Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!]

Iskra · 20.07.2010, 16:03

Liebes Board,

gestern durfte ich mit Antivir Pro Solution Bekanntschaft machen. Dank der Anleitung im Board konnt ich den Mist aber entfernen.

Jetzt stelle ich aber fest dass mein PC deutlich langsamer geworden ist, Internetseiten bauen sich langsam oder gar nicht auf (keine Antwort) und werden erst beim aktualisieren angezeigt. Wind. Media Player ruckelt beim Musik-abspielen...

CC Cleaner durchgeführt.
Malwarebytes Anti-Malware Log, von gestern bei der Entfernung:

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

19.07.2010 22:51:15
mbam-log-2010-07-19 (22-51-15).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 314349
Laufzeit: 31 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\esxovioi (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\eythqcovw\owmefaftssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\***\Desktop\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.

Log von heute:

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

20.07.2010 16:36:19
mbam-log-2010-07-20 (16-36-19).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 124775
Laufzeit: 2 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Beim 3ten Programm, OTL allerdings, habe ich ein Problem, beim Scan ist der PC mit folgendem Bluescreen abgestürzt:
hxxp://img32.imageshack.us/i/p1080186v.jpg/

Habt ihr Vorschläge, was ich tun kann?

Danke für eure Hilfe..

Liebe Grüße,

Iskra

markusg · 20.07.2010, 16:27

führe doch erst mal ein Malwarebytes update aus und mache einen komplett scan.
lösche die funde, poste das log.
weist du noch die seite, auf der du dir das eingefangen hast? wenn ja, per persönlicher nachicht an mich.

Iskra · 20.07.2010, 18:17

Leider erscheint immer wieder ein Bluescreen beim neuerlichen Scan.

Was tun? :/

markusg · 20.07.2010, 18:37

ok.
dann weiter hiermit:
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
und beantworte noch die frage wo dus her haben könntest

Iskra · 20.07.2010, 19:54

Zitat:

Zitat von markusg

ok.
dann weiter hiermit:
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
und beantworte noch die frage wo dus her haben könntest

Bei ComboFix kommt die MEldung ''Incompitable OS. ComboFix only works for workstations with Windows 2000 and XP.

Schade dass ich Windows 7 habe, entschuldige, das habe ich nicht erwähnt.
Wie gehts weiter?

Zu deiner Frage (entschuldige, habe ich vergessen zu schreiben): Leider weiß ich nicht mehr auf welcher Seite ich mir diesen Müll eingefangen habe, sorry.

markusg · 20.07.2010, 19:59

versuche windows mal im abgesicherten modus zu starten, sollte mit der f8-taste zu erreichen sein, dort den Malwarebytes komplett scan ausführen, funde löschen, log posten

Iskra · 22.07.2010, 05:58

Super, das hat funktioniert!!

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4331

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

21.07.2010 23:01:19
mbam-log-2010-07-21 (23-01-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 327064
Laufzeit: 29 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\AVSolution (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\***\AppData\Local\Temp\rropyvnl.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\swearmonxc.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\uhedyvt.exe (Adware.BHO) -> Quarantined and deleted successfully.

markusg · 22.07.2010, 14:04

ok.
schau doch mal bitte ob du otl zum laufen bekommst, erst im normalen modus, wenn nicht, abgesicherter modus. logs posten

Iskra · 25.07.2010, 11:46

Es hat ohne abgesicherten Modus geklappt, hier der Log:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 25.07.2010 12:29:04 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\xxx\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 75,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 337,65 Gb Free Space | 72,49% Space Free | Partition Type: NTFS
Drive D: | 5,56 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 931,41 Gb Total Space | 886,78 Gb Free Space | 95,21% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 543,56 Gb Free Space | 58,35% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: xxx
Current User Name: xxx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Users\xxx\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\xxx\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (dc3d) MS Hardware Device Detection Driver (USB) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NuidFltr) -- C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV - (speedfan) -- C:\Windows\SysWOW64\speedfan.sys (Windows (R) Server 2003 DDK provider)
DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys ()
DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.80
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.07.25 01:28:29 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.25 01:28:29 | 000,000,000 | ---D | M]
 
