| |
| |||||||
Log-Analyse und Auswertung: Brauche Loganalyse für MyStart TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
15.07.2012, 22:17
| #1 |
 |  Brauche Loganalyse für MyStart Trojaner Hi erstmal, das Problem ist ja im Forum schon bekannt, aber da ich gelesen habe, dass man seine Logs hier Posten soll bevor man irgendetwas tut, mache ich das mal  Vielen Dank im Voraus! Hier die geforderten Logs: Code:
ATTFilter # AdwCleaner v1.608 - Logfile created 07/15/2012 at 22:43:02
# Updated 27/05/2012 by Xplode
# Operating system : Windows 7 Professional (64 bits)
# User : Ralph - RALPH-PC
# Running from : C:\Users\Ralph\Downloads\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Users\Ralph\AppData\Local\Temp\BabylonToolbar
Folder Deleted : C:\Users\Ralph\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Ralph\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Ralph\AppData\Roaming\BabylonToolbar
Folder Deleted : C:\Users\Ralph\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\extensions\ffxtlbr@babylon.com
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\Program Files (x86)\BabylonToolbar
File Deleted : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\searchplugins\MyStart Search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
***** [Registry] *****
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=d4a22dfc000000000000002618aea11b --> hxxp://www.google.fr
-\\ Mozilla Firefox v11.0 (de)
Profile name : default
File : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\prefs.js
C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\user.js ... Deleted !
Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=110819&babsrc=NT_ss&mntrId=d4a22df[...]
Deleted : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");
Deleted : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");
Deleted : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=d[...]
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=110819&babsrc=N[...]
Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=110819&babsrc=KW_ss&mntrId=d4a22dfc000000[...]
*************************
AdwCleaner[S1].txt - [8255 octets] - [15/07/2012 22:43:02]
########## EOF - C:\AdwCleaner[S1].txt - [8383 octets] ##########
Code:
ATTFilter OTL logfile created on: 15.07.2012 23:00:32 - Run 1 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Ralph\Downloads 64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,81% Memory free 8,00 Gb Paging File | 6,18 Gb Available in Paging File | 77,22% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 638,53 Gb Total Space | 455,41 Gb Free Space | 71,32% Space Free | Partition Type: NTFS Drive D: | 292,97 Gb Total Space | 91,81 Gb Free Space | 31,34% Space Free | Partition Type: NTFS Computer Name: RALPH-PC | User Name: Ralph | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Ralph\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer USA Ltd) PRC - C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) PRC - C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe () ========== Modules (No Company Name) ========== MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\79ac99fe5274fb82ffcff2c15f71854c\System.Runtime.DurableInstancing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\8a9fac9cb825b5d2db0bdb867fff940e\System.Runtime.Serialization.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\bb97517e4ca64e02282fca24612ce8ad\SMDiagnostics.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\4837a5c6204d53e7aa4f7dd94b98207c\System.Xml.Linq.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ef6e3eb351fe12a5766be7c956c35d95\PresentationFramework.Classic.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe () MOD - C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll () MOD - C:\Windows\SysWOW64\AsIO.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.) SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (rzudd) -- C:\Windows\SysNative\drivers\rzudd.sys (Razer USA Ltd) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.fr IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BD 11 E4 4F 33 55 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.22 19:44:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.07 12:50:46 | 000,000,000 | ---D | M] [2012.05.01 21:32:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ralph\AppData\Roaming\mozilla\Extensions [2012.07.15 22:43:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ralph\AppData\Roaming\mozilla\Firefox\Profiles\ubjbzlrq.default\extensions [2012.07.07 12:50:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.03.13 06:38:06 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.03.13 07:23:34 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.13 07:06:36 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.03.13 07:23:34 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.03.13 07:23:34 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.13 07:23:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.13 07:23:34 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [Razer Synapse] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer USA Ltd) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18C49525-4FA0-46F4-815E-69E96DAED9FD}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.01.25 04:06:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{b55a05e2-282a-11e0-947b-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{b55a05e2-282a-11e0-947b-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Bin\ASSETUP.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.15 22:34:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DownloadManager [2012.07.12 22:37:34 | 000,000,000 | ---D | C] -- C:\0a3bb06ed37b86abc526ce [2012.07.12 02:23:10 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.07.12 02:23:10 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.07.12 02:23:09 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.07.12 02:23:09 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.07.12 02:23:09 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.07.12 02:23:09 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.07.12 02:23:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.07.12 02:23:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.07.12 02:23:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.07.12 02:23:06 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.07.12 02:23:06 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.07.12 02:23:06 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.07.12 02:23:06 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.07.11 20:38:30 | 000,000,000 | ---D | C] -- C:\Users\Ralph\riotsGamesLogs [2012.07.11 20:31:02 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Roaming\LolClient [2012.07.11 20:18:19 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.07.11 20:16:06 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Roaming\Malwarebytes [2012.07.11 20:15:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.11 20:15:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.11 20:15:45 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.11 20:15:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.07.07 12:50:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.07.02 22:36:30 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\PDF24 [2012.07.02 22:36:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24 [2012.07.02 22:36:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDF24 [2012.07.02 22:34:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator [2012.07.02 22:34:04 | 001,071,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX [2012.07.02 22:34:04 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX [2012.07.02 22:34:04 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX [2012.07.02 22:34:03 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL [2012.07.02 22:34:03 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL [2012.07.02 22:34:03 | 000,095,232 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll [2012.07.02 22:34:03 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL [2012.07.02 22:34:03 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL [2012.07.02 22:34:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium [2012.07.02 22:34:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator [2012.07.02 22:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate [2012.07.01 23:26:38 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\SIX_Projects [2012.07.01 22:46:08 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\ArmA 2 [2012.07.01 22:46:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bohemia Interactive [2012.07.01 22:40:56 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.01 22:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.06.30 15:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\ArmA 2 OA [2012.06.30 15:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ralph\Documents\ArmA 2 [2012.06.30 15:08:11 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Roaming\six-updater [2012.06.30 15:08:10 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Roaming\six-zsync [2012.06.30 15:07:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects [2012.06.30 15:07:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SIX Projects [2012.06.30 15:06:44 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\Downloaded Installations [2012.06.30 13:47:29 | 000,000,000 | ---D | C] -- C:\Users\Ralph\Desktop\Rise against [2012.06.30 12:35:18 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2012.06.30 12:35:18 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2012.06.30 12:35:17 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2012.06.30 12:32:56 | 000,000,000 | ---D | C] -- C:\Riot Games [2012.06.30 12:32:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games [2012.06.30 12:31:20 | 000,000,000 | ---D | C] -- C:\Users\Ralph\Desktop\LeagueOfLegends [2012.06.28 10:26:06 | 000,143,360 | ---- | C] (Razer USA Ltd) -- C:\Windows\SysWow64\rztouchdll.dll [2012.06.28 08:36:06 | 000,437,248 | ---- | C] (Razer USA Ltd) -- C:\Windows\SysWow64\rzdevicedll.dll [2012.06.23 12:53:56 | 000,000,000 | ---D | C] -- C:\Users\Ralph\AppData\Local\Macromedia [2012.06.23 12:17:46 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.06.23 12:17:46 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.06.23 12:17:46 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.06.23 12:17:31 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012.06.23 12:17:31 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012.06.23 12:17:31 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012.06.23 12:17:20 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.06.23 12:17:20 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012.06.18 04:09:12 | 000,097,792 | ---- | C] (Razer USA Ltd) -- C:\Windows\SysNative\drivers\rzudd.sys [2012.06.18 03:38:48 | 000,165,888 | ---- | C] (Razer USA Ltd) -- C:\Windows\SysWow64\rzaudiodll.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.15 22:52:13 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.15 22:52:13 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.15 22:48:47 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.15 22:48:47 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.15 22:48:47 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.15 22:48:47 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.15 22:48:47 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.15 22:44:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.15 22:44:22 | 3220,574,208 | -HS- | M] () -- C:\hiberfil.sys [2012.07.15 22:34:47 | 000,002,077 | ---- | M] () -- C:\Users\Ralph\Desktop\JDownloader.lnk [2012.07.15 22:33:04 | 000,000,691 | ---- | M] () -- C:\user.js [2012.07.15 22:33:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.13 19:24:30 | 000,291,512 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.12 01:33:09 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.07.12 01:33:09 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.07.11 20:15:48 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.11 20:13:01 | 001,572,125 | R--- | M] () -- C:\Users\Ralph\Desktop\Misho.jpg [2012.07.07 12:50:47 | 000,001,134 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.07.04 01:24:42 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.04 01:24:42 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.02 22:44:48 | 000,758,476 | ---- | M] () -- C:\Users\Ralph\Desktop\Zeugnis.pdf [2012.07.02 22:42:01 | 004,880,956 | ---- | M] () -- C:\Users\Ralph\Desktop\Beurteilung.pdf [2012.07.02 22:36:05 | 000,001,872 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk [2012.07.02 22:36:05 | 000,001,857 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk [2012.07.02 22:34:05 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2012.06.30 13:28:27 | 000,000,221 | ---- | M] () -- C:\Users\Ralph\Desktop\ARMA 2 Operation Arrowhead.url [2012.06.30 12:35:19 | 000,001,722 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2012.06.30 11:05:17 | 000,000,221 | ---- | M] () -- C:\Users\Ralph\Desktop\ARMA 2.url [2012.06.28 10:26:06 | 000,143,360 | ---- | M] (Razer USA Ltd) -- C:\Windows\SysWow64\rztouchdll.dll [2012.06.28 08:36:06 | 000,437,248 | ---- | M] (Razer USA Ltd) -- C:\Windows\SysWow64\rzdevicedll.dll [2012.06.18 04:09:12 | 000,097,792 | ---- | M] (Razer USA Ltd) -- C:\Windows\SysNative\drivers\rzudd.sys [2012.06.18 03:38:48 | 000,165,888 | ---- | M] (Razer USA Ltd) -- C:\Windows\SysWow64\rzaudiodll.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.15 22:34:47 | 000,002,077 | ---- | C] () -- C:\Users\Ralph\Desktop\JDownloader.lnk [2012.07.15 22:34:31 | 000,002,041 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk [2012.07.15 22:34:31 | 000,001,985 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk [2012.07.15 22:34:31 | 000,001,964 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk [2012.07.11 20:15:48 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.11 20:13:25 | 001,572,125 | R--- | C] () -- C:\Users\Ralph\Desktop\Misho.jpg [2012.07.07 12:50:47 | 000,001,146 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.07.07 12:50:47 | 000,001,134 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.07.02 22:44:43 | 000,758,476 | ---- | C] () -- C:\Users\Ralph\Desktop\Zeugnis.pdf [2012.07.02 22:42:01 | 004,880,956 | ---- | C] () -- C:\Users\Ralph\Desktop\Beurteilung.pdf [2012.07.02 22:36:05 | 000,001,872 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk [2012.07.02 22:36:05 | 000,001,857 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk [2012.07.02 22:34:05 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk [2012.07.02 22:33:55 | 000,000,691 | ---- | C] () -- C:\user.js [2012.06.30 15:07:21 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.06.30 15:07:21 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.06.30 13:28:27 | 000,000,221 | ---- | C] () -- C:\Users\Ralph\Desktop\ARMA 2 Operation Arrowhead.url [2012.06.30 12:35:19 | 000,001,722 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2012.06.30 11:05:17 | 000,000,221 | ---- | C] () -- C:\Users\Ralph\Desktop\ARMA 2.url [2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011.11.10 04:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011.11.10 04:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.10.06 19:09:48 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.10.03 20:08:04 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.10.03 20:08:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.03 14:27:15 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.09.13 01:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.01.25 04:57:54 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll [2011.01.25 04:57:54 | 000,014,392 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.01.25 04:57:51 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.01.25 04:57:51 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys [2011.01.25 04:54:22 | 000,031,573 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.01.25 04:53:39 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.01.25 04:53:35 | 000,026,667 | ---- | C] () -- C:\Windows\Ascd_tmp.ini ========== Files - Unicode (All) ========== [2012.01.27 17:09:29 | 000,000,000 | ---D | M](C:\Users\Ralph\Desktop\?(????)) -- C:\Users\Ralph\Desktop\ლ(ಠ益ಠლ) [2012.01.24 15:42:23 | 000,000,000 | ---D | C](C:\Users\Ralph\Desktop\?(????)) -- C:\Users\Ralph\Desktop\ლ(ಠ益ಠლ) < End of report > Code:
ATTFilter OTL Extras logfile created on: 15.07.2012 23:00:32 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Ralph\Downloads
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,81% Memory free
8,00 Gb Paging File | 6,18 Gb Available in Paging File | 77,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 638,53 Gb Total Space | 455,41 Gb Free Space | 71,32% Space Free | Partition Type: NTFS
Drive D: | 292,97 Gb Total Space | 91,81 Gb Free Space | 31,34% Space Free | Partition Type: NTFS
Computer Name: RALPH-PC | User Name: Ralph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05F7AC8E-7D5D-42F5-A089-EA95297B6A4F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{16FF009B-80A8-46D1-8444-BC5A50B74325}" = lport=445 | protocol=6 | dir=in | app=system |
"{233A2ED6-117F-4570-BFCF-AF5A680A91E2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{451F3740-CBC2-4F2B-817E-A4AB8160B910}" = lport=137 | protocol=17 | dir=in | app=system |
"{56B00BBB-7074-44AC-921F-B1BE7A59CC4E}" = lport=139 | protocol=6 | dir=in | app=system |
"{5C8964CA-993F-4A66-9D36-47C1BEC7D412}" = lport=2869 | protocol=6 | dir=in | app=system |
"{66DBA057-AB63-430B-8CE3-0EC217C361D7}" = rport=138 | protocol=17 | dir=out | app=system |
"{6C6674B4-2195-4C8B-9E80-6D74AE53E58F}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6D79A132-22A0-4F9E-962B-4D1172FB5E00}" = rport=445 | protocol=6 | dir=out | app=system |
"{797FFBB8-B3B7-42BC-A6CC-77BEAA000BAC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7F8647C0-DF0B-453C-BE80-743CB3C15723}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{91A76CA1-C530-41CF-BCF1-8D8026E6ADCC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{91E44AD8-24BD-4A5F-8AF5-5A8FC73ADAA3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{95604C2E-0EF8-429D-8BD4-790DBAA4F593}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9D574EE3-4E8C-4857-97B8-A9DDEC084D25}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A7A3123F-21A3-456D-BEC4-95184490A34F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{AD59B7A9-E1FC-4ADE-8CA6-B117B3C9CCDE}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{AF11B470-8A1A-4B7B-8489-1F442C21CE40}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BA08F5F4-75BD-4CF1-BD5A-331773D50FA2}" = lport=138 | protocol=17 | dir=in | app=system |
"{C0C0DEAE-E54D-4A64-B6E1-87F1D22F1B21}" = rport=137 | protocol=17 | dir=out | app=system |
"{DDE70675-7BBD-488D-AE19-525DEB028D8F}" = rport=139 | protocol=6 | dir=out | app=system |
"{E8B521CF-FA6B-4851-B410-FCE15DA21917}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{EA81CB2B-3F35-45C6-884D-0B5192BAB259}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{005B4FB3-EACA-4805-89D1-09B9304E7A8D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{007F56DC-ADAB-4F1C-91B0-663BED38796D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{00A114EC-80B7-4FDE-902F-5F062195F820}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\kingdoms of amalur reckoning\reckoning.exe |
"{024CF8BA-AFD1-4070-BD53-8923CF4C0981}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{02782E87-F2A4-469D-B5A9-E3C5B3D9D740}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0682CD0C-C5A9-456D-A2F8-E271412F8608}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0A312BEB-2F9C-4CDE-9F2F-E401A38D92C5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{0D1CC07F-8586-4EC9-A16A-D34B0F04A494}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{0E62CDAF-5E2A-4009-9D77-81B8252DB637}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"{17D62927-9D58-48D0-96F6-DD5BB04A701A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1A3C2FA7-F815-4CD4-9451-19E5E9F77C1E}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{1F6F1CF2-8093-4269-AE9A-00ED61708788}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{1F80B221-4442-43DA-8F50-1F4DD4726BEE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{207851F6-1CF5-4E55-9EF9-6ACA9F0754AD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{251B91B2-A5D6-460F-9ADA-F117394D1B4E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{291EF6FC-A453-4EA2-AEA0-88C26EB40707}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{295D76D8-BD81-478E-A9CA-96C07792B348}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3033B1F6-9EA7-440D-814F-0C38BD1EBB44}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{316123AF-1ECD-4C56-8E84-946C97C0F908}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3B06FD93-9498-4374-BCF0-66AF9106AF39}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{3F88A180-7AAD-4EDD-853F-5B6203248417}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{42DD4589-6637-4C4A-807C-02C6A625C40C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{4AFBE697-1A51-4B02-B982-D745F231E91C}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{50311199-F0A2-410F-AA28-AB0D767A4927}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{543CDD6B-4846-43F9-92CC-83724094AD54}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{589E217B-0374-44A6-A051-A62F8B7AC8BF}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{5EFE33BD-B248-4913-A459-AC166180C156}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{6078E76D-6E57-428C-8977-1082626777DB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{63CD6280-C820-4C31-A6CF-A28BEE66BE45}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{63D8F5D8-A359-449D-89D6-71AFBAA1EAA6}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{64228752-FCFB-486B-813B-F035A4330095}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{66CFB53F-89E4-4B20-819E-C0DF9361095C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{699A5C5D-7DCA-4571-A068-62124AF931B8}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{6DFB8C5D-5617-4ACE-887D-270B6B2097D2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2\arma2.exe |
"{752CDCE8-6B72-4A66-9CCB-BA5536E12D77}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{7A216C27-D116-4256-879C-461A76A6A9F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7A6FED94-ABF9-4839-91E0-81AFBE5E13B6}" = protocol=6 | dir=out | app=system |
"{868F1035-0386-466B-9EA1-9EE0FFBE2C31}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{870776BA-B744-4DCD-AF14-BFD67E9D7922}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{8D393E44-DBE6-457B-9624-EDD9C5E0C3AC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8F63CADC-BB4B-4AB5-9788-F1899EBAE450}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9D03218A-44C4-4DC7-8B29-6D48CA074B0A}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{A0258ABC-BE45-4523-BAA8-5ADF6CAC0969}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\fable iii\fable3.exe |
"{A37D7F5A-B019-442B-8912-16D56B747EC8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A6115A58-F594-4610-BE5E-2C37B5933256}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A848EE1F-1766-4615-8F6F-8981D98F6B7A}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{A94B1CD9-D95F-43E8-9C54-582F0793FC10}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe |
"{AB5CD8C4-1963-4D57-AE6B-7B3FF06A12D6}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{BB811E51-555B-41BB-99DE-4DE600F9E308}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{C85C1346-BF44-48E7-9C32-1BA3E8C39E4A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\rage\rage.exe |
"{CA989F58-C58A-47DB-91C9-87A10DF29573}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\fable iii\fable3.exe |
"{D0C9744A-25AC-4A8B-9ACA-7A623ED7BB35}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{D8FE9508-4543-43B8-9BAB-F05453BC6E00}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\rage\rage.exe |
"{DA63645C-2CF7-49DF-AFA9-1B5852DDBB8F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DA8D673B-BE15-4C78-ABFF-239F33A0359B}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{DA962A96-E8E8-42ED-9969-2ADE0D623ED6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{DCC753CE-C663-4FFE-846D-D5CFECABF86D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{DD9D7789-FC28-4C6E-9EAC-BC08D90CE08E}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{DE138A46-491C-4ACD-9500-B1706E8B6E93}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2\arma2.exe |
"{E08B7B7F-2EE5-47C4-9143-6949F655DDE2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E5381651-8A24-410F-AF8C-9B97A3E46B16}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"{ECB953A1-F826-4643-BC1B-F56A7224FB37}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{F19BE7F7-67CF-4793-A26C-308EA703446B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F1C3D7BF-4565-431A-A14A-137E85C007DB}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\kingdoms of amalur reckoning\reckoning.exe |
"{F401F9FA-BB2A-469C-A569-37399F6A0A58}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{F4746840-08B4-469E-938A-099A34EE5E35}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{FD8758F9-DD05-476E-B35C-777C60FD688A}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\might & magic heroes vi\might & magic heroes vi.exe |
"TCP Query User{9C4B7F3A-5734-43CE-A318-EC289D5D1C0D}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
"TCP Query User{AE122E6E-8C87-4CC3-8A92-CA3B6688FC08}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"UDP Query User{A84D5EB0-B084-4621-87DC-8ED6F759B3BD}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"UDP Query User{EA95775E-071C-4785-9756-0054BCA17F07}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9E3B2120-0BD8-9865-0387-E9BAC2A53AD3}" = ccc-utility64
"{ABE286AE-C65D-B7DE-C8D1-DF79584169B4}" = AMD Fuel
"{BE882A12-5A45-3DFF-9FD0-306DE65EB8A5}" = AMD Catalyst Install Manager
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EF393943-0CCE-9CD9-6181-96DF4E4428EF}" = AMD Media Foundation Decoders
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F809FFB5-6F9B-AFDE-6048-5D9E95A85505}" = AMD Drag and Drop Transcoding
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}" = Razer Synapse 2.0
"{0D97F8D1-2102-53D2-5633-C992D6086801}" = CCC Help Chinese Traditional
"{0EA00EA7-42C0-ED9C-9110-2C04B8EDBA66}" = CCC Help Italian
"{0EB86B70-91FF-39BF-633C-785DF2218CC6}" = CCC Help French
"{1686C07D-C2BB-A8B2-C5ED-32C4EE1A3E62}" = CCC Help Spanish
"{18B6A9F8-25BC-5978-6B42-A50FA2CABC18}" = CCC Help English
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{298C6691-46B2-2065-0DD7-1E7B3B669A47}" = CCC Help Finnish
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{400C5445-1AE8-1A41-CAC6-AB114341F65D}" = CCC Help Swedish
"{448B1C6D-02C2-7681-66B2-624E58B25375}" = CCC Help Turkish
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{46EB9D45-FC1A-2635-1693-176E6FA1C672}" = CCC Help Portuguese
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"{651F43AA-3F06-9277-6F1B-8E8155017463}" = CCC Help Polish
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68DE32E1-292B-6A02-6A53-935BFAE70C99}" = CCC Help Chinese Standard
"{6A9D1594-7791-48f5-9CAA-DE9BCB968320}" = Mass Effect™ 3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{745D37C2-26F4-4B65-BA13-F9840EBFA75B}" = Might & Magic Heroes VI
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{818212BA-7F8C-DDF9-64BE-F6D0B6F46D29}" = CCC Help German
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.6.0
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84F4542C-ED64-28AC-49B3-1A9BAB395AB4}" = CCC Help Hungarian
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}" = EPU-4 Engine
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C41195F-11B3-8EEC-6634-7183BE6CB1B1}" = CCC Help Japanese
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A33A89D0-2F48-FD1C-A243-9073EE0592E0}" = Catalyst Control Center InstallProxy
"{A66FB6C7-B689-AFD5-21BA-7CAF8E44E6E6}" = Catalyst Control Center Graphics Previews Common
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AE136F7F-7DC6-600F-9DF9-BFA0DF516135}" = Catalyst Control Center Localization All
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B4CF00AE-2622-7BC6-24EC-4E5A0A8C9135}" = CCC Help Czech
"{BAE1C0A8-634D-CFF1-0E0C-893092427D34}" = CCC Help Danish
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C27B9A80-6A57-ECCF-F952-DC8F27AA67B7}" = Catalyst Control Center InstallProxy
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2DEC505-79A9-E952-32B0-31B67B83E231}" = CCC Help Korean
"{C2FB14FB-DF6B-287D-BDC3-C7BEC86F539E}" = AMD VISION Engine Control Center
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CCEFAE22-4D01-0084-D1CA-AC14AA743A97}" = CCC Help Greek
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DE460826-5E72-2357-154F-E376F9926008}" = CCC Help Norwegian
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E21FFD29-D231-3BD3-6941-15710E44BED4}" = CCC Help Dutch
"{E3E313C7-0AE2-7F44-52E8-528D4EDC74B2}" = CCC Help Thai
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9929777-7B6E-F53D-3105-1C06E5120CA1}" = CCC Help Russian
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"DivX Setup" = DivX-Setup
"ESN Sonar-0.70.0" = ESN Sonar
"ESN Sonar-0.70.4" = ESN Sonar
"GFWL_{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"OpenAL" = OpenAL
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 9200" = RAGE
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Warcraft III" = Warcraft III
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 03.07.2012 19:28:10 | Computer Name = Ralph-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: arma2oa.exe, Version: 1.60.94.364,
Zeitstempel: 0x4fedb8ba Name des fehlerhaften Moduls: arma2oa.exe, Version: 1.60.94.364,
Zeitstempel: 0x4fedb8ba Ausnahmecode: 0xc0000005 Fehleroffset: 0x002a1b13 ID des fehlerhaften
Prozesses: 0x1390 Startzeit der fehlerhaften Anwendung: 0x01cd59731f0a999e Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Steam\SteamApps\common\arma 2 operation
arrowhead\Expansion\beta\arma2oa.exe Pfad des fehlerhaften Moduls: C:\Program Files
(x86)\Steam\SteamApps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Berichtskennung:
c033baad-c566-11e1-88ab-002618aea11b
Error - 03.07.2012 19:30:52 | Computer Name = Ralph-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: arma2oa.exe, Version: 1.60.94.364,
Zeitstempel: 0x4fedb8ba Name des fehlerhaften Moduls: arma2oa.exe, Version: 1.60.94.364,
Zeitstempel: 0x4fedb8ba Ausnahmecode: 0xc0000005 Fehleroffset: 0x002a1b13 ID des fehlerhaften
Prozesses: 0x13c4 Startzeit der fehlerhaften Anwendung: 0x01cd59738462760c Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Steam\SteamApps\common\arma 2 operation
arrowhead\Expansion\beta\arma2oa.exe Pfad des fehlerhaften Moduls: C:\Program Files
(x86)\Steam\SteamApps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Berichtskennung:
20704d92-c567-11e1-88ab-002618aea11b
Error - 06.07.2012 09:27:15 | Computer Name = Ralph-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".
Die
abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.07.2012 18:30:09 | Computer Name = Ralph-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".
Die
abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.07.2012 19:23:21 | Computer Name = Ralph-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_262.exe,
Version: 11.3.300.262, Zeitstempel: 0x4fe20fae Name des fehlerhaften Moduls: NPSWF32_11_3_300_262.dll,
Version: 11.3.300.262, Zeitstempel: 0x4fe21212 Ausnahmecode: 0xc0000005 Fehleroffset:
0x0066d2ff ID des fehlerhaften Prozesses: 0xf74 Startzeit der fehlerhaften Anwendung:
0x01cd5bcde75ace0b Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
Pfad
des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll
Berichtskennung:
9321a807-c7c1-11e1-840f-002618aea11b
Error - 11.07.2012 14:11:34 | Computer Name = Ralph-PC | Source = Application Hang | ID = 1002
Description = Programm Skype.exe, Version 5.8.0.158 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 9f4 Startzeit:
01cd5f906e186df7 Endzeit: 16 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe
Berichts-ID:
Error - 11.07.2012 16:53:48 | Computer Name = Ralph-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".
Die
abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 14.07.2012 04:35:18 | Computer Name = Ralph-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".
Die
abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 14.07.2012 11:02:28 | Computer Name = Ralph-PC | Source = Application Hang | ID = 1002
Description = Programm Skype.exe, Version 5.8.0.158 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 950 Startzeit:
01cd61cf2779f359 Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe
Berichts-ID:
Error - 15.07.2012 15:30:26 | Computer Name = Ralph-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".
Die
abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
[ System Events ]
Error - 21.04.2012 17:03:00 | Computer Name = Ralph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 24.04.2012 12:09:17 | Computer Name = Ralph-PC | Source = DCOM | ID = 10010
Description =
Error - 25.04.2012 19:39:17 | Computer Name = Ralph-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error - 25.04.2012 19:40:24 | Computer Name = Ralph-PC | Source = DCOM | ID = 10010
Description =
Error - 26.04.2012 02:59:25 | Computer Name = Ralph-PC | Source = DCOM | ID = 10010
Description =
Error - 29.04.2012 05:07:50 | Computer Name = Ralph-PC | Source = DCOM | ID = 10010
Description =
Error - 30.04.2012 09:12:02 | Computer Name = Ralph-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error - 02.05.2012 09:03:29 | Computer Name = Ralph-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error - 04.05.2012 09:11:03 | Computer Name = Ralph-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error - 04.05.2012 13:40:44 | Computer Name = Ralph-PC | Source = volsnap | ID = 393245
Description = Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
< End of report >
Code:
ATTFilter Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 12.07.2012 6,00MB 11.3.300.265 Adobe Flash Player 11 Plugin Adobe Systems Incorporated 12.07.2012 6,00MB 11.3.300.265 Adobe Reader X (10.1.2) - Deutsch Adobe Systems Incorporated 19.01.2012 121MB 10.1.2 AMD Catalyst Install Manager Advanced Micro Devices, Inc. 04.03.2012 26,2MB 3.0.859.0 ARMA 2 Bohemia Interactive 30.06.2012 ARMA 2: Operation Arrowhead Bohemia Interactive 30.06.2012 Avira AntiVir Personal - Free Antivirus Avira GmbH 16.02.2012 70,6MB 10.2.0.707 BabylonObjectInstaller 25.01.2011 Battlefield 3™ Electronic Arts 27.11.2011 1.0.0.0 Bing Bar Microsoft Corporation 22.01.2012 24,2MB 7.0.619.0 CCleaner Piriform 22.06.2012 3.20 DivX-Setup DivX, LLC 22.01.2012 2.6.1.5 EPU-4 Engine 25.01.2011 1.00.25 ESN Sonar ESN Social Software AB 22.04.2012 0.70.0 Fable III Microsoft Game Studios 14.10.2011 1.0.0000.131 Futuremark SystemInfo Futuremark Corporation 16.09.2011 3.21.2.1 JDownloader 0.9 AppWork GmbH 15.07.2012 0.9 League of Legends Riot Games 30.06.2012 1.02.0000 Malwarebytes Anti-Malware Version 1.61.0.1400 Malwarebytes Corporation 11.07.2012 18,0MB 1.61.0.1400 Mass Effect™ 3 Electronic Arts 10.03.2012 1.0.0.0 Microsoft .NET Framework 4 Client Profile Microsoft Corporation 28.02.2011 38,8MB 4.0.30319 Microsoft .NET Framework 4 Extended Microsoft Corporation 06.10.2011 51,9MB 4.0.30319 Microsoft Games for Windows - LIVE Redistributable Microsoft Corporation 06.11.2011 31,3MB 3.5.88.0 Microsoft Games for Windows Marketplace Microsoft Corporation 06.11.2011 6,03MB 3.5.50.0 Microsoft Silverlight Microsoft Corporation 12.05.2012 60,4MB 4.1.10329.0 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 22.01.2012 1,69MB 3.1.0000 Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 11.03.2012 298KB 8.0.61001 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 07.10.2011 240KB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 06.10.2011 596KB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 07.11.2011 600KB 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 13.12.2011 15,0MB 10.0.30319 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 06.11.2011 15,0MB 10.0.40219 Might & Magic Heroes VI Ubisoft 29.10.2011 1.1.1 Mozilla Firefox 11.0 (x86 de) Mozilla 07.07.2012 35,8MB 11.0 NVIDIA PhysX NVIDIA Corporation 10.03.2012 86,1MB 9.11.1107 OpenAL 16.09.2011 Origin Electronic Arts, Inc. 10.03.2012 8.5.0.4554 PDF24 Creator 4.6.0 PDF24.org 02.07.2012 33,8MB PDFCreator Frank Heindörfer, Philip Chinery 02.07.2012 1.4.1 PunkBuster Services Even Balance, Inc. 26.10.2011 0.991 RAGE 18.02.2012 Razer Synapse 2.0 Razer USA Ltd. 10.07.2012 15,4MB 1.3.7 Realtek 8136 8168 8169 Ethernet Driver Realtek 25.01.2011 1.00.0005 Six Updater Six Projects 04.07.2012 38,6MB 2.09.7004 Skype™ 5.8 Skype Technologies S.A. 09.04.2012 19,0MB 5.8.158 Steam Valve Corporation 07.11.2011 35,4MB 1.0.0.0 The Elder Scrolls V: Skyrim Bethesda Game Studios 12.11.2011 TuneUp Utilities 2012 TuneUp Software 04.12.2011 12.0.2110.7 Ubisoft Game Launcher UBISOFT 29.10.2011 1.0.0.0 VIA Plattform-Geräte-Manager VIA Technologies, Inc. 25.01.2011 2,61MB 1.34 Warcraft III Blizzard Entertainment 23.12.2011 Windows Live Essentials Microsoft Corporation 22.01.2012 15.4.3538.0513 Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 22.01.2012 5,57MB 15.4.5722.2 World of Warcraft Blizzard Entertainment 19.04.2012 4.3.4.15595 |
|
16.07.2012, 21:52
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Brauche Loganalyse für MyStart Trojaner Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
12.08.2012, 15:53
| #3 |
