| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer öfnet ungewollt Popups ohne das er genutzt wirdWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.02.2010, 19:31
| #1 |
 |  Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird So Hallo, Ichw ende mich hier an euch, weil ich ein quälendes Problem habe. Bei mir öffnet sich der Internet explorer mit irgendwelcher werbung. Obwohl ich den nichtmal benutze! Es stört mich, da ich einfach keine Zeit hab, Immer meinem Spiel zuzusehen wie es abkratzt weil so ein doofes Fenster geöfnet wird. leider crasht das game immer sobal man auf den desktop kommt/geht  tja, HjackThis bericht liegt unten vor, hoffe ihr helft mir, aufdass der Virus vergehe  ![spoiler] Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:29:51, on 02.02.2010 Platform: Unknown Windows (WinNT 6.01.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Boot mode: Normal Running processes: C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Windows\System32\rundll32.exe C:\Users\Michael\AppData\Roaming\svhost.exe C:\Windows\system32\taskeng.exe C:\Users\Michael\AppData\Local\Temp\Pck.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\Users\Michael\AppData\Local\Temp\Pcl.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Michael\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.web.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://go.web.de/suchbox/webdesuche?su=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSN Toolbar] "C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe" O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKCU\..\Run: [Windows Service Host] C:\Users\Michael\AppData\Roaming\svhost.exe O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [LosAlamos] rundll32.exe C:\Users\Michael\AppData\Local\Temp\sshnas21.dll,AttachConsoleA O4 - HKCU\..\Run: [BMIMZMHMFM] C:\Users\Michael\AppData\Local\Temp\Pcl.exe O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: 1261680059 (.1261680059) - Unknown owner - C:\Program Files\1261680059\Michael1261680059L.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe -- End of file - 5445 bytes [/spoiler] |
|
03.02.2010, 13:09
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Hallo und
__________________ Bitte diese Liste beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! ) Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen! Die Logfiles kannst Du zB alle in eine Datei zippen und auf File-Upload.net hochladen und hier verlinken, denn 1. sind manche Logfiles fürs Board nämlich zu groß und 2. kann ich mit einem Klick mir gleich alle auf einmal runterladen.
__________________ |
|
03.02.2010, 20:04
| #3 |
| | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Okay, bekomme aber RSIT nicht zum laufen!
__________________AutoIt Error Line -1: Error: Variable used without being declared.  Naja, die logfile hab ich dier von mBam: http://www.file-upload.net/download-2224409/Cycrows-Analyse.rar.html CC cleaner hab ich auch schon ausgeführt. Ziehmlich viel müll drauf. Ich hab mir schon Norton antivirus 2010 bestellt, warte nurnoch drauf das es kommt. |
|
03.02.2010, 20:10
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Hast Du die Funde alle entfernt? Da steht überall no action taken... Manchmal läuft RSIT unter Win7 nicht...mach stattdessen bitte OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
03.02.2010, 21:31
| #5 |
| | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird einmal: OTL logfile created on: 2/3/2010 9:25:27 PM - Run 1 OTL by OldTimer - Version 3.1.27.1 Folder = C:\Users\Michael\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 452.99 Gb Total Space | 316.41 Gb Free Space | 69.85% Space Free | Partition Type: NTFS Drive D: | 4.11 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MICHAEL-PC Current User Name: Michael Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\Michael\AppData\Local\Temp\Pcl.exe () PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe (Microsoft Corp.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) PRC - C:\Programme\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) PRC - C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) PRC - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) ========== Modules (SafeList) ========== MOD - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation) MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation) MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation) MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation) MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation) MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation) MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation) MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.) SRV - (.1261680059) -- C:\Programme\1261680059\Michael1261680059L.exe () SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) SRV - (nvsvc) -- C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation) SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation) SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation) SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation) SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation) SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation) SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation) SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation) SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation) SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation) SRV - (NMIndexingService) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) SRV - (Nero BackItUp Scheduler 3) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) SRV - (InCDsrvR) InCD Helper (read only) -- C:\Program Files\Ahead\InCD\InCDsrv.exe (Nero AG) ========== Driver Services (SafeList) ========== DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.) DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.) DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.) DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.) DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices) DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.) DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices) DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation) DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.) DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation) DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation) DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation) DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation) DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation) DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex) DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.) DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company) DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.) DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation) DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation) DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems) DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation) DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.) DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology) DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.) DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation) DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation) DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation) DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation) DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation) DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation) DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation) DRV - (usbaudio) USB Audio Driver (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation) DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation) DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation) DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation) DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation) DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation) DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation) DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation) DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp) DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation) DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation) DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation) DRV - (secdrv) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (WinDriver6) -- C:\Windows\System32\drivers\windrvr6.sys (Jungo) DRV - (BsUDF) -- C:\Windows\System32\drivers\bsudf.sys (ahead software) DRV - (BsStor) -- C:\Windows\System32\DRIVERS\bsstor.sys (B.H.A Co.,Ltd.) DRV - (OVT511Plus) -- C:\Windows\System32\drivers\omcamvid.sys (OmniVision Technologies, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = go.web.de/homehttp://www.google.de/ [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.web.de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6F 6B 75 3F D4 84 CA 01 [binary data] IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "WEB.DE Suche" FF - prefs.js..browser.search.defaulturl: "http://www3.iamwired.net/websearch.php?src=tops&search=" FF - prefs.js..browser.search.order.1: "GMX Suche" FF - prefs.js..browser.search.order.2: "1und1 Suche" FF - prefs.js..browser.search.order.3: "amazon.de" FF - prefs.js..browser.search.order.4: "WEB.DE Suche" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de  fficial"FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0 FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5 FF - prefs.js..keyword.URL: "http://go.web.de/suchbox/webdesuche?su=" FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\Firefox [2010/01/05 00:01:12 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/01/05 00:01:11 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/31 00:32:21 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/31 00:32:21 | 000,000,000 | ---D | M] [2009/12/24 21:14:03 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions [2010/02/03 20:09:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7e1suptk.default\extensions [2010/01/30 10:00:22 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7e1suptk.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66} [2010/01/22 17:40:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\7e1suptk.default\extensions\playbox@toolbar [2010/01/30 10:00:45 | 000,005,591 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\1und1-suche.xml [2010/01/30 10:00:45 | 000,001,371 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\amazonde.xml [2010/01/06 01:36:27 | 000,002,256 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\askcom.xml [2010/01/02 19:45:37 | 000,002,186 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\bing.xml [2010/01/12 15:26:24 | 000,000,925 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\conduit.xml [2010/01/30 10:00:45 | 000,010,605 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\gmx-suche.xml [2009/12/27 14:35:15 | 000,000,261 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\Search.xml [2010/01/30 10:00:53 | 000,005,588 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\Mozilla\FireFox\Profiles\7e1suptk.default\searchplugins\webde-suche.xml [2010/01/30 10:00:42 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010/01/30 10:00:14 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Programme\Mozilla Firefox\extensions\{95f24680-9e31-11da-a746-0800200c9a66} [2010/01/30 10:00:14 | 000,000,000 | ---D | M] (WEB.DE Firefox Addon) -- C:\Programme\Mozilla Firefox\extensions\{a82d0125-000a-4a57-abbc-5d4b0dbaab54} [2010/01/16 02:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010/01/16 02:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010/01/16 02:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010/01/16 02:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010/01/16 02:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/12/25 18:45:05 | 000,001,178 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 mynortonaccount.conxion.com O1 - Hosts: 127.0.0.1 a204-2-160-40.deploy.akamaitechnologies.com O1 - Hosts: 127.0.0.1 symantec.com.102.112.2o7.net O1 - Hosts: 127.0.0.1 a96-7-151-238.deploy.akamaitechnologies.com O1 - Hosts: 127.0.0.1 lcsitemain.conxion.com O1 - Hosts: 127.0.0.1 lc1alt.symantec.com O1 - Hosts: 127.0.0.1 lcsitemain.symantec.com O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx () O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll (Microsoft Corporation) O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation) O4 - HKLM..\Run: [MSN Toolbar] C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe (Microsoft Corp.) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [BMIMZMHMFM] C:\Users\Michael\AppData\Local\Temp\Pcl.exe () O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2005/11/21 18:26:21 | 000,000,057 | R--- | M] () - D:\autorun.inf -- [ UDF ] O33 - MountPoints2\{007c9fb7-f104-11de-87a6-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{007c9fb7-f104-11de-87a6-806e6f6e6963}\Shell\AutoRun\command - "" = D:\OblivionLauncher.exe -- [2006/02/27 15:17:52 | 001,662,976 | R--- | M] (Bethesda Softworks) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/02/03 21:23:33 | 000,548,864 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe [2010/02/03 21:23:32 | 000,548,864 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe.part [2010/02/03 19:25:48 | 000,000,000 | ---D | C] -- C:\Programme\trend micro [2010/02/03 19:25:48 | 000,000,000 | ---D | C] -- C:\rsit [2010/02/03 19:15:05 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Malwarebytes [2010/02/03 19:15:02 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/02/03 19:15:01 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/02/03 19:15:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010/02/03 19:15:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010/02/03 19:09:38 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010/01/31 22:41:06 | 000,000,000 | ---D | C] -- C:\Windows\OvtCam [2010/01/31 21:35:57 | 000,000,000 | ---D | C] -- C:\Fraps [2010/01/31 21:29:32 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\DonationCoder [2010/01/31 21:29:32 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\DonationCoder [2010/01/30 19:53:39 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\LogMeIn Hamachi [2010/01/30 18:33:50 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Stranded Mulitplayer [2010/01/30 10:00:08 | 000,000,000 | ---D | C] -- C:\ProgramData\IEConfiguration1und1 [2010/01/30 09:59:58 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\PackageAware [2010/01/27 18:06:05 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2010/01/25 19:07:43 | 000,000,000 | ---D | C] -- C:\ProgramData\BC Soft Games [2010/01/23 17:11:46 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll [2010/01/23 12:29:50 | 000,101,504 | ---- | C] (Nero AG) -- C:\Windows\System32\drivers\InCDfs.sys [2010/01/23 12:29:50 | 000,029,696 | ---- | C] (Nero AG) -- C:\Windows\System32\drivers\InCDpass.sys [2010/01/23 12:29:50 | 000,008,704 | ---- | C] (Nero AG) -- C:\Windows\System32\drivers\InCDrec.sys [2010/01/22 23:19:10 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Ahead [2010/01/22 22:02:47 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\Ahead [2010/01/22 22:02:29 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Neuer Ordner [2010/01/22 20:37:27 | 000,155,648 | ---- | C] (Ahead Software Gmbh) -- C:\Windows\System32\NeroCheck.exe [2010/01/22 20:36:13 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3a.dll [2010/01/22 20:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Ahead [2010/01/22 20:35:34 | 000,106,496 | ---- | C] (Pegasus Software) -- C:\Windows\System32\TwnLib20.dll [2010/01/22 20:35:34 | 000,038,912 | ---- | C] (Pegasus Imaging Corp.) -- C:\Windows\System32\picn20.dll [2010/01/22 20:35:32 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Ahead [2010/01/22 19:12:23 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\Nero [2010/01/22 18:48:54 | 000,000,000 | ---D | C] -- C:\Windows\Profiles [2010/01/22 18:48:54 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\My eBooks [2010/01/22 18:48:54 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe [2010/01/22 18:48:53 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\InterTrust [2010/01/22 18:48:42 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe [2010/01/22 18:48:15 | 000,009,344 | ---- | C] (B.H.A Co.,Ltd.) -- C:\Windows\System32\drivers\bsstor.sys [2010/01/22 18:48:14 | 000,441,728 | ---- | C] (ahead software) -- C:\Windows\System32\drivers\bsudf.sys [2010/01/22 18:28:21 | 000,254,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmclien.dll [2010/01/22 13:17:23 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010/01/22 13:17:23 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010/01/21 17:37:44 | 000,000,000 | -H-D | C] -- C:\Programme\InstallShield Installation Information [2010/01/21 17:14:26 | 000,000,000 | ---D | C] -- C:\Programme\Oblivion Improved [2010/01/21 17:12:58 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gdiplus.dll [2010/01/20 21:32:28 | 000,000,000 | ---D | C] -- C:\Programme\Bethesda Softworks [2010/01/20 21:32:07 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll [2010/01/20 21:29:46 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\InstallShield [2010/01/20 21:29:39 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\Oblivion [2010/01/20 21:29:39 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\My Games [2010/01/16 23:55:43 | 000,000,000 | ---D | C] -- C:\Users\Michael\Desktop\Minecraft [2010/01/16 15:27:19 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Roaming\.minecraft [2010/01/16 15:25:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010/01/16 15:25:18 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010/01/16 15:24:59 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll [2010/01/16 15:24:59 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010/01/16 15:24:59 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010/01/16 15:24:59 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010/01/16 14:44:58 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Steam [2010/01/16 14:44:57 | 000,000,000 | ---D | C] -- C:\Programme\Steam [2010/01/16 11:58:06 | 000,000,000 | ---D | C] -- C:\Programme\Innonics [2010/01/16 00:20:54 | 000,136,704 | ---- | C] (Ligos Corporation) -- C:\Windows\System32\iacenc.dll [2010/01/16 00:20:54 | 000,000,000 | ---D | C] -- C:\Programme\Ligos [2010/01/16 00:19:22 | 000,306,688 | ---- | C] (InstallShield Software Corporation) -- C:\Windows\IsUninst.exe [2010/01/16 00:08:58 | 000,182,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft3.dll [2010/01/16 00:08:58 | 000,140,800 | ---- | C] (The Duck Corporation) -- C:\Windows\System32\tm20dec.ax [2010/01/16 00:08:58 | 000,038,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\LMRTREND.dll [2010/01/16 00:08:57 | 000,217,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\strmdll.dll [2010/01/16 00:08:57 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unam4ie.exe [2010/01/16 00:08:56 | 001,088,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\danim.dll [2010/01/16 00:08:56 | 000,194,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qcut.dll [2010/01/16 00:08:56 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciqtz.drv [2010/01/16 00:08:55 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\w95inf32.dll [2010/01/16 00:08:55 | 000,002,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\w95inf16.dll [2010/01/15 08:44:08 | 000,000,000 | ---D | C] -- C:\Users\Michael\AppData\Local\ElevatedDiagnostics [2010/01/14 19:01:16 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\theHunter [2010/01/14 18:59:43 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll [2010/01/14 18:59:43 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll [2010/01/14 18:58:50 | 000,000,000 | ---D | C] -- C:\Programme\Emote [2010/01/13 18:16:59 | 000,108,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010/01/13 18:16:59 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010/01/07 15:13:25 | 003,453,712 | ---- | C] (INCA Internet Co., Ltd.) -- C:\Windows\System32\GameMon.des [2010/01/07 15:09:26 | 000,004,682 | ---- | C] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npptNT2.sys [2010/01/07 15:09:10 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\INCA Shared [2010/01/07 14:51:54 | 000,000,000 | ---D | C] -- C:\Programme\gPotato.eu [2010/01/05 23:19:41 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll [2010/01/05 22:38:43 | 000,000,000 | ---D | C] -- C:\Users\Michael\Documents\UseNeXT [2009/10/29 00:07:48 | 136,691,802 | ---- | C] (Games ) -- C:\Users\Michael\AppData\Roaming\CampfireLegends.exe [2009/04/06 17:09:46 | 163,844,793 | ---- | C] (Games ) -- C:\Users\Michael\AppData\Roaming\Samantha Swift and the Golden Touch.exe [4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/02/03 21:26:43 | 001,572,864 | -HS- | M] () -- C:\Users\Michael\ntuser.dat [2010/02/03 21:23:44 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe [2010/02/03 21:23:35 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe.part [2010/02/03 21:11:28 | 000,000,294 | -H-- | M] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job [2010/02/03 20:32:52 | 000,000,023 | ---- | M] () -- C:\Windows\BlendSettings.ini [2010/02/03 19:56:47 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\wlijjm.sys [2010/02/03 19:52:22 | 000,010,507 | ---- | M] () -- C:\Users\Michael\Desktop\Haus des Alchemisten.rar [2010/02/03 19:15:05 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/02/03 19:09:38 | 000,001,835 | ---- | M] () -- C:\Users\Michael\Desktop\CCleaner.lnk [2010/02/03 19:09:06 | 314,124,600 | ---- | M] () -- C:\Users\Michael\Desktop\ooo1.3.exe.part [2010/02/03 19:09:06 | 000,000,000 | ---- | M] () -- C:\Users\Michael\Desktop\ooo1.3.exe [2010/02/03 19:06:20 | 000,781,909 | ---- | M] () -- C:\Users\Michael\Desktop\RSIT.exe [2010/02/03 18:42:10 | 000,020,512 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010/02/03 18:42:10 | 000,020,512 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010/02/03 18:40:08 | 001,472,002 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010/02/03 18:40:08 | 000,641,706 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010/02/03 18:40:08 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010/02/03 18:40:08 | 000,126,062 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010/02/03 18:40:08 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010/02/03 18:33:33 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010/02/03 18:33:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010/02/03 18:33:24 | 2411,859,968 | -HS- | M] () -- C:\hiberfil.sys [2010/02/02 23:48:20 | 002,766,291 | -H-- | M] () -- C:\Users\Michael\AppData\Local\IconCache.db [2010/01/31 22:41:07 | 000,000,300 | ---- | M] () -- C:\Windows\setup.ini [2010/01/31 21:35:58 | 000,000,566 | ---- | M] () -- C:\Users\Michael\Desktop\Fraps.lnk [2010/01/31 21:29:32 | 000,000,058 | ---- | M] () -- C:\Users\Michael\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat [2010/01/31 00:32:22 | 000,001,889 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010/01/30 09:42:28 | 000,052,315 | ---- | M] () -- C:\Users\Michael\Desktop\Fun_6in1 File.rar [2010/01/23 17:19:08 | 000,002,713 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart.lnk [2010/01/23 17:19:08 | 000,002,593 | ---- | M] () -- C:\Users\Public\Desktop\Nero Home.lnk [2010/01/23 12:43:13 | 000,000,047 | ---- | M] () -- C:\Windows\NeroDigital.ini [2010/01/23 10:43:12 | 000,341,719 | ---- | M] () -- C:\Users\Michael\Desktop\Edison Softcam 2100-2620 15.01.10.rar [2010/01/22 23:08:00 | 1910,166,898 | ---- | M] () -- C:\Users\Michael\Desktop\2Brothers-Avatar.German.TELESYNC.XviD.rar [2010/01/22 18:48:56 | 000,001,213 | ---- | M] () -- C:\Users\Public\Desktop\Acrobat Reader 5.0.lnk [2010/01/21 17:14:53 | 000,001,220 | ---- | M] () -- C:\Users\Michael\Desktop\Oblivion Mod Manager.lnk [2010/01/21 17:12:58 | 001,700,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\gdiplus.dll [2010/01/16 21:05:46 | 000,000,036 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\TheHunterSettings.cfg [2010/01/16 15:24:51 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll [2010/01/16 15:24:51 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010/01/16 15:24:51 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010/01/16 15:24:51 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010/01/16 14:44:58 | 000,002,527 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2010/01/16 00:08:55 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\w95inf32.dll [2010/01/16 00:08:55 | 000,002,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\w95inf16.dll [2010/01/14 20:20:10 | 000,009,716 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\TheHunterSettings.bin [2010/01/14 11:12:06 | 000,181,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010/01/11 18:15:24 | 000,000,167 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\default.rss [2010/01/11 08:12:38 | 000,381,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010/01/10 13:25:53 | 000,789,384 | ---- | M] () -- C:\Users\Michael\Desktop\save3.10ms.zip [2010/01/09 22:35:57 | 000,303,692 | ---- | M] () -- C:\Users\Michael\Desktop\Supper_Mario_Playing_Fire_PSP_Theme.zip [2010/01/07 16:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/01/07 16:07:04 | 000,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/01/07 14:55:00 | 000,001,116 | ---- | M] () -- C:\Users\Michael\Desktop\Dragonica.lnk [2010/01/07 03:02:11 | 000,524,288 | -HS- | M] () -- C:\Users\Michael\ntuser.dat{0aa5a26e-f93a-11de-8abd-001e6561b71a}.TMContainer00000000000000000002.regtrans-ms [2010/01/07 03:02:11 | 000,524,288 | -HS- | M] () -- C:\Users\Michael\ntuser.dat{0aa5a26e-f93a-11de-8abd-001e6561b71a}.TMContainer00000000000000000001.regtrans-ms [2010/01/07 03:02:11 | 000,065,536 | -HS- | M] () -- C:\Users\Michael\ntuser.dat{0aa5a26e-f93a-11de-8abd-001e6561b71a}.TM.blf [4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/02/03 20:05:53 | 000,000,294 | -H-- | C] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job [2010/02/03 19:56:47 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\wlijjm.sys [2010/02/03 19:52:13 | 000,010,507 | ---- | C] () -- C:\Users\Michael\Desktop\Haus des Alchemisten.rar [2010/02/03 19:15:05 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/02/03 19:09:38 | 000,001,835 | ---- | C] () -- C:\Users\Michael\Desktop\CCleaner.lnk [2010/02/03 19:06:16 | 000,781,909 | ---- | C] () -- C:\Users\Michael\Desktop\RSIT.exe [2010/02/02 23:26:36 | 000,000,000 | ---- | C] () -- C:\Users\Michael\Desktop\ooo1.3.exe [2010/02/02 23:26:35 | 313,239,864 | ---- | C] () -- C:\Users\Michael\Desktop\ooo1.3.exe.part [2010/01/31 22:41:07 | 000,000,300 | ---- | C] () -- C:\Windows\setup.ini [2010/01/31 21:35:58 | 000,000,566 | ---- | C] () -- C:\Users\Michael\Desktop\Fraps.lnk [2010/01/31 21:29:32 | 000,000,058 | ---- | C] () -- C:\Users\Michael\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat [2010/01/30 09:42:28 | 000,052,315 | ---- | C] () -- C:\Users\Michael\Desktop\Fun_6in1 File.rar [2010/01/23 22:25:23 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini [2010/01/23 18:28:25 | 000,000,668 | ---- | C] () -- C:\ccJobMgr.dat [2010/01/23 17:19:08 | 000,002,713 | ---- | C] () -- C:\Users\Public\Desktop\Nero StartSmart.lnk [2010/01/23 17:19:08 | 000,002,593 | ---- | C] () -- C:\Users\Public\Desktop\Nero Home.lnk [2010/01/23 12:43:13 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini [2010/01/23 10:43:04 | 000,341,719 | ---- | C] () -- C:\Users\Michael\Desktop\Edison Softcam 2100-2620 15.01.10.rar [2010/01/22 23:26:29 | 1917,237,248 | ---- | C] () -- C:\Users\Michael\Desktop\2Brothers-Avatar.German.TELESYNC.XviD.avi [2010/01/22 22:49:46 | 1910,166,898 | ---- | C] () -- C:\Users\Michael\Desktop\2Brothers-Avatar.German.TELESYNC.XviD.rar [2010/01/22 18:48:56 | 000,001,213 | ---- | C] () -- C:\Users\Public\Desktop\Acrobat Reader 5.0.lnk [2010/01/21 17:14:53 | 000,001,220 | ---- | C] () -- C:\Users\Michael\Desktop\Oblivion Mod Manager.lnk [2010/01/17 09:32:25 | 2068,119,552 | ---- | C] () -- C:\Users\Michael\Desktop\ps2 game.iso [2010/01/16 14:44:58 | 000,002,527 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2010/01/16 00:20:54 | 000,056,320 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll [2010/01/16 00:08:56 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll [2010/01/16 00:08:56 | 000,005,672 | ---- | C] () -- C:\Windows\System32\quartz.vxd [2010/01/14 20:20:10 | 000,009,716 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\TheHunterSettings.bin [2010/01/14 19:01:06 | 000,000,036 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\TheHunterSettings.cfg [2010/01/10 13:25:52 | 000,789,384 | ---- | C] () -- C:\Users\Michael\Desktop\save3.10ms.zip [2010/01/09 22:35:32 | 000,303,692 | ---- | C] () -- C:\Users\Michael\Desktop\Supper_Mario_Playing_Fire_PSP_Theme.zip [2010/01/07 15:09:26 | 000,005,174 | ---- | C] () -- C:\Windows\System32\nppt9x.vxd [2010/01/07 14:55:00 | 000,001,116 | ---- | C] () -- C:\Users\Michael\Desktop\Dragonica.lnk [2010/01/01 11:34:54 | 000,000,167 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\default.rss [2010/01/01 11:34:53 | 000,000,000 | ---- | C] () -- C:\Users\Michael\AppData\Roaming\downloads.m3u [2009/07/14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2001/09/18 12:00:00 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bmpproc.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:1A3830B1 < End of report > zweimal: OTL Extras logfile created on: 2/3/2010 9:25:27 PM - Run 1 OTL by OldTimer - Version 3.1.27.1 Folder = C:\Users\Michael\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 80.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 452.99 Gb Total Space | 316.41 Gb Free Space | 69.85% Space Free | Partition Type: NTFS Drive D: | 4.11 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MICHAEL-PC Current User Name: Michael Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{04EFC3B1-1A7A-4075-866F-B1EF3BA3E783}_is1" = Rungs "Verbesserte Magiergilde" 2.3a "{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar "{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant "{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{23D683DD-93C6-48E6-B84E-78B57778F126}" = Oblivion - Construction Set "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18 "{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion "{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5FCCD531-1B38-4A94-924C-127F722F1031}" = Nero 8 "{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{A21470CE-352F-4152-A2A1-B231CF0CED78}" = theHunter "{A65F7CF8-6F76-40CE-B44D-D5A89D9881C7}" = MSN Toolbar Platform "{A7709081-CE4E-4339-A727-F88E648F92FA}_is1" = Oblivion Improved 1.41 "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles "{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center "{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader "{BAD5A8D1-02A1-40CB-ADAA-875F3C8B3990}" = CAS Interface Studio 8.7 "{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter "{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser "{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer "{F8A3C1B6-D2E0-4CE1-80A2-555D6F71C639}" = Microsoft Search Enhancement Pack "{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}" = Media Go "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe Acrobat 5.0" = Adobe Acrobat 5.0 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "CCleaner" = CCleaner "Dragonica" = Dragonica "Emote-Launcher" = Emote-Launcher (remove only) "Fraps" = Fraps "HijackThis" = HijackThis 2.0.2 "Indeo® Software" = Indeo® Software "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Mozilla Firefox (3.6)" = Mozilla Firefox (3.6) "NVIDIA Drivers" = NVIDIA Drivers "Oblivion mod manager_is1" = Oblivion mod manager 1.1.12 "Unofficial Oblivion Patch_is1" = Unofficial Oblivion Patch v3.2.0 "Wiggles" = Wiggles "WinRAR archiver" = WinRAR ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 2/1/2010 4:24:38 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000cee0b ID des fehlerhaften Prozesses: 0xda8 Startzeit der fehlerhaften Anwendung: 0x01caa379540dc40b Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Berichtskennung: d18b078e-0f6f-11df-97fd-001f16b732e5 Error - 2/1/2010 6:20:31 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000cee0b ID des fehlerhaften Prozesses: 0xf98 Startzeit der fehlerhaften Anwendung: 0x01caa38568f5b60e Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Berichtskennung: 0186900a-0f80-11df-97fd-001f16b732e5 Error - 2/1/2010 6:53:21 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000cee0b ID des fehlerhaften Prozesses: 0x15b0 Startzeit der fehlerhaften Anwendung: 0x01caa38d538e54c6 Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Berichtskennung: 97f5e4d5-0f84-11df-97fd-001f16b732e5 Error - 2/2/2010 7:14:46 AM | Computer Name = Michael-PC | Source = VSS | ID = 8194 Description = Error - 2/2/2010 10:25:17 AM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16385, Zeitstempel: 0x4a5bc69e Name des fehlerhaften Moduls: WININET.dll, Version: 8.0.7600.16490, Zeitstempel: 0x4b2c9616 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000bab04 ID des fehlerhaften Prozesses: 0x1698 Startzeit der fehlerhaften Anwendung: 0x01caa41387e67468 Pfad der fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe Pfad des fehlerhaften Moduls: C:\Windows\system32\WININET.dll Berichtskennung: c8d54dd8-1006-11df-8089-001f16b732e5 Error - 2/2/2010 12:20:47 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0018b262 ID des fehlerhaften Prozesses: 0xaa8 Startzeit der fehlerhaften Anwendung: 0x01caa41f7cbdaa7b Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Berichtskennung: eb0305d7-1016-11df-8089-001f16b732e5 Error - 2/2/2010 6:04:48 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16385, Zeitstempel: 0x4a5bc69e Name des fehlerhaften Moduls: sshnas21.dll, Version: 0.0.0.0, Zeitstempel: 0x469d5c73 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001192d ID des fehlerhaften Prozesses: 0xaac Startzeit der fehlerhaften Anwendung: 0x01caa453ba9ee763 Pfad der fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe Pfad des fehlerhaften Moduls: C:\Users\Michael\AppData\Local\Temp\sshnas21.dll Berichtskennung: fa5c1a2a-1046-11df-80ba-001f16b732e5 Error - 2/2/2010 6:09:22 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000cee0b ID des fehlerhaften Prozesses: 0xee4 Startzeit der fehlerhaften Anwendung: 0x01caa4312647e331 Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Berichtskennung: 9d5479bc-1047-11df-80ba-001f16b732e5 Error - 2/3/2010 1:47:12 PM | Computer Name = Michael-PC | Source = VSS | ID = 8194 Description = Error - 2/3/2010 3:22:54 PM | Computer Name = Michael-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x18d857ea ID des fehlerhaften Prozesses: 0xa50 Startzeit der fehlerhaften Anwendung: 0x01caa50466702c94 Pfad der fehlerhaften Anwendung: C:\Program Files\Bethesda Softworks\Oblivion\Oblivion.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 86d57f6b-10f9-11df-80b4-001f16b732e5 [ System Events ] Error - 2/2/2010 7:01:09 AM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst 1261680059 erreicht. Error - 2/2/2010 7:01:09 AM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "1261680059" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 2/2/2010 7:01:09 AM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "InCD Helper (read only)" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. Error - 2/2/2010 1:41:26 PM | Computer Name = Michael-PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?02.?02.?2010 um 18:40:09 unerwartet heruntergefahren. Error - 2/2/2010 1:41:31 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst 1261680059 erreicht. Error - 2/2/2010 1:41:31 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "1261680059" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 2/2/2010 1:41:31 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "InCD Helper (read only)" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. Error - 2/3/2010 1:33:35 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst 1261680059 erreicht. Error - 2/3/2010 1:33:35 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "1261680059" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 2/3/2010 1:33:36 PM | Computer Name = Michael-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "InCD Helper (read only)" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. < End of report > Also ich hab die probleme behoben mit Mbam. Auserdem kommen die Popups nichtmehr... mhm. Aber ihr mact ja weiter bis die Kiste ganz "clean ist" was^^ Geändert von Cycrow (03.02.2010 um 21:38 Uhr) |
|
03.02.2010, 22:18
| #6 | |||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wirdZitat:
Zitat:
Zitat:
 Ein PDF-Reader aus der Steinzeit!!! 