[2010.02.28 01:29:14 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions
[2010.07.24 21:00:46 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\pvsssm8e.default\extensions
[2010.06.09 14:34:02 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\pvsssm8e.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.07.23 17:00:48 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\pvsssm8e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.06.21 17:57:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\pvsssm8e.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.07.23 17:00:48 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\pvsssm8e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.29 00:08:23 | 000,002,254 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\FireFox\Profiles\pvsssm8e.default\searchplugins\askcom.xml
[2010.07.24 21:00:46 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.05.17 16:55:14 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ 7\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ 7\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.30 04:57:32 | 000,054,544 | R--- | M] (Electronic Arts) - D:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2008.10.22 01:48:37 | 000,000,045 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{61cd00aa-2418-11df-b0ce-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{61cd00aa-2418-11df-b0ce-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe -- [2009.04.30 04:57:32 | 000,054,544 | R--- | M] (Electronic Arts)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.23 17:40:14 | 000,000,000 | ---D | C] -- C:\Filme
[2010.07.22 22:55:45 | 000,000,000 | ---D | C] -- C:\Users\xxx\.jenny
[2010.07.20 20:48:00 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010.07.20 17:43:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\ICQ
[2010.07.19 22:09:09 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Malwarebytes
[2010.07.19 22:09:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.07.19 22:08:59 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.07.19 22:08:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.19 22:08:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.07.19 21:25:46 | 000,000,000 | ---D | C] -- C:\Users\xxxAppData\Local\eythqcovw
[2010.07.18 00:34:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\Documents\Electronic Arts
[2010.07.17 23:41:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Smart Projects
[2010.07.15 18:06:15 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2010.07.11 23:33:59 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\USB
[2010.07.09 15:18:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\GFS
[2010.07.03 12:38:10 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Neuer Ordner (3)
[2010.07.01 16:37:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Homo_Faber
[2010.06.30 17:39:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Bewerbungsordner
[2010.06.30 17:39:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Bank
[2010.06.30 17:39:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Dokumente
[2010.06.30 15:48:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WSE
[2010.06.29 21:39:45 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Neuer Ordner (2)
[2010.06.29 14:56:18 | 000,000,000 | ---D | C] -- C:\Programme\Civilization
[2010.06.29 14:16:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\GameSpy
[2010.06.29 14:16:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\ApplicationHistory
[2010.06.29 14:07:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\2K Games
[2010.06.29 14:06:37 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\InstallShield
[2010.06.29 13:59:56 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\URTTEMP
[2010.06.27 11:25:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Interface
[2010.06.27 11:25:02 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Effects
[2010.06.26 20:41:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\Zattoo
[2010.06.26 20:41:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Zattoo4
[2010.06.26 02:40:23 | 001,942,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dfshim.dll
[2010.06.26 02:40:23 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll
[2010.06.26 02:40:23 | 000,320,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHost.exe
[2010.06.26 02:40:23 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe
[2010.06.26 02:40:23 | 000,109,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHostProxy.dll
[2010.06.26 02:40:23 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll
[2010.06.26 02:40:23 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll
[2010.06.26 02:40:23 | 000,048,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netfxperf.dll
[2010.06.26 02:15:32 | 001,736,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2010.06.26 02:15:25 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll
[2010.06.26 02:15:25 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll
[2010.06.26 02:15:24 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll
[2010.06.26 02:15:24 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax
[2010.06.26 02:15:24 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax
[2010.06.26 02:15:23 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2010.06.26 02:15:23 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2010.03.06 13:33:50 | 000,099,840 | ---- | C] ( ) -- C:\Windows\SysWow64\Zipdll.dll
[2009.03.05 04:49:33 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\unzdll.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.25 12:30:05 | 001,835,008 | -HS- | M] () -- C:\Users\xxx\ntuser.dat
[2010.07.25 12:08:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.25 10:44:00 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.25 10:44:00 | 000,015,008 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.25 09:43:53 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.25 09:43:44 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.25 09:43:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.25 09:43:38 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2010.07.25 01:31:36 | 001,765,031 | -H-- | M] () -- C:\Users\xxx\AppData\Local\IconCache.db
[2010.07.23 17:18:57 | 001,501,000 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.07.23 17:18:57 | 000,654,096 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.07.23 17:18:57 | 000,615,760 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.07.23 17:18:57 | 000,130,952 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.07.23 17:18:57 | 000,107,396 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.07.20 19:16:12 | 831,250,511 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.07.20 16:28:22 | 000,001,007 | ---- | M] () -- C:\Users\xxx\Desktop\CCleaner.lnk
[2010.07.19 22:09:02 | 000,001,009 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 23:16:08 | 000,021,059 | ---- | M] () -- C:\Users\xxx\Desktop\Biologie-Referat.odt
[2010.07.18 17:05:30 | 004,077,696 | ---- | M] () -- C:\Users\xxx\Desktop\shorty-heroji danas.mp3
[2010.07.18 16:03:45 | 000,002,284 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.07.18 00:21:35 | 000,000,575 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2010.07.17 23:41:49 | 000,001,096 | ---- | M] () -- C:\Users\xxx\Desktop\IsoBuster.lnk
[2010.07.15 23:44:24 | 000,024,074 | ---- | M] () -- C:\Users\xxx\Desktop\bookmarks-2010-07-15.json
[2010.07.11 23:39:56 | 000,022,175 | ---- | M] () -- C:\Users\xxx\Desktop\gfs_handout.odt
[2010.07.11 23:35:14 | 000,025,203 | ---- | M] () -- C:\Users\xxx\Desktop\zusammenfassung_1.odt
[2010.07.11 20:25:12 | 000,025,266 | ---- | M] () -- C:\Users\xxx\Desktop\gfs haupt-final22.odt
[2010.07.11 19:31:46 | 000,025,533 | ---- | M] () -- C:\Users\xxx\Desktop\gfs haupt-final.odt
[2010.07.11 13:11:19 | 001,151,443 | ---- | M] () -- C:\Users\xxx\Desktop\srebre3.jpg
[2010.07.11 13:10:06 | 000,062,286 | ---- | M] () -- C:\Users\xxx\Desktop\srebre2.jpg
[2010.07.11 13:09:52 | 000,008,748 | ---- | M] () -- C:\Users\xxx\Desktop\srebre.jpg
[2010.07.09 15:21:39 | 031,407,523 | ---- | M] () -- C:\Users\xxx\Desktop\Sagan om Ändringen 03.mp4
[2010.07.09 15:15:58 | 003,924,096 | ---- | M] () -- C:\Users\xxx\Desktop\Chemical Brothers Push The Button.mp3
[2010.07.09 07:57:47 | 000,024,330 | ---- | M] () -- C:\Users\xxx\Desktop\forum bih.odt
[2010.07.05 21:57:55 | 000,032,600 | ---- | M] () -- C:\Users\xxx\Desktop\gfs haupt.odt
[2010.07.04 11:37:45 | 000,013,171 | ---- | M] () -- C:\Users\xxx\Desktop\gfs-titelblatt.odt
[2010.07.01 15:45:32 | 000,002,705 | ---- | M] () -- C:\Users\xxx\.recently-used.xbel
[2010.07.01 15:45:27 | 000,305,569 | ---- | M] () -- C:\Users\xxx\Desktop\bih karteforum.gif
[2010.07.01 15:08:32 | 000,303,668 | ---- | M] () -- C:\Users\xxx\Desktop\bih karte.gif
[2010.06.30 15:50:05 | 000,062,840 | ---- | M] () -- C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.06.29 15:47:49 | 000,288,568 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.06.29 14:16:01 | 000,000,094 | ---- | M] () -- C:\Users\xxx\AppData\Local\fusioncache.dat
[2010.06.29 14:00:17 | 001,528,242 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.06.27 12:12:49 | 000,044,086 | ---- | M] () -- C:\Users\xxx\Desktop\xdralovic.bmp
[2010.06.27 11:57:49 | 000,037,823 | ---- | M] () -- C:\Users\xxx\Desktop\xdralovic.jpg
[2010.06.26 20:42:40 | 000,017,408 | ---- | M] () -- C:\Users\xxx\AppData\Local\WebpageIcons.db
[2010.06.26 20:41:05 | 000,001,868 | ---- | M] () -- C:\Users\xxx\Desktop\Zattoo.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.20 16:48:52 | 831,250,511 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.07.19 22:09:02 | 000,001,009 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.18 21:07:20 | 000,021,059 | ---- | C] () -- C:\Users\xxx\Desktop\Biologie-Referat.odt
[2010.07.18 17:05:18 | 004,077,696 | ---- | C] () -- C:\Users\xxx\Desktop\shorty-heroji danas.mp3
[2010.07.18 16:03:45 | 000,002,284 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.07.18 16:03:16 | 000,000,898 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.18 16:03:15 | 000,000,894 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.18 00:21:35 | 000,000,575 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2010.07.17 23:41:49 | 000,001,096 | ---- | C] () -- C:\Users\xxx\Desktop\IsoBuster.lnk
[2010.07.15 23:44:24 | 000,024,074 | ---- | C] () -- C:\Users\xxx\Desktop\bookmarks-2010-07-15.json
[2010.07.11 23:39:54 | 000,022,175 | ---- | C] () -- C:\Users\xxx\Desktop\gfs_handout.odt
[2010.07.11 23:35:12 | 000,025,203 | ---- | C] () -- C:\Users\xxx\Desktop\zusammenfassung_1.odt
[2010.07.11 19:37:59 | 000,025,266 | ---- | C] () -- C:\Users\xxx\Desktop\gfs haupt-final22.odt
[2010.07.11 13:11:19 | 001,151,443 | ---- | C] () -- C:\Users\xxx\Desktop\srebre3.jpg
[2010.07.11 13:10:06 | 000,062,286 | ---- | C] () -- C:\Users\xxx\Desktop\srebre2.jpg
[2010.07.11 13:09:52 | 000,008,748 | ---- | C] () -- C:\Users\xxx\Desktop\srebre.jpg
[2010.07.09 15:15:49 | 003,924,096 | ---- | C] () -- C:\Users\xxx\Desktop\Chemical Brothers Push The Button.mp3
[2010.07.09 15:15:05 | 031,407,523 | ---- | C] () -- C:\Users\xxx\Desktop\Sagan om Ändringen 03.mp4
[2010.07.09 07:57:46 | 000,024,330 | ---- | C] () -- C:\Users\xxx\Desktop\forum bih.odt
[2010.07.04 22:59:34 | 000,025,533 | ---- | C] () -- C:\Users\xxx\Desktop\gfs haupt-final.odt
[2010.07.04 13:48:21 | 000,032,600 | ---- | C] () -- C:\Users\xxx\Desktop\gfs haupt.odt
[2010.07.04 11:23:08 | 000,013,171 | ---- | C] () -- C:\Users\xxx\Desktop\gfs-titelblatt.odt
[2010.07.01 15:45:32 | 000,002,705 | ---- | C] () -- C:\Users\xxx\.recently-used.xbel
[2010.07.01 15:45:26 | 000,305,569 | ---- | C] () -- C:\Users\xxx\Desktop\bih karteforum.gif
[2010.07.01 15:08:31 | 000,303,668 | ---- | C] () -- C:\Users\xxx\Desktop\bih karte.gif
[2010.06.29 14:16:01 | 000,000,094 | ---- | C] () -- C:\Users\xxx\AppData\Local\fusioncache.dat
[2010.06.27 12:08:33 | 000,044,086 | ---- | C] () -- C:\Users\xxx\Desktop\xdralovic.bmp
[2010.06.27 11:57:48 | 000,037,823 | ---- | C] () -- C:\Users\xxx\Desktop\xdralovic.jpg
[2010.06.26 20:41:34 | 000,017,408 | ---- | C] () -- C:\Users\xxx\AppData\Local\WebpageIcons.db
[2010.06.26 20:41:05 | 000,001,868 | ---- | C] () -- C:\Users\xxx\Desktop\Zattoo.lnk
[2010.03.19 23:26:21 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2010.03.09 20:22:37 | 001,528,242 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.03.05 04:49:33 | 000,230,912 | ---- | C] () -- C:\Windows\SysWow64\Zipit.dll
[2009.03.05 04:49:33 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\zlib.dll
< End of report >

--- --- ---

Iskra · 25.07.2010, 11:49

Und Log Nr. 2:

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 25.07.2010 12:29:04 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\xxx\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 75,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 337,65 Gb Free Space | 72,49% Space Free | Partition Type: NTFS
Drive D: | 5,56 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 931,41 Gb Total Space | 886,78 Gb Free Space | 95,21% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 543,56 Gb Free Space | 58,35% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: xxx
Current User Name: xxx
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5F94D3B9-2B02-9C37-740B-A59C7B8D17CC}" = ATI Catalyst Install Manager
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A792E67C-FDA4-A301-0C3C-53BA86EFBB5A}" = ccc-utility64
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam(TM)
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = Die Schlacht um Mittelerde™ II
"{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{3D6A24EA-A543-6C84-351E-D7646E7AB86E}" = Catalyst Control Center InstallProxy
"{3FA7A919-87DA-42B1-814B-86DE8DCA17C2}" = gmax
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{47CAFF95-C3D8-ABF2-70BC-89DE00D8FB19}" = Catalyst Control Center Graphics Light
"{4962EBAC-AE7C-1B22-1EA0-0916A7E40954}" = Catalyst Control Center Graphics Full Existing
"{49A62E2B-B35C-941D-DF48-601207CF14C0}" = Catalyst Control Center Graphics Previews Common
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53D264A1-EBB7-4BA6-939B-DC0BB0D268CC}_is1" = Image Maximator 1.0.1.3
"{59C80C5E-8C92-40FF-B910-2BB5C7281F61}" = Europa Universalis III
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A490E11-6C8A-777C-4E00-43F3CC16A1EC}" = CCC Help English
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77919701-C3E7-09AA-D2F7-DBF42CD7C13D}" = Catalyst Control Center HydraVision Full
"{78B2F09F-BDC7-7865-CF4C-233B64A3BE51}" = Catalyst Control Center Graphics Full New
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DCD9CA6-E4AE-4CE7-85AC-58DC35B38242}" = SBK®X Superbike World Championship
"{94838967-2844-4F7B-BB98-22E61654503C}" = SBK®X Superbike World Championship
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.1 - Deutsch
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{BDA825AD-D60B-4935-9590-B0F1AC2E0D22}" = MotoGP 08 Demo
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C2D129C0-7508-11DF-9F1B-005056806466}" = Google Earth
"{C50EF365-2898-489A-B6C7-30DAA466E9A2}" = Nokia Connectivity Cable Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D241BBEC-B1C7-7953-EDDE-D90A654A8D2C}" = ccc-core-static
"{D474A0E8-4421-43C0-BE8E-F454F91E2E2A}" = Race Driver 2
"{D5C24E77-099E-9B84-5BE2-708E70B938A9}" = Catalyst Control Center Core Implementation
"{DC4757E2-BAE3-0BFE-C6E5-576CB911FF52}" = Catalyst Control Center Graphics Previews Vista
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ArmA" = ArmA Uninstall
"AV Voice Changer Software GOLD 7.0" = AV Voice Changer Software GOLD 7.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BattlEye" = BattlEye Uninstall
"CCleaner" = CCleaner
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Creation Master 09_is1" = Creation Master 09 Release 1.01
"EA Download Manager" = EA Download Manager
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FormatFactory" = FormatFactory 2.30
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube Download_is1" = Free YouTube Download 2.6
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"FUSSBALL MANAGER 10" = FUSSBALL MANAGER 10
"InstallShield_{D474A0E8-4421-43C0-BE8E-F454F91E2E2A}" = Race Driver 2
"IsoBuster_is1" = IsoBuster 2.8
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Mp3tag" = Mp3tag v2.46
"Net TV Plus Player" = Net TV Plus Player 1.81
"OpenAL" = OpenAL
"Picasa 3" = Picasa 3
"QuickStores-Toolbar_is1" = QuickStores-Toolbar 1.0.0
"s4uVoctra" = s4uVoctra
"Samsung PC Studio 7" = Samsung PC Studio 7
"SopCast" = SopCast 3.2.8
"SpeedFan" = SpeedFan (remove only)
"Sprach-Verzerrer 1" = Sprach-Verzerrer 1
"the Renegade mod tools" = the Renegade mod tools
"TmNationsForever_is1" = TmNationsForever Update 2010-03-15
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.16
"VLC media player" = VLC media player 1.0.5
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite_Wave3" = Windows Live Essentials
"Zattoo4" = Zattoo4 4.0.5
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"PhotoZoom Pro 3" = BenVista PhotoZoom Pro 3.0.2
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

Danke dir für deine Hilfe!

markusg · 25.07.2010, 15:28

avira

avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

20.07.2010, 16:27	#2
markusg /// Malware-holic	Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!] führe doch erst mal ein Malwarebytes update aus und mache einen komplett scan. lösche die funde, poste das log. weist du noch die seite, auf der du dir das eingefangen hast? wenn ja, per persönlicher nachicht an mich. __________________

20.07.2010, 18:37	#4
markusg /// Malware-holic	Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!] ok. dann weiter hiermit: bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix und beantworte noch die frage wo dus her haben könntest

20.07.2010, 19:59	#6
markusg /// Malware-holic	Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!] versuche windows mal im abgesicherten modus zu starten, sollte mit der f8-taste zu erreichen sein, dort den Malwarebytes komplett scan ausführen, funde löschen, log posten

22.07.2010, 14:04	#8
markusg /// Malware-holic	Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!] ok. schau doch mal bitte ob du otl zum laufen bekommst, erst im normalen modus, wenn nicht, abgesicherter modus. logs posten

25.07.2010, 15:28	#11
markusg /// Malware-holic	Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!] avira avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm. klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!]

Plagegeister aller Art und deren Bekämpfung: Antivir Solution Pro entfernt - PC langsam - [OTL abgestürzt!]