Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Befall vom Windows Verschlüsselungstrojaner

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 07.06.2012, 13:09   #1
Taproot1976
 
Befall vom Windows Verschlüsselungstrojaner - Standard

Befall vom Windows Verschlüsselungstrojaner



Hallo,

auch mich hat es nun mit dem Windows Verschlüsselungs Trojaner erwischt.
Ich hab den Scan mit Malewarebites durchgeführt und hab das Ergebnis des Logs wie beschrieben unten eingefügt.

Leider bin ich ab jetzt trotz Anleitungen hier im Forum total überfordert, was ich nun weiterhin tun muss, um mein System wieder sauber zu bekommen.

Was bedeutet verschlüsselte Dateien entschlüsseln und wie gehe ich dabei vor?

Für Hilfe wäre ich sehr dankbar, da ich wie gesagt ein absoluter Laie und total überfordert bin.

Anbei das Log:


Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.07.03

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
TomTom :: TOMTOM-PC [Administrator]

07.06.2012 13:58:49
mbam-log-2012-06-07 (13-58-49).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 201703
Laufzeit: 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|C62BB140 (Trojan.Agent) -> Daten: C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg\80A76A04C62BB140317D.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg\80A76A04C62BB140317D.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)




habe nun noch, wie beschrieben defogger und OTL durchgeführt, dabei sind folgende Ergebnisse herausgekommen:

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:14 on 07/06/2012 (TomTom)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-




OTL.txt:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 07.06.2012 14:15:55 - Run 1
OTL by OldTimer - Version 3.2.46.2     Folder = C:\Users\TomTom\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
16,00 Gb Total Physical Memory | 14,84 Gb Available Physical Memory | 92,76% Memory free
32,00 Gb Paging File | 30,89 Gb Available in Paging File | 96,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55,80 Gb Total Space | 12,78 Gb Free Space | 22,90% Space Free | Partition Type: NTFS
Drive D: | 2,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 300,00 Gb Total Space | 252,81 Gb Free Space | 84,27% Space Free | Partition Type: NTFS
Drive F: | 631,51 Gb Total Space | 86,56 Gb Free Space | 13,71% Space Free | Partition Type: NTFS
 
Computer Name: TOMTOM-PC | User Name: TomTom | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012.04.05 21:57:34 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)
SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)
SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.26 17:32:39 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.10 16:41:27 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.10 15:53:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.10 15:53:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- E:\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.10 18:16:49 | 000,189,248 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2011.12.10 18:16:41 | 000,075,136 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.02.16 00:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012.02.16 00:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011.11.15 11:14:02 | 000,126,464 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RzSynapse.sys -- (RzSynapse)
DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.06.10 08:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.06.02 11:32:50 | 000,401,896 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011.06.02 11:32:50 | 000,128,488 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.09.29 12:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM)
DRV:64bit: - [2010.09.29 12:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2)
DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.08.24 00:55:32 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 17 AB 3D 6E A4 44 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Appz\Java\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Appz\Adope Reader X\Reader\AIR\nppdf32.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: E:\Appz\Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: E:\Appz\Firefox\plugins
 
