| |
| |||||||
Log-Analyse und Auswertung: CPU Auslastung 100% (Seven Gold Soft Version 2011)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.11.2010, 20:09
| #16 |
 |  CPU Auslastung 100% (Seven Gold Soft Version 2011) Soll ich mein aktuelles Avira erst deinstallieren, oder die neue Installation einfach draufpacken? EDIT// Muss ich ja nicht, ich führe mal die Konfiguration durch. |
|
21.11.2010, 20:16
| #17 |
| /// Malware-holic   | CPU Auslastung 100% (Seven Gold Soft Version 2011) deinstaliere es mal bitte, irgendwas stimmt da mit dem avira treiber nicht, nutze auch das removal tool.
__________________
__________________ |
|
21.11.2010, 20:26
| #18 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011) Removal Tool?
__________________ |
|
21.11.2010, 20:33
| #19 |
| /// Malware-holic | CPU Auslastung 100% (Seven Gold Soft Version 2011) in meinem tutorial ist zum avira uninstall tool verlinkt.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
21.11.2010, 22:48
| #20 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011) Achso, alles klaro. Also für Leute die es nicht sofort finden sollten. Auf der Avira Supportseite runterscrollen: Support Tools (...zu den Tools)-->Support Tool Download-->Avira AntiVir Removal Tool Also, das Removal Tool hat nichts mehr gefunden. Avira deinstalliert und neu installiert, alle Einstellungen vorgenommen laut Anleitung. Mir ist aufgefallen, das ich einen Ordner habe der nicht SysNative heisst, sondern SysWOW64. Da sind u.a. folgende Dateien drin: C:\Windows\SysWOW64\drivers... avgntdd.sys und avgntmgr.sys |
|
23.11.2010, 14:55
| #21 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011) Ich bekomme gleich einen Anfall. Jetzt sind schon wieder die Sachen aufgetaucht... diesmal heisst es GOLD SOFT VERSION 2011. ~_~ Anbei ein Hijack Log: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:54:05, on 23.11.2010 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18975) Boot mode: Normal Running processes: C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files (x86)\USB_video_device\Driver\Driver32\emmon.exe C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe C:\Program Files (x86)\FreePDF_XP\fpassist.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Users\Taner\piuinu.exe C:\Windows\SysWOW64\conime.exe C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\Taner\AppData\Local\Temp\Mzg.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Users\Taner\AppData\Local\Temp\Mzi.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Users\Taner\AppData\Local\Temp\Mzh.exe C:\Users\Taner\Desktop\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter O4 - HKLM\..\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\RunOnce: [Launcher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Google Update] "C:\Users\Taner\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [piuinu] C:\Users\Taner\piuinu.exe /a O4 - HKCU\..\Run: [Metropolis] rundll32.exe C:\Users\Taner\AppData\Local\Temp\sshnas21.dll,GetHandle O4 - HKCU\..\Run: [UO8KTAT1GY] C:\Users\Taner\AppData\Local\Temp\Mzh.exe O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: emMon.lnk = ? O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta O8 - Extra context menu item: Display Toolbar and Menubar - C:\Program Files (x86)\IEInspector\IEWebDeveloperV2\cmd_display.html O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Taner\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: IE WebDeveloper V2 - {D851CEE8-86A0-440C-B8F4-DA7DA99B5765} - C:\PROGRA~2\IEINSP~1\IEWEBD~1\IEWEBD~1.DLL O9 - Extra 'Tools' menuitem: IE WebDeveloper V2 - {D851CEE8-86A0-440C-B8F4-DA7DA99B5765} - C:\PROGRA~2\IEINSP~1\IEWEBD~1\IEWEBD~1.DLL O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: AccSys WiFi Component (accsvc) - AccSys GmbH - C:\Program Files (x86)\Common Files\AccSys\accsvc.exe O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Unknown owner - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe (file missing) O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: Kbdsvccidxp - Unknown owner - drv.sys (file missing) O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMSAccessU - Unknown owner - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe O23 - Service: Audio Service (STacSV) - Unknown owner - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: XobniService - Xobni Corporation - C:\Program Files (x86)\Xobni\XobniService.exe O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing) -- End of file - 13168 bytes Hier nochmals die Log von Malewarebyte: Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 5163
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18975
23.11.2010 15:15:11
mbam-log-2010-11-23 (15-15-11).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 143606
Laufzeit: 7 Minute(n), 2 Sekunde(n)
Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 9
Infizierte Speicherprozesse:
C:\Users\Taner\piuinu.exe (Worm.SFDC) -> No action taken.