__________________ --> Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird |
|
04.02.2010, 00:21
| #7 |
| | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Mhm, nein das ist nicht gewollt. Aber ein dickes  Bekommst du trozdem  Auswetungen: http://www.virustotal.com/de/analisis/3651f87f9a5d6c41ee8c80ac9ac6c57b0b6d0ca3d3552aebcca90ec6fdeafd63-1264358353 http://www.virustotal.com/de/analisis/3da4f51682e7d42c5569f1fb1adc6295182962e36f748219e1d0c8f2389ba516-1265219034 http://www.virustotal.com/de/analisis/df927142505322b2e1b8b9a3757193efe843c7e2201e91070e1fcdef9a561570-1265239030 http://www.virustotal.com/de/analisis/df927142505322b2e1b8b9a3757193efe843c7e2201e91070e1fcdef9a561570-1265239228 http://www.virustotal.com/de/analisis/7a8254a2c3b8069b5c602f07a43446a30e617873a3200627aebb1dcd32b7b31d-1265239201 alles der reihenfolge nach |
|
04.02.2010, 12:41
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Bitte mal den Avenger anwenden 1.) Lade Dir von hier Avenger: Swandog46's Public Anti-Malware Tools (Download, linksseitig) 2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:  3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld: Code:
ATTFilter folders to delete:
C:\Programme\1261680059
files to delete:
C:\Windows\System32\drivers\wlijjm.sys
drivers to delete:
wlijjm
5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein. 6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso. 7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.02.2010, 20:12
| #9 |
| | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: folder "C:\Programme\1261680059" not found! Deletion of folder "C:\Programme\1261680059" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\Windows\System32\drivers\wlijjm.sys" not found! Deletion of file "C:\Windows\System32\drivers\wlijjm.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\wlijjm" not found! Deletion of driver "wlijjm" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. =) so... Der neustart verlief... nicht ganz in ordnung. Ein Bluescreen mit einem Text, konnte ihn aber nicht lesen, war zu kurz da um überhaupt was zu lesen. Dannach ne doofe meldung das eine WIndwos Sstemdatei anscheinend beschädigt sein könnte bla bl bla -> windows Normal starten. Auserdem hab ich Windows 7 :P Der bericht sagt da was anderes...  |
|
04.02.2010, 20:19
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Welche Systemdatei? Fährt Windows jetzt garnicht mehr hoch?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.02.2010, 20:32
| #11 |
| | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird Doch, doch WIndows fährt hoch, DU kennst windows, es zickt gerne :P Ja,Ja, hätte ich WIndows 7 neu auflegen müssen... Hätte ich dich dafür verantwortlich gemacht Ist nähmlich der Laptop meines Vater... Mein eigener ist kaputt |
|
09.02.2010, 15:52
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Internet Explorer öfnet ungewollt Popups ohne das er genutzt wirdZitat:
 Die Vorschläge sind hier eh alle auf eigene Gefahr und auch bei den Tools steht ein Disclaimer, dass die Nutzung auf eigene Gefahr geschieht. Wie ist es um den Rechner jetzt bestellt? Mach bitte noch einen Kontrollscan, öffne Malwarebytes, aktualisiere das Programm, starte einen Vollscan und lass alle etwaigen Funde entfernen. Anschließend wieder das Logfile posten.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Internet Explorer öfnet ungewollt Popups ohne das er genutzt wird |
| adobe, ask toolbar, ask.com, bho, desktop, dll, explorer, firefox, gservice, hijack, hijackthis, internet, internet explorer, local\temp, micro, microsoft, mozilla, msn, nvidia, object, plug-in, popups, problem, rundll, software, sshnas21.dll, system, temp, virus, windows, öffnet |
Linear-Darstellung