[2011.11.11 18:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Extensions
[2012.05.03 18:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions
[2012.06.07 12:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Appz\Java\bin\jp2ssv.dll File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] E:\Appz\Setpoint\SetPointP\SetPoint.exe /launchGaming File not found
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avgnt] E:\Appz\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Logitech G35] E:\Appz\Logitech G35\G35.exe File not found
O4 - HKLM..\Run: [Razer Naga Driver] E:\Appz\Razer Naga\RazerNagaSysTray.exe File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] E:\Appz\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D483E299-B9BB-4BCF-BE63-A0A55FBD9C60}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.05 21:30:20 | 000,000,039 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.07 14:15:37 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
[2012.06.07 13:58:03 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Malwarebytes
[2012.06.07 13:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.07 13:57:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.07 13:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.07 13:56:51 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.07 12:30:10 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg
[2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Ubisoft
[2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft
[2012.06.06 19:24:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Rockstar Games
[2012.06.06 19:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.06.06 18:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Rockstar Games
[2012.06.06 17:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games
[2012.06.03 11:07:55 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\dxhr
[2012.06.03 11:07:21 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\28050
[2012.06.03 10:53:01 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDE2B48A-5632-4D42-8BF5-924CF1E0A57F}
[2012.06.03 10:52:45 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{EF77C2FA-D8A8-4F52-AECC-AB51AB55B532}
[2012.06.03 10:31:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2012.06.02 09:39:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{D4FCE0F8-EE3C-4659-A466-90AD2767B776}
[2012.06.02 09:39:37 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{4D8BE728-AAC9-49FD-856C-738C3AB88B8C}
[2012.06.01 11:51:26 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{366E1564-1267-49A6-B826-DA6C8B61DA38}
[2012.06.01 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDBACFB2-5880-4096-A400-873055DC2C7C}
[2012.05.31 16:41:39 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{9CFDFF90-2890-4445-94CB-B9F7058E0A24}
[2012.05.31 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{661A89E0-C6B3-4623-AA5B-E2C9268527BC}
[2012.05.27 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Star_Vault
[2012.05.24 23:00:52 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\ArmA 2 OA
[2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\ArmA 2
[2012.05.24 19:00:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2012.05.24 18:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2012.05.18 15:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.05.18 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.05.18 15:50:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.05.18 15:45:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA
[2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA
[2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\es-ES
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\es
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0C0A
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\es-ES
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\es
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0C0A
[2012.05.18 15:42:06 | 000,000,000 | ---D | C] -- C:\Windows\es-ES
[2012.05.18 15:39:13 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\es-ES\pscr.sys.mui
[2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerId.sys.mui
[2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerIb.sys.mui
[2012.05.18 15:39:05 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrParwdm.sys.mui
[2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\he-IL
[2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\he
[2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\he-IL
[2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\he
[2012.05.18 15:38:18 | 000,000,000 | ---D | C] -- C:\Windows\he-IL
[2012.05.18 15:35:43 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\he-IL\pscr.sys.mui
[2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerId.sys.mui
[2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerIb.sys.mui
[2012.05.18 15:35:35 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrParwdm.sys.mui
[2012.05.18 15:35:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sl-SI
[2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sl-SI
[2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\sl-SI
[2012.05.18 15:30:03 | 000,000,000 | ---D | C] -- C:\Windows\it-IT
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\it-IT
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\it
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0410
[2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\it-IT
[2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0410
[2012.05.18 15:29:55 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\it
[2012.05.18 15:27:36 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\it-IT\pscr.sys.mui
[2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerId.sys.mui
[2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerIb.sys.mui
[2012.05.18 15:27:28 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrParwdm.sys.mui
[2012.05.18 15:26:47 | 000,000,000 | ---D | C] -- C:\Windows\fr-FR
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\fr-FR
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\fr
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ar-SA
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ar
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\040C
[2012.05.18 15:26:42 | 000,000,000 | ---D | C] -- C:\Windows\ar-SA
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\fr-FR
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\fr
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\ar-SA
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ar
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\040C
[2012.05.18 15:24:05 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\ar-SA\pscr.sys.mui
[2012.05.18 15:23:56 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerIb.sys.mui
[2012.05.18 15:23:55 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerId.sys.mui
[2012.05.18 15:23:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrParwdm.sys.mui
[2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en
[2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409
[2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sk-SK
[2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US
[2012.05.18 15:23:13 | 000,000,000 | ---D | C] -- C:\Windows\sk-SK
[2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en
[2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409
[2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sk-SK
[2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\en-US
[2012.05.18 15:21:02 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\en-US\pscr.sys.mui
[2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerId.sys.mui
[2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerIb.sys.mui
[2012.05.18 15:20:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrParwdm.sys.mui
[2012.05.17 10:53:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{485CB5D6-D82B-484D-8685-62226625857B}
[2012.05.17 10:53:41 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{C63D01E7-01B2-46D1-90FF-3C75C3FE8FEE}
[2012.05.16 10:02:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{155D2572-F3BA-4937-879B-EF0A706D2CE1}
[2012.05.16 10:02:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{B46C1653-E8A2-413E-A21E-383DC3AE93F3}
[2012.05.15 12:19:05 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{83791854-B717-4965-BA8C-F00286A6A129}
[2012.05.15 12:18:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F3085A7-AF42-4D51-A241-70534BD8AF2F}
[2012.05.15 11:08:28 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Diablo III
[2012.05.15 10:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.15 10:44:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.05.12 07:47:36 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{5AF14BF9-9DF2-4142-B46F-D3B1039A393C}
[2012.05.12 07:47:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{2FCF4905-C1B9-4892-B100-6DDF75C1CD52}
[2012.05.10 16:34:19 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\SysWow64\QtCore4.dll
[2012.05.10 16:34:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.05.10 16:34:18 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll
[2012.05.10 16:34:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2012.05.10 16:12:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{E607B543-B60F-4376-BDB2-66B2DFA75FAB}
[2012.05.10 16:12:31 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F33CB26-54CB-4A64-B414-F74CBD817B83}
[2012.05.10 15:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funcom
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
[2012.06.07 14:13:49 | 000,000,000 | ---- | M] () -- C:\Users\TomTom\defogger_reenable
[2012.06.07 14:13:37 | 000,050,477 | ---- | M] () -- C:\Users\TomTom\Desktop\Defogger.exe
[2012.06.07 14:11:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.07 14:11:00 | 4294,254,590 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.07 13:58:50 | 005,308,760 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.07 13:58:50 | 000,744,532 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat
[2012.06.07 13:58:50 | 000,739,584 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2012.06.07 13:58:50 | 000,707,316 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.07 13:58:50 | 000,689,572 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2012.06.07 13:58:50 | 000,660,934 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.07 13:58:50 | 000,477,168 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat
[2012.06.07 13:58:50 | 000,389,634 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat
[2012.06.07 13:58:50 | 000,162,318 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat
[2012.06.07 13:58:50 | 000,152,908 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.07 13:58:50 | 000,150,420 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2012.06.07 13:58:50 | 000,133,296 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2012.06.07 13:58:50 | 000,125,124 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.07 13:58:50 | 000,097,384 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat
[2012.06.07 13:58:50 | 000,087,494 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat
[2012.06.07 13:57:59 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.07 13:57:27 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.07 12:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.03 10:33:40 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk
[2012.05.25 08:16:49 | 000,002,072 | ---- | M] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.05.25 08:16:49 | 000,002,001 | ---- | M] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk
[2012.05.24 22:39:55 | 000,000,761 | ---- | M] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk
[2012.05.24 19:00:59 | 000,000,731 | ---- | M] () -- C:\Users\Public\Desktop\ARMA II starten.lnk
[2012.05.18 15:42:01 | 000,341,432 | ---- | M] () -- C:\Windows\SysNative\perfi00A.dat
[2012.05.18 15:42:01 | 000,041,390 | ---- | M] () -- C:\Windows\SysNative\perfd00A.dat
[2012.05.18 15:38:14 | 000,229,316 | ---- | M] () -- C:\Windows\SysNative\perfi00D.dat
[2012.05.18 15:38:14 | 000,032,166 | ---- | M] () -- C:\Windows\SysNative\perfd00D.dat
[2012.05.18 15:29:50 | 000,335,478 | ---- | M] () -- C:\Windows\SysNative\perfi010.dat
[2012.05.18 15:29:50 | 000,037,534 | ---- | M] () -- C:\Windows\SysNative\perfd010.dat
[2012.05.18 15:26:30 | 000,344,522 | ---- | M] () -- C:\Windows\SysNative\perfi00C.dat
[2012.05.18 15:26:30 | 000,289,060 | ---- | M] () -- C:\Windows\SysNative\perfi001.dat
[2012.05.18 15:26:30 | 000,042,056 | ---- | M] () -- C:\Windows\SysNative\perfd001.dat
[2012.05.18 15:26:30 | 000,038,160 | ---- | M] () -- C:\Windows\SysNative\perfd00C.dat
[2012.05.16 08:18:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.05.15 11:02:28 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.12 07:41:26 | 000,294,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.10 16:34:19 | 000,000,967 | ---- | M] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk
[2012.05.10 15:57:13 | 000,000,757 | ---- | M] () -- C:\Users\Public\Desktop\The Secret World.lnk
[2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
 
========== Files Created - No Company Name ==========
 
[2012.06.07 14:13:49 | 000,000,000 | ---- | C] () -- C:\Users\TomTom\defogger_reenable
[2012.06.07 14:13:33 | 000,050,477 | ---- | C] () -- C:\Users\TomTom\Desktop\Defogger.exe
[2012.06.07 13:57:59 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.03 10:33:40 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk
[2012.05.25 08:16:49 | 000,002,072 | ---- | C] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.05.25 08:16:49 | 000,002,001 | ---- | C] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk
[2012.05.24 22:39:55 | 000,000,761 | ---- | C] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk
[2012.05.24 19:00:59 | 000,000,731 | ---- | C] () -- C:\Users\Public\Desktop\ARMA II starten.lnk
[2012.05.18 15:42:32 | 000,744,532 | ---- | C] () -- C:\Windows\SysNative\perfh00A.dat
[2012.05.18 15:42:32 | 000,341,432 | ---- | C] () -- C:\Windows\SysNative\perfi00A.dat
[2012.05.18 15:42:32 | 000,162,318 | ---- | C] () -- C:\Windows\SysNative\perfc00A.dat
[2012.05.18 15:42:32 | 000,041,390 | ---- | C] () -- C:\Windows\SysNative\perfd00A.dat
[2012.05.18 15:38:39 | 000,389,634 | ---- | C] () -- C:\Windows\SysNative\perfh00D.dat
[2012.05.18 15:38:39 | 000,229,316 | ---- | C] () -- C:\Windows\SysNative\perfi00D.dat
[2012.05.18 15:38:39 | 000,087,494 | ---- | C] () -- C:\Windows\SysNative\perfc00D.dat
[2012.05.18 15:38:39 | 000,032,166 | ---- | C] () -- C:\Windows\SysNative\perfd00D.dat
[2012.05.18 15:30:20 | 000,739,584 | ---- | C] () -- C:\Windows\SysNative\perfh010.dat
[2012.05.18 15:30:20 | 000,335,478 | ---- | C] () -- C:\Windows\SysNative\perfi010.dat
[2012.05.18 15:30:20 | 000,150,420 | ---- | C] () -- C:\Windows\SysNative\perfc010.dat
[2012.05.18 15:30:20 | 000,037,534 | ---- | C] () -- C:\Windows\SysNative\perfd010.dat
[2012.05.18 15:27:05 | 000,289,060 | ---- | C] () -- C:\Windows\SysNative\perfi001.dat
[2012.05.18 15:27:04 | 000,689,572 | ---- | C] () -- C:\Windows\SysNative\perfh00C.dat
[2012.05.18 15:27:04 | 000,477,168 | ---- | C] () -- C:\Windows\SysNative\perfh001.dat
[2012.05.18 15:27:04 | 000,344,522 | ---- | C] () -- C:\Windows\SysNative\perfi00C.dat
[2012.05.18 15:27:04 | 000,133,296 | ---- | C] () -- C:\Windows\SysNative\perfc00C.dat
[2012.05.18 15:27:04 | 000,097,384 | ---- | C] () -- C:\Windows\SysNative\perfc001.dat
[2012.05.18 15:27:04 | 000,042,056 | ---- | C] () -- C:\Windows\SysNative\perfd001.dat
[2012.05.18 15:27:04 | 000,038,160 | ---- | C] () -- C:\Windows\SysNative\perfd00C.dat
[2012.05.16 08:18:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.05.15 10:46:27 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.10 16:34:19 | 000,000,967 | ---- | C] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk
[2012.05.10 15:57:13 | 000,000,757 | ---- | C] () -- C:\Users\Public\Desktop\The Secret World.lnk
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.01.28 19:48:26 | 000,000,094 | ---- | C] () -- C:\Users\TomTom\AppData\Local\fusioncache.dat
[2012.01.28 19:47:55 | 001,619,178 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.11.11 21:28:27 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.11.11 21:28:26 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.11.11 16:49:12 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.11.11 16:49:06 | 000,028,829 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011.11.11 16:47:56 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== LOP Check ==========
 
[2012.06.07 12:43:28 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\.minecraft
[2011.11.29 12:07:09 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Bioshock
[2012.05.10 16:34:27 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoft
[2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\GetRightToGo
[2012.06.07 14:01:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg
[2012.06.07 12:43:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\ICQ
[2011.11.11 21:41:54 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Leadertech
[2011.11.13 13:28:23 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\OpenOffice.org
[2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Origin
[2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\RIFT
[2012.01.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Sytexis Software
[2012.04.29 01:18:53 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Ubisoft
[2012.02.20 13:02:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---


Extras.txt:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 07.06.2012 14:15:55 - Run 1
OTL by OldTimer - Version 3.2.46.2     Folder = C:\Users\TomTom\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
16,00 Gb Total Physical Memory | 14,84 Gb Available Physical Memory | 92,76% Memory free
32,00 Gb Paging File | 30,89 Gb Available in Paging File | 96,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55,80 Gb Total Space | 12,78 Gb Free Space | 22,90% Space Free | Partition Type: NTFS
Drive D: | 2,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 300,00 Gb Total Space | 252,81 Gb Free Space | 84,27% Space Free | Partition Type: NTFS
Drive F: | 631,51 Gb Total Space | 86,56 Gb Free Space | 13,71% Space Free | Partition Type: NTFS
 
Computer Name: TOMTOM-PC | User Name: TomTom | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012.04.05 21:57:34 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)
SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)
SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.26 17:32:39 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.10 16:41:27 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.10 15:53:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.10 15:53:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- E:\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.10 18:16:49 | 000,189,248 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2011.12.10 18:16:41 | 000,075,136 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.02.16 00:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012.02.16 00:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011.11.15 11:14:02 | 000,126,464 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RzSynapse.sys -- (RzSynapse)
DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.06.10 08:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.06.02 11:32:50 | 000,401,896 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011.06.02 11:32:50 | 000,128,488 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.09.29 12:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM)
DRV:64bit: - [2010.09.29 12:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2)
DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.08.24 00:55:32 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 17 AB 3D 6E A4 44 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Appz\Java\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Appz\Adope Reader X\Reader\AIR\nppdf32.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: E:\Appz\Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: E:\Appz\Firefox\plugins
 
[2011.11.11 18:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Extensions
[2012.05.03 18:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions
[2012.06.07 12:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Appz\Java\bin\jp2ssv.dll File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] E:\Appz\Setpoint\SetPointP\SetPoint.exe /launchGaming File not found
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avgnt] E:\Appz\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Logitech G35] E:\Appz\Logitech G35\G35.exe File not found
O4 - HKLM..\Run: [Razer Naga Driver] E:\Appz\Razer Naga\RazerNagaSysTray.exe File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] E:\Appz\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D483E299-B9BB-4BCF-BE63-A0A55FBD9C60}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.05 21:30:20 | 000,000,039 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.07 14:15:37 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
[2012.06.07 13:58:03 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Malwarebytes
[2012.06.07 13:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.07 13:57:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.07 13:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.07 13:56:51 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.07 12:30:10 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg
[2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Ubisoft
[2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft
[2012.06.06 19:24:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Rockstar Games
[2012.06.06 19:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.06.06 18:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Rockstar Games
[2012.06.06 17:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games
[2012.06.03 11:07:55 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\dxhr
[2012.06.03 11:07:21 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\28050
[2012.06.03 10:53:01 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDE2B48A-5632-4D42-8BF5-924CF1E0A57F}
[2012.06.03 10:52:45 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{EF77C2FA-D8A8-4F52-AECC-AB51AB55B532}
[2012.06.03 10:31:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2012.06.02 09:39:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{D4FCE0F8-EE3C-4659-A466-90AD2767B776}
[2012.06.02 09:39:37 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{4D8BE728-AAC9-49FD-856C-738C3AB88B8C}
[2012.06.01 11:51:26 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{366E1564-1267-49A6-B826-DA6C8B61DA38}
[2012.06.01 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDBACFB2-5880-4096-A400-873055DC2C7C}
[2012.05.31 16:41:39 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{9CFDFF90-2890-4445-94CB-B9F7058E0A24}
[2012.05.31 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{661A89E0-C6B3-4623-AA5B-E2C9268527BC}
[2012.05.27 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Star_Vault
[2012.05.24 23:00:52 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\ArmA 2 OA
[2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\ArmA 2
[2012.05.24 19:00:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2012.05.24 18:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2012.05.18 15:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.05.18 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.05.18 15:50:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.05.18 15:45:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA
[2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA
[2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\es-ES
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\es
[2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0C0A
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\es-ES
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\es
[2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0C0A
[2012.05.18 15:42:06 | 000,000,000 | ---D | C] -- C:\Windows\es-ES
[2012.05.18 15:39:13 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\es-ES\pscr.sys.mui
[2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerId.sys.mui
[2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerIb.sys.mui
[2012.05.18 15:39:05 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrParwdm.sys.mui
[2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\he-IL
[2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\he
[2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\he-IL
[2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\he
[2012.05.18 15:38:18 | 000,000,000 | ---D | C] -- C:\Windows\he-IL
[2012.05.18 15:35:43 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\he-IL\pscr.sys.mui
[2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerId.sys.mui
[2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerIb.sys.mui
[2012.05.18 15:35:35 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrParwdm.sys.mui
[2012.05.18 15:35:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sl-SI
[2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sl-SI
[2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\sl-SI
[2012.05.18 15:30:03 | 000,000,000 | ---D | C] -- C:\Windows\it-IT
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\it-IT
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\it
[2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0410
[2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\it-IT
[2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0410
[2012.05.18 15:29:55 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\it
[2012.05.18 15:27:36 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\it-IT\pscr.sys.mui
[2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerId.sys.mui
[2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerIb.sys.mui
[2012.05.18 15:27:28 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrParwdm.sys.mui
[2012.05.18 15:26:47 | 000,000,000 | ---D | C] -- C:\Windows\fr-FR
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\fr-FR
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\fr
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ar-SA
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ar
[2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\040C
[2012.05.18 15:26:42 | 000,000,000 | ---D | C] -- C:\Windows\ar-SA
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\fr-FR
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\fr
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\ar-SA
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ar
[2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\040C
[2012.05.18 15:24:05 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\ar-SA\pscr.sys.mui
[2012.05.18 15:23:56 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerIb.sys.mui
[2012.05.18 15:23:55 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerId.sys.mui
[2012.05.18 15:23:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrParwdm.sys.mui
[2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en
[2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409
[2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sk-SK
[2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US
[2012.05.18 15:23:13 | 000,000,000 | ---D | C] -- C:\Windows\sk-SK
[2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en
[2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409
[2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sk-SK
[2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\en-US
[2012.05.18 15:21:02 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\en-US\pscr.sys.mui
[2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerId.sys.mui
[2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerIb.sys.mui
[2012.05.18 15:20:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrParwdm.sys.mui
[2012.05.17 10:53:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{485CB5D6-D82B-484D-8685-62226625857B}
[2012.05.17 10:53:41 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{C63D01E7-01B2-46D1-90FF-3C75C3FE8FEE}
[2012.05.16 10:02:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{155D2572-F3BA-4937-879B-EF0A706D2CE1}
[2012.05.16 10:02:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{B46C1653-E8A2-413E-A21E-383DC3AE93F3}
[2012.05.15 12:19:05 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{83791854-B717-4965-BA8C-F00286A6A129}
[2012.05.15 12:18:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F3085A7-AF42-4D51-A241-70534BD8AF2F}
[2012.05.15 11:08:28 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Diablo III
[2012.05.15 10:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.15 10:44:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.05.12 07:47:36 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{5AF14BF9-9DF2-4142-B46F-D3B1039A393C}
[2012.05.12 07:47:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{2FCF4905-C1B9-4892-B100-6DDF75C1CD52}
[2012.05.10 16:34:19 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\SysWow64\QtCore4.dll
[2012.05.10 16:34:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.05.10 16:34:18 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll
[2012.05.10 16:34:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2012.05.10 16:12:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{E607B543-B60F-4376-BDB2-66B2DFA75FAB}
[2012.05.10 16:12:31 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F33CB26-54CB-4A64-B414-F74CBD817B83}
[2012.05.10 15:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funcom
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe
[2012.06.07 14:13:49 | 000,000,000 | ---- | M] () -- C:\Users\TomTom\defogger_reenable
[2012.06.07 14:13:37 | 000,050,477 | ---- | M] () -- C:\Users\TomTom\Desktop\Defogger.exe
[2012.06.07 14:11:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.07 14:11:00 | 4294,254,590 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.07 13:58:50 | 005,308,760 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.07 13:58:50 | 000,744,532 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat
[2012.06.07 13:58:50 | 000,739,584 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2012.06.07 13:58:50 | 000,707,316 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.07 13:58:50 | 000,689,572 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2012.06.07 13:58:50 | 000,660,934 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.07 13:58:50 | 000,477,168 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat
[2012.06.07 13:58:50 | 000,389,634 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat
[2012.06.07 13:58:50 | 000,162,318 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat
[2012.06.07 13:58:50 | 000,152,908 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.07 13:58:50 | 000,150,420 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2012.06.07 13:58:50 | 000,133,296 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2012.06.07 13:58:50 | 000,125,124 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.07 13:58:50 | 000,097,384 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat
[2012.06.07 13:58:50 | 000,087,494 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat
[2012.06.07 13:57:59 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.07 13:57:27 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.07 12:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.03 10:33:40 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk
[2012.05.25 08:16:49 | 000,002,072 | ---- | M] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.05.25 08:16:49 | 000,002,001 | ---- | M] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk
[2012.05.24 22:39:55 | 000,000,761 | ---- | M] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk
[2012.05.24 19:00:59 | 000,000,731 | ---- | M] () -- C:\Users\Public\Desktop\ARMA II starten.lnk
[2012.05.18 15:42:01 | 000,341,432 | ---- | M] () -- C:\Windows\SysNative\perfi00A.dat
[2012.05.18 15:42:01 | 000,041,390 | ---- | M] () -- C:\Windows\SysNative\perfd00A.dat
[2012.05.18 15:38:14 | 000,229,316 | ---- | M] () -- C:\Windows\SysNative\perfi00D.dat
[2012.05.18 15:38:14 | 000,032,166 | ---- | M] () -- C:\Windows\SysNative\perfd00D.dat
[2012.05.18 15:29:50 | 000,335,478 | ---- | M] () -- C:\Windows\SysNative\perfi010.dat
[2012.05.18 15:29:50 | 000,037,534 | ---- | M] () -- C:\Windows\SysNative\perfd010.dat
[2012.05.18 15:26:30 | 000,344,522 | ---- | M] () -- C:\Windows\SysNative\perfi00C.dat
[2012.05.18 15:26:30 | 000,289,060 | ---- | M] () -- C:\Windows\SysNative\perfi001.dat
[2012.05.18 15:26:30 | 000,042,056 | ---- | M] () -- C:\Windows\SysNative\perfd001.dat
[2012.05.18 15:26:30 | 000,038,160 | ---- | M] () -- C:\Windows\SysNative\perfd00C.dat
[2012.05.16 08:18:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.05.15 11:02:28 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.12 07:41:26 | 000,294,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.10 16:34:19 | 000,000,967 | ---- | M] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk
[2012.05.10 15:57:13 | 000,000,757 | ---- | M] () -- C:\Users\Public\Desktop\The Secret World.lnk
[2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
 
========== Files Created - No Company Name ==========
 
[2012.06.07 14:13:49 | 000,000,000 | ---- | C] () -- C:\Users\TomTom\defogger_reenable
[2012.06.07 14:13:33 | 000,050,477 | ---- | C] () -- C:\Users\TomTom\Desktop\Defogger.exe
[2012.06.07 13:57:59 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.03 10:33:40 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk
[2012.05.25 08:16:49 | 000,002,072 | ---- | C] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.05.25 08:16:49 | 000,002,001 | ---- | C] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk
[2012.05.24 22:39:55 | 000,000,761 | ---- | C] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk
[2012.05.24 19:00:59 | 000,000,731 | ---- | C] () -- C:\Users\Public\Desktop\ARMA II starten.lnk
[2012.05.18 15:42:32 | 000,744,532 | ---- | C] () -- C:\Windows\SysNative\perfh00A.dat
[2012.05.18 15:42:32 | 000,341,432 | ---- | C] () -- C:\Windows\SysNative\perfi00A.dat
[2012.05.18 15:42:32 | 000,162,318 | ---- | C] () -- C:\Windows\SysNative\perfc00A.dat
[2012.05.18 15:42:32 | 000,041,390 | ---- | C] () -- C:\Windows\SysNative\perfd00A.dat
[2012.05.18 15:38:39 | 000,389,634 | ---- | C] () -- C:\Windows\SysNative\perfh00D.dat
[2012.05.18 15:38:39 | 000,229,316 | ---- | C] () -- C:\Windows\SysNative\perfi00D.dat
[2012.05.18 15:38:39 | 000,087,494 | ---- | C] () -- C:\Windows\SysNative\perfc00D.dat
[2012.05.18 15:38:39 | 000,032,166 | ---- | C] () -- C:\Windows\SysNative\perfd00D.dat
[2012.05.18 15:30:20 | 000,739,584 | ---- | C] () -- C:\Windows\SysNative\perfh010.dat
[2012.05.18 15:30:20 | 000,335,478 | ---- | C] () -- C:\Windows\SysNative\perfi010.dat
[2012.05.18 15:30:20 | 000,150,420 | ---- | C] () -- C:\Windows\SysNative\perfc010.dat
[2012.05.18 15:30:20 | 000,037,534 | ---- | C] () -- C:\Windows\SysNative\perfd010.dat
[2012.05.18 15:27:05 | 000,289,060 | ---- | C] () -- C:\Windows\SysNative\perfi001.dat
[2012.05.18 15:27:04 | 000,689,572 | ---- | C] () -- C:\Windows\SysNative\perfh00C.dat
[2012.05.18 15:27:04 | 000,477,168 | ---- | C] () -- C:\Windows\SysNative\perfh001.dat
[2012.05.18 15:27:04 | 000,344,522 | ---- | C] () -- C:\Windows\SysNative\perfi00C.dat
[2012.05.18 15:27:04 | 000,133,296 | ---- | C] () -- C:\Windows\SysNative\perfc00C.dat
[2012.05.18 15:27:04 | 000,097,384 | ---- | C] () -- C:\Windows\SysNative\perfc001.dat
[2012.05.18 15:27:04 | 000,042,056 | ---- | C] () -- C:\Windows\SysNative\perfd001.dat
[2012.05.18 15:27:04 | 000,038,160 | ---- | C] () -- C:\Windows\SysNative\perfd00C.dat
[2012.05.16 08:18:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.05.15 10:46:27 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.10 16:34:19 | 000,000,967 | ---- | C] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk
[2012.05.10 15:57:13 | 000,000,757 | ---- | C] () -- C:\Users\Public\Desktop\The Secret World.lnk
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.01.28 19:48:26 | 000,000,094 | ---- | C] () -- C:\Users\TomTom\AppData\Local\fusioncache.dat
[2012.01.28 19:47:55 | 001,619,178 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.11.11 21:28:27 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.11.11 21:28:26 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.11.11 16:49:12 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.11.11 16:49:06 | 000,028,829 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011.11.11 16:47:56 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== LOP Check ==========
 
[2012.06.07 12:43:28 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\.minecraft
[2011.11.29 12:07:09 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Bioshock
[2012.05.10 16:34:27 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoft
[2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\GetRightToGo
[2012.06.07 14:01:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg
[2012.06.07 12:43:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\ICQ
[2011.11.11 21:41:54 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Leadertech
[2011.11.13 13:28:23 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\OpenOffice.org
[2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Origin
[2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\RIFT
[2012.01.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Sytexis Software
[2012.04.29 01:18:53 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Ubisoft
[2012.02.20 13:02:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

Geändert von Taproot1976 (07.06.2012 um 13:20 Uhr)

Alt 10.06.2012, 00:56   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Befall vom Windows Verschlüsselungstrojaner - Standard

Befall vom Windows Verschlüsselungstrojaner



Allgemeine Hinweise bzgl. des Verschlüsselungstrojaners:
Wann genau deine Daten entschlüsselt werden können wird dir niemand genau sagen können außer vllt einer es kann sein, dass du eine neuere Variante hast, deren Verschlüsselungsalgorithmus noch unbekannt ist. Sowas kann man (noch) nicht entschlüsseln und ohne Schlüssel schon garnicht - ist ja auch logisch, sonst wär es ja keine vernünftige Verschlüsselung
Einfach hier nochmal reinsehen in regelmäßigen Abständen, obige Hinweise beachten. 8 Tools mitsamt hunderten Diskussionsbeiträgen stehen da schon

Eine Notlösung für Vista und Win7-User => http://www.trojaner-board.de/115496-...erstellen.html

Entschlüsselungsversuche der verschlüsselten Dateien sind nur auf zusätzliche Kopien der verschlüsselten Dateien anzuwenden, sonst zerhackt man sich die noch weiter ohne die "original" verschlüsselte Datei mehr zu haben. Das willst du sicher nicht!


Man darf sich aber keine falschen Hoffnungen machen. Mittlerweile sieht es finster aus => Delphi-PRAXiS - Einzelnen Beitrag anzeigen - Verschlüsselungs-Trojaner, Hilfe benötigt

Und in Zukunft willst du sicher mal an ein besseres Backupkonzept denken. Hier ein Denkanstoß => http://www.trojaner-board.de/115678-...r-backups.html


Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
__________________

__________________

Antwort

Themen zu Befall vom Windows Verschlüsselungstrojaner
administrator, anti-malware, appdata, autostart, befall, dateien, dateisystem, device driver, entschlüsseln, ergebnis, explorer, forum, gelöscht, gen, heuristiks/extra, heuristiks/shuriken, langs, launch, microsoft, plug-in, quarantäne, roaming, scan, searchscopes, software, speicher, system, total, trojan.agent, trojaner, version, version=1.0, windows, windows verschlüsselungstrojaner




Ähnliche Themen: Befall vom Windows Verschlüsselungstrojaner


  1. Belgian Cybercrime Unit: Befall mit Verschlüsselungstrojaner
    Log-Analyse und Auswertung - 05.01.2013 (21)
  2. Windows-Verschlüsselungstrojaner
    Plagegeister aller Art und deren Bekämpfung - 16.12.2012 (4)
  3. Vermutlicher Befall mit Verschlüsselungstrojaner
    Plagegeister aller Art und deren Bekämpfung - 30.07.2012 (1)
  4. Alle Dateien versteckt nach Befall mit S.M.A.R.T Verschlüsselungstrojaner
    Plagegeister aller Art und deren Bekämpfung - 16.07.2012 (50)
  5. Befall Verschlüsselungstrojaner 256bit AES - Wer kann mir beim Fix helfen?
    Log-Analyse und Auswertung - 30.06.2012 (1)
  6. Windows XP Pro, Verschlüsselungstrojaner, Windows fährt nicht vollständig hoch
    Plagegeister aller Art und deren Bekämpfung - 21.06.2012 (1)
  7. Vorgehensweise nach Verschlüsselungstrojaner-Befall
    Plagegeister aller Art und deren Bekämpfung - 19.06.2012 (3)
  8. Verschlüsselungstrojaner Befall
    Plagegeister aller Art und deren Bekämpfung - 19.06.2012 (1)
  9. Befall Verschlüsselungstrojaner 256bit AES
    Plagegeister aller Art und deren Bekämpfung - 18.06.2012 (1)
  10. Erwischt: Windows Verschlüsselungstrojaner unter Windows XP via E-Mail
    Log-Analyse und Auswertung - 17.06.2012 (11)
  11. Windows verschlüsselungstrojaner
    Log-Analyse und Auswertung - 14.06.2012 (3)
  12. Verschlüsselungstrojaner; Windows XP
    Plagegeister aller Art und deren Bekämpfung - 05.06.2012 (9)
  13. Windows Verschlüsselungstrojaner ...
    Plagegeister aller Art und deren Bekämpfung - 27.05.2012 (7)
  14. Verschlüsselungstrojaner: Windowsdateien sind verschlüsselt nach Befall
    Plagegeister aller Art und deren Bekämpfung - 24.05.2012 (2)
  15. Windows Verschlüsselungstrojaner
    Log-Analyse und Auswertung - 07.05.2012 (5)
  16. Windows XP-Verschlüsselungstrojaner
    Log-Analyse und Auswertung - 07.05.2012 (5)
  17. Windows Verschlüsselungstrojaner
    Plagegeister aller Art und deren Bekämpfung - 27.04.2012 (3)

Zum Thema Befall vom Windows Verschlüsselungstrojaner - Hallo, auch mich hat es nun mit dem Windows Verschlüsselungs Trojaner erwischt. Ich hab den Scan mit Malewarebites durchgeführt und hab das Ergebnis des Logs wie beschrieben unten eingefügt. Leider - Befall vom Windows Verschlüsselungstrojaner...
Archiv
Du betrachtest: Befall vom Windows Verschlüsselungstrojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.