| | Brauche Loganalyse für MyStart Trojaner Hier noch die restlichen angefragten txts, sry dass es so lang gedauert hat, war im urlaub
__________________Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.17.07 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Ralph :: RALPH-PC [Administrator] Schutz: Aktiviert 17.07.2012 11:25:31 mbam-log-2012-07-17 (11-25-31).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 495723 Laufzeit: 1 Stunde(n), 19 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Ralph\AppData\Local\Temp\is357113909\IWantThis_IC_V3_ROW.exe (Adware.GamePlayLabs) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Ralph\Downloads\DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 12.07.2012 6,00MB 11.3.300.265 Adobe Flash Player 11 Plugin Adobe Systems Incorporated 12.07.2012 6,00MB 11.3.300.265 Adobe Reader X (10.1.2) - Deutsch Adobe Systems Incorporated 19.01.2012 121MB 10.1.2 AMD Catalyst Install Manager Advanced Micro Devices, Inc. 04.03.2012 26,2MB 3.0.859.0 ARMA 2 Bohemia Interactive 30.06.2012 ARMA 2: Operation Arrowhead Bohemia Interactive 30.06.2012 Avira AntiVir Personal - Free Antivirus Avira GmbH 16.02.2012 70,6MB 10.2.0.707 BabylonObjectInstaller 25.01.2011 Battlefield 3™ Electronic Arts 27.11.2011 1.0.0.0 Bing Bar Microsoft Corporation 22.01.2012 24,2MB 7.0.619.0 CCleaner Piriform 22.06.2012 3.20 DivX-Setup DivX, LLC 22.01.2012 2.6.1.5 EPU-4 Engine 25.01.2011 1.00.25 ESN Sonar ESN Social Software AB 22.04.2012 0.70.0 Fable III Microsoft Game Studios 14.10.2011 1.0.0000.131 Futuremark SystemInfo Futuremark Corporation 16.09.2011 3.21.2.1 JDownloader 0.9 AppWork GmbH 15.07.2012 0.9 League of Legends Riot Games 30.06.2012 1.02.0000 Malwarebytes Anti-Malware Version 1.61.0.1400 Malwarebytes Corporation 11.07.2012 18,0MB 1.61.0.1400 Mass Effect™ 3 Electronic Arts 10.03.2012 1.0.0.0 Microsoft .NET Framework 4 Client Profile Microsoft Corporation 28.02.2011 38,8MB 4.0.30319 Microsoft .NET Framework 4 Extended Microsoft Corporation 06.10.2011 51,9MB 4.0.30319 Microsoft Games for Windows - LIVE Redistributable Microsoft Corporation 06.11.2011 31,3MB 3.5.88.0 Microsoft Games for Windows Marketplace Microsoft Corporation 06.11.2011 6,03MB 3.5.50.0 Microsoft Silverlight Microsoft Corporation 12.05.2012 60,4MB 4.1.10329.0 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 22.01.2012 1,69MB 3.1.0000 Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 11.03.2012 298KB 8.0.61001 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 07.10.2011 240KB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 06.10.2011 596KB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 07.11.2011 600KB 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 13.12.2011 15,0MB 10.0.30319 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 06.11.2011 15,0MB 10.0.40219 Might & Magic Heroes VI Ubisoft 29.10.2011 1.1.1 Mozilla Firefox 11.0 (x86 de) Mozilla 07.07.2012 35,8MB 11.0 NVIDIA PhysX NVIDIA Corporation 10.03.2012 86,1MB 9.11.1107 OpenAL 16.09.2011 Origin Electronic Arts, Inc. 10.03.2012 8.5.0.4554 PDF24 Creator 4.6.0 PDF24.org 02.07.2012 33,8MB PDFCreator Frank Heindörfer, Philip Chinery 02.07.2012 1.4.1 PunkBuster Services Even Balance, Inc. 26.10.2011 0.991 RAGE 18.02.2012 Razer Synapse 2.0 Razer USA Ltd. 10.07.2012 15,4MB 1.3.7 Realtek 8136 8168 8169 Ethernet Driver Realtek 25.01.2011 1.00.0005 Six Updater Six Projects 04.07.2012 38,6MB 2.09.7004 Skype™ 5.8 Skype Technologies S.A. 09.04.2012 19,0MB 5.8.158 Steam Valve Corporation 07.11.2011 35,4MB 1.0.0.0 The Elder Scrolls V: Skyrim Bethesda Game Studios 12.11.2011 TuneUp Utilities 2012 TuneUp Software 04.12.2011 12.0.2110.7 Ubisoft Game Launcher UBISOFT 29.10.2011 1.0.0.0 VIA Plattform-Geräte-Manager VIA Technologies, Inc. 25.01.2011 2,61MB 1.34 Warcraft III Blizzard Entertainment 23.12.2011 Windows Live Essentials Microsoft Corporation 22.01.2012 15.4.3538.0513 Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 22.01.2012 5,57MB 15.4.5722.2 World of Warcraft Blizzard Entertainment 19.04.2012 4.3.4.15595 Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=3e0fa9ade7dee044939cfd637802be46
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-19 05:23:52
# local_time=2012-07-19 07:23:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode=1797 16775145 100 94 317417 79239299 0 0
# compatibility_mode=5893 16776573 100 94 93617 95108149 0 0
# compatibility_mode=8192 67108863 100 0 115 115 0 0
# scanned=295632
# found=17
# cleaned=0
# scan_time=16154
D:\Dokumente und Einstellungen\Guybrush Threepwood\Eigene Dateien\Downloads\YouTubeDownloaderSetup33.exe Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\Gemeinsame Dateien\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9 Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\pdfforge Toolbar\IE\6.0\pdfforgeToolbarIE.dll Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\Programme\YouTube Downloader Toolbar\IE\6.0\youtubedownloaderToolbarIE.dll Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\WINDOWS\Installer\13407.msi möglicherweise Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
D:\WINDOWS\Installer\16e88.msi möglicherweise Variante von Win32/Toolbar.Widgi Anwendung (Säubern nicht möglich) 00000000000000000000000000000000 I
|
|
13.08.2012, 14:17
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop (neu runterladen, die alte adwCleaner.exe überschreiben)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2012, 13:09
| #5 |
| | Brauche Loganalyse für MyStart TrojanerCode:
ATTFilter AdwCleaner v1.608 - Logfile created 07/15/2012 at 22:43:02
# Updated 27/05/2012 by Xplode
# Operating system : Windows 7 Professional (64 bits)
# User : Ralph - RALPH-PC
# Running from : C:\Users\Ralph\Downloads\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Users\Ralph\AppData\Local\Temp\BabylonToolbar
Folder Deleted : C:\Users\Ralph\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Ralph\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Ralph\AppData\Roaming\BabylonToolbar
Folder Deleted : C:\Users\Ralph\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\extensions\ffxtlbr@babylon.com
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\Program Files (x86)\BabylonToolbar
File Deleted : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\searchplugins\MyStart Search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
***** [Registry] *****
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=d4a22dfc000000000000002618aea11b --> hxxp://www.google.fr
-\\ Mozilla Firefox v11.0 (de)
Profile name : default
File : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\prefs.js
C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\user.js ... Deleted !
Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=110819&babsrc=NT_ss&mntrId=d4a22df[...]
Deleted : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");
Deleted : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");
Deleted : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=d[...]
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=110819&babsrc=N[...]
Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=110819&babsrc=KW_ss&mntrId=d4a22dfc000000[...]
*************************
AdwCleaner[S1].txt - [8255 octets] - [15/07/2012 22:43:02]
########## EOF - C:\AdwCleaner[S1].txt - [8383 octets] ##########
|
|
04.09.2012, 16:23
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner Bitte mal den aktuellen adwCleaner runterladen, also die alte adwcleaner löschen und neu runterladen adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ --> Brauche Loganalyse für MyStart Trojaner |
|
05.09.2012, 16:42
| #7 |
| | Brauche Loganalyse für MyStart TrojanerCode:
ATTFilter # AdwCleaner v2.000 - Datei am 09/05/2012 um 17:42:00 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Professional (64 bits)
# Benutzer : Ralph - RALPH-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Ralph\Downloads\adwcleaner(2).exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\user.js
Ordner Gefunden : C:\ProgramData\InstallMate
Ordner Gefunden : C:\ProgramData\Premium
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gefunden : HKLM\Software\Web Assistant
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Web Assistant
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\prefs.js
Gefunden : user_pref("extensions.incredibar.actvtyRptTime", "1341261284084");
Gefunden : user_pref("extensions.incredibar.admin", false);
Gefunden : user_pref("extensions.incredibar.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar.afterInstallRpt", "sent");
Gefunden : user_pref("extensions.incredibar.cntry", "DE");
Gefunden : user_pref("extensions.incredibar.dfltLng", "EN");
Gefunden : user_pref("extensions.incredibar.dfltSrch", false);
Gefunden : user_pref("extensions.incredibar.dfltlng", "en");
Gefunden : user_pref("extensions.incredibar.dfltsrch", "false");
Gefunden : user_pref("extensions.incredibar.did", "10669");
Gefunden : user_pref("extensions.incredibar.envrmnt", "production");
Gefunden : user_pref("extensions.incredibar.excTlbr", false);
Gefunden : user_pref("extensions.incredibar.hdrMd5", "0BE9D29A08051BDEE6C785E75DD9B082");
Gefunden : user_pref("extensions.incredibar.hmpg", false);
Gefunden : user_pref("extensions.incredibar.hrdid", "0");
Gefunden : user_pref("extensions.incredibar.id", "d4a22dfc000000000000002618aea11b");
Gefunden : user_pref("extensions.incredibar.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar.instlDay", "15523");
Gefunden : user_pref("extensions.incredibar.instlRef", "");
Gefunden : user_pref("extensions.incredibar.instlday", "15523");
Gefunden : user_pref("extensions.incredibar.instlref", "");
Gefunden : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gefunden : user_pref("extensions.incredibar.isdcmntcmplt", "false");
Gefunden : user_pref("extensions.incredibar.keywordurl", "");
Gefunden : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1422:33:55");
Gefunden : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gefunden : user_pref("extensions.incredibar.newTab", false);
Gefunden : user_pref("extensions.incredibar.newtab", "false");
Gefunden : user_pref("extensions.incredibar.newtaburl", "");
Gefunden : user_pref("extensions.incredibar.noFFXTlbr", false);
Gefunden : user_pref("extensions.incredibar.ppd", "123%5F1");
Gefunden : user_pref("extensions.incredibar.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar.productid", "26");
Gefunden : user_pref("extensions.incredibar.propectorlck", 79821305);
Gefunden : user_pref("extensions.incredibar.prtkHmpg", 1);
Gefunden : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar.prtnrid", "Incredibar");
Gefunden : user_pref("extensions.incredibar.sg", "none");
Gefunden : user_pref("extensions.incredibar.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar.smplgrp", "none");
Gefunden : user_pref("extensions.incredibar.srch", "");
Gefunden : user_pref("extensions.incredibar.srchprvdr", "");
Gefunden : user_pref("extensions.incredibar.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB_T[...]
Gefunden : user_pref("extensions.incredibar.tlbrid", "base");
Gefunden : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB_T[...]
Gefunden : user_pref("extensions.incredibar.upn2", "6OyGKDdFPT");
Gefunden : user_pref("extensions.incredibar.upn2n", "92261687784978173");
Gefunden : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1422:33:55");
Gefunden : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar.vrsnts", "1.5.11.1422:33:55");
Gefunden : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gefunden : user_pref("extensions.incredibar_i.dfltLng", "");
Gefunden : user_pref("extensions.incredibar_i.did", "10669");
Gefunden : user_pref("extensions.incredibar_i.excTlbr", false);
Gefunden : user_pref("extensions.incredibar_i.id", "d4a22dfc000000000000002618aea11b");
Gefunden : user_pref("extensions.incredibar_i.installerproductid", "26");
Gefunden : user_pref("extensions.incredibar_i.instlDay", "15523");
Gefunden : user_pref("extensions.incredibar_i.instlRef", "");
Gefunden : user_pref("extensions.incredibar_i.ms_url_id", "");
Gefunden : user_pref("extensions.incredibar_i.newTab", false);
Gefunden : user_pref("extensions.incredibar_i.ppd", "123%5F1");
Gefunden : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gefunden : user_pref("extensions.incredibar_i.productid", "26");
Gefunden : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gefunden : user_pref("extensions.incredibar_i.smplGrp", "none");
Gefunden : user_pref("extensions.incredibar_i.tlbrId", "base");
Gefunden : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB[...]
Gefunden : user_pref("extensions.incredibar_i.upn2", "6OyGKDdFPT");
Gefunden : user_pref("extensions.incredibar_i.upn2n", "92261687784978173");
Gefunden : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gefunden : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1422:33:55");
Gefunden : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
*************************
AdwCleaner[S1].txt - [8356 octets] - [15/07/2012 22:43:02]
AdwCleaner[R1].txt - [6820 octets] - [04/09/2012 14:07:34]
AdwCleaner[R2].txt - [6914 octets] - [05/09/2012 17:42:00]
########## EOF - C:\AdwCleaner[R2].txt - [6974 octets] ##########
|
|
06.09.2012, 10:43
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.09.2012, 17:49
| #9 |
| | Brauche Loganalyse für MyStart TrojanerCode:
ATTFilter # AdwCleaner v1.801 - Logfile created 09/06/2012 at 18:43:52
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional (64 bits)
# User : Ralph - RALPH-PC
# Boot Mode : Normal
# Running from : C:\Users\Ralph\Downloads\adwcleaner(1).exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Premium
File Deleted : C:\user.js
***** [Registry] *****
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
[x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Deleted : HKLM\SOFTWARE\Web Assistant
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\prefs.js
Deleted : user_pref("extensions.incredibar.actvtyRptTime", "1341261284084");
Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.afterInstallRpt", "sent");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "EN");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.dfltlng", "en");
Deleted : user_pref("extensions.incredibar.dfltsrch", "false");
Deleted : user_pref("extensions.incredibar.did", "10669");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "0BE9D29A08051BDEE6C785E75DD9B082");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.hrdid", "0");
Deleted : user_pref("extensions.incredibar.id", "d4a22dfc000000000000002618aea11b");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15523");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.instlday", "15523");
Deleted : user_pref("extensions.incredibar.instlref", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.isdcmntcmplt", "false");
Deleted : user_pref("extensions.incredibar.keywordurl", "");
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1422:33:55");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.newtab", "false");
Deleted : user_pref("extensions.incredibar.newtaburl", "");
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "123%5F1");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.propectorlck", 79821305);
Deleted : user_pref("extensions.incredibar.prtkHmpg", 1);
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.prtnrid", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.smplgrp", "none");
Deleted : user_pref("extensions.incredibar.srch", "");
Deleted : user_pref("extensions.incredibar.srchprvdr", "");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB_T[...]
Deleted : user_pref("extensions.incredibar.tlbrid", "base");
Deleted : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB_T[...]
Deleted : user_pref("extensions.incredibar.upn2", "6OyGKDdFPT");
Deleted : user_pref("extensions.incredibar.upn2n", "92261687784978173");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1422:33:55");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnts", "1.5.11.1422:33:55");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10669");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "d4a22dfc000000000000002618aea11b");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15523");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "123%5F1");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyGKDdFPT&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6OyGKDdFPT");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92261687784978173");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1422:33:55");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
*************************
AdwCleaner[S1].txt - [8356 octets] - [15/07/2012 22:43:02]
AdwCleaner[R1].txt - [6820 octets] - [04/09/2012 14:07:34]
AdwCleaner[R2].txt - [7037 octets] - [05/09/2012 17:42:00]
AdwCleaner[S2].txt - [6719 octets] - [06/09/2012 18:43:52]
########## EOF - C:\AdwCleaner[S2].txt - [6847 octets] ##########
|
|
06.09.2012, 20:38
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner Wieso jast du denn jetzt schon wieder die alte Version vvom adwCleaner genommen?  Du solltest die alte adwCleaner.exe doch vorher löschen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.09.2012, 21:37
| #11 |
| | Brauche Loganalyse für MyStart Trojaner ja sorry, es war ja nichts installiert, da dachte ich, ich wäre dazu fähig 2 exe dateien in meinen downloads auseinanderzuhalten...aber dem war wohl nicht so. asche über mein haupt  Hier also nochmal die richtige textdatei. Code:
ATTFilter # AdwCleaner v2.000 - Datei am 09/06/2012 um 22:32:52 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Professional (64 bits)
# Benutzer : Ralph - RALPH-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Ralph\Downloads\adwcleaner(2).exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
-\\ Mozilla Firefox v14.0.1 (de)
Profilname : default
Datei : C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\ubjbzlrq.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [8356 octets] - [15/07/2012 22:43:02]
AdwCleaner[R1].txt - [6820 octets] - [04/09/2012 14:07:34]
AdwCleaner[R2].txt - [7037 octets] - [05/09/2012 17:42:00]
AdwCleaner[S2].txt - [6844 octets] - [06/09/2012 18:43:52]
AdwCleaner[S3].txt - [1346 octets] - [06/09/2012 22:32:52]
########## EOF - C:\AdwCleaner[S3].txt - [1406 octets] ##########
|
|
07.09.2012, 10:00
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner Hätte da mal drei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? 3.) mystart ist nun weg?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.09.2012, 12:57
| #13 |
| | Brauche Loganalyse für MyStart Trojaner Was meinst du mit 1.? Wie soll ich denn feststellen ob es uneingeschränkt läuft? Es fährt hoch, ich habe keine abstürze oder sonstiges und bis jetzt auch nichts gemerkt ausser, dass ich zu anfang immer auf die incredibarseite gekommen bin sobal ich nen tab geöffnet habe, obwohl es deinstalliert war im browser. |
|
09.09.2012, 20:47
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Brauche Loganalyse für MyStart Trojaner normaler Modus ist ist das "Gegenstück" zum abgesicherten Modus, ich wollte nur wissen ob dieser Modus normal und vernünftig läuft Wätre schön gewesen, wenn du die anderen Fragen noch beantwortet hättest, naja so dauert es halt etwas länger 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.09.2012, 18:00
| #15 |
| | Brauche Loganalyse für MyStart Trojaner 1.) Ja es läuft vernünftig 2.) Ausser dem Ordner Autostart ist kein leerer Ordner unter Start/Alle Programme 3.) Ja. Das Problem mit dem neuen Tab, wodurch es mir überhaupt aufgefallen ist, tritt nicht mehr auf. |
|
| Themen zu Brauche Loganalyse für MyStart Trojaner |
| adwcleaner, antivir, autorun, avira, bho, bingbar, browser, desktop, error, firefox, flash player, google, helper, install.exe, internet, internet explorer, langs, launch, league of legends, logfile, mozilla, mystart trojaner, newtab, origin, problem, realtek, registry, scan, search the web, searchscopes, security, software, spielen, svchost.exe, system, trojane, trojaner, vdeck.exe, windows |
