liegen Dateien von combofix und Erunt im gleichen Verzeichnis. Ist das richtig? Ich dachte das wäre unterschiedliche Programme :confused Dann noch Logfiles von 1. MAM, 2. OTL Wie ist deine Meinung zum System? Okay soweit? |
Hier noch die Logs von RSIT |
Hi, C:\Windows\System32\drivers\pxkbf.sys -> http://www.prevx.com/filenames/X2397...PXKBF.SYS.html Versuche die Datei mal bei Virustotal.com prüfen zu lassen... Das gehört entweder zu Prevx oder ist ein Rookit... Lass nochmal Gmer laufen... ERUNT und CF sind auch getrennte Programme, wie lautet denn die Fehlermeldung beim Versuch der deinstallation? chris |
Liste der Anhänge anzeigen (Anzahl: 1) Zitat:
Wenn ich "combofix /unistall" eingebe, dann erscheit nur das Such-Fenster und die Datei wird nicht gefunden. Das ist wie bei dem User in diesem Thread, Seite 4 h**p://www.trojaner-board.de/79817-security-tool-4.html Anbei das log von gmer. Aber wie das letzte mal. ich kann auf der rechten seite nicht alles anhaken. Adminrechte habe ich. Siehe auch screenshot GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-10 20:56:44 Windows 6.0.6002 Service Pack 2 Running: prl8lwt9.exe ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme1\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x34 0x65 0x5B 0x2E ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x11 0xFD 0xEE 0xB5 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x25 0x6D 0xAC 0x44 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xEA 0xFD 0x61 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xA3 0xAE 0x10 0x2A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xB1 0xEA 0xFD 0x61 ... ---- EOF - GMER 1.0.15 ---- |
Hi, Log ist okay. CF versucht aber nicht zu starten, oder (insofern unterschiedlich zu dem Thread)... Installiere Combofix noch mal neu und probiere dann ihn zu deinstallieren... Combofix Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop. Antivierenlösung komplett auschalten und zwar so, dass sie sich auch nach einem Reboot NICHT einschaltet! Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Hoffen wir mal, dass er wieder komplett durchläuft... chris |
So, CF kann ich doch nicht installieren, da ich ein 64 Bit system habe. Ich habe jetzt einfach mal das ominöse Versichnis gelöscht. Dann habe ich noch DrWeb laufen lassen. Nachfolgend dazu das Log. Was sagst Du dazu? mirc616.exe\data001;A:\Sicherung alter PC\Programme\mirc616.exe;Program.mIRC.616;; mirc616.exe;A:\Sicherung alter PC\Programme;Container enthält infizierte Objekte;; $RC4E0IB.exe\32788R22FWJFW\List-C.bat;C:\$Recycle.Bin\S-1-5-21-2353367572-823071264-3059823556-1000\$RC4E0IB.exe;Wahrscheinlich BATCH.Virus;; $RC4E0IB.exe;C:\$Recycle.Bin\S-1-5-21-2353367572-823071264-3059823556-1000;Archiv enthält infizierte Objekte;Verschoben.; List-C.bat;C:\$Recycle.Bin\S-1-5-21-2353367572-823071264-3059823556-1000\$RSW12MI;Wahrscheinlich BATCH.Virus;; ComboFix.exe\32788R22FWJFW\List-C.bat;C:\Documents and Settings\bedlam\Desktop\Virusbekämpfung\ComboFix.exe;Wahrscheinlich BATCH.Virus;; ComboFix.exe;C:\Documents and Settings\bedlam\Desktop\Virusbekämpfung;Archiv enthält infizierte Objekte;Verschoben.; $RC4E0IB.exe\32788R22FWJFW\List-C.bat;C:\Documents and Settings\bedlam\DoctorWeb\Quarantine\$RC4E0IB.exe;Wahrscheinlich BATCH.Virus;; $RC4E0IB.exe;C:\Documents and Settings\bedlam\DoctorWeb\Quarantine;Archiv enthält infizierte Objekte;Verschoben.; ComboFix.exe\32788R22FWJFW\List-C.bat;C:\Documents and Settings\bedlam\DoctorWeb\Quarantine\ComboFix.exe;Wahrscheinlich BATCH.Virus;; ComboFix.exe;C:\Documents and Settings\bedlam\DoctorWeb\Quarantine;Archiv enthält infizierte Objekte;Verschoben.; $RC4E0I0.exe\32788R22FWJFW\List-C.bat;C:\Dokumente und Einstellungen\bedlam\DoctorWeb\Quarantine\$RC4E0I0.exe;Wahrscheinlich BATCH.Virus;; $RC4E0I0.exe;C:\Dokumente und Einstellungen\bedlam\DoctorWeb\Quarantine;Archiv enthält infizierte Objekte;Verschoben.; ComboFi0.exe\32788R22FWJFW\List-C.bat;C:\Dokumente und Einstellungen\bedlam\DoctorWeb\Quarantine\ComboFi0.exe;Wahrscheinlich BATCH.Virus;; ComboFi0.exe;C:\Dokumente und Einstellungen\bedlam\DoctorWeb\Quarantine;Archiv enthält infizierte Objekte;Verschoben.; 4b8bed5d.qua\data001;C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b8bed5d.qua;Trojan.Packed.650;; 4b8bed5d.qua;C:\ProgramData\Avira\AntiVir Desktop\INFECTED;Container enthält infizierte Objekte;Verschoben.; 4b90ed5b.qua\data001;C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b90ed5b.qua;Wahrscheinlich Trojan.Packed.Based;; 4b90ed5b.qua;C:\ProgramData\Avira\AntiVir Desktop\INFECTED;Container enthält infizierte Objekte;Verschoben.; 4ba0ed53.qua\data001;C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4ba0ed53.qua;Wahrscheinlich Trojan.Packed.Based;; 4ba0ed53.qua;C:\ProgramData\Avira\AntiVir Desktop\INFECTED;Container enthält infizierte Objekte;Verschoben.; |
Hi, das sind alle bereits gefundene Sachen (Avira) oder Combofix selbst... Lösche CF... chris |
Hi, wird erledigt. Wir müssten dann ja fertig sein. Der Thread könnte dann also geschlossen werden, wenn du keiner anderen Meinung bist, oder wir noch etwas prüfen müssen. Auf jeden Fall ein ganz dickes Dankeschön für die Hilf von dir :daumenhoc |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 04:35 Uhr. |
Copyright ©2000-2025, Trojaner-Board