Infizierte Speichermodule:
C:\Users\Taner\AppData\Local\Temp\sshnas21.dll (Trojan.FraudPack) -> No action taken.
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\6BTOP2GA8A (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metropolis (Trojan.FraudPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uo8ktat1gy (Trojan.FraudPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\piuinu (Worm.SFDC) -> No action taken.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\Users\Taner\AppData\Local\Temp\sshnas21.dll (Trojan.FraudPack) -> No action taken.
C:\Users\Taner\AppData\Local\Temp\Mzh.exe (Trojan.FraudPack) -> No action taken.
C:\Users\Taner\AppData\Local\Temp\Mzf.exe (Trojan.FraudPack) -> No action taken.
C:\Users\Taner\AppData\Local\Temp\Mzg.exe (Trojan.FraudPack) -> No action taken.
C:\Users\Taner\AppData\Local\Temp\Mzi.exe (Trojan.FraudPack) -> No action taken.
C:\Users\Taner\piuinu.exe (Worm.SFDC) -> No action taken.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> No action taken.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> No action taken.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> No action taken.
Geändert von Buddy (23.11.2010 um 15:16 Uhr) |
|
23.11.2010, 15:33
| #22 |
| /// Malware-holic | CPU Auslastung 100% (Seven Gold Soft Version 2011) auf irgendwelchen seiten unterwegs gewesen die nicht ganz koscha sind, porno websites, streaming usw.?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
23.11.2010, 15:38
| #23 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011) Nein, deshalb wundert es mich ja stark, aber wenn du es so erwähnst, benutzt der Sohnemann auch mein Laptop - zwar nicht oft, aber oft genug anscheinend (will jetzt keine falschen Anschuldigen machen, aber anders kann ich es mir nicht erklären). Hab Malewarebytes ausgeführt und die Funde löschen lassen inklusive Neustart - ich beobachte jetzt seit ca. 15 Minuten via Taskmanager das Geschehen und es öffnen sich keine dubiosen Prozesse - scheint diesmal Malewarebytes ordentlich gelöscht zu haben, da beim letzten Mal Malewarebystes es nicht gelöscht hatte. Kann es so erstmal bleiben, oder muss (oder sollte) ich noch etwas ausführen? |
|
23.11.2010, 15:49
| #24 |
| /// Malware-holic | CPU Auslastung 100% (Seven Gold Soft Version 2011) bitte poste mal eine neue otl.txt nach neustart.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
23.11.2010, 16:10
| #25 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011)Code:
ATTFilter OTL logfile created on: 23.11.2010 15:50:57 - Run 3 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Taner\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18975) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 78,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 134,36 Gb Total Space | 20,44 Gb Free Space | 15,22% Space Free | Partition Type: NTFS Drive E: | 14,65 Gb Total Space | 6,48 Gb Free Space | 44,27% Space Free | Partition Type: NTFS Drive H: | 966,59 Mb Total Space | 85,43 Mb Free Space | 8,84% Space Free | Partition Type: FAT32 Computer Name: TANER-PC | User Name: Taner | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Users\Taner\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS) PRC - C:\Program Files (x86)\Xobni\XobniService.exe (Xobni Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe () PRC - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe () PRC - C:\Program Files (x86)\USB_video_device\Driver\Driver32\emmon.exe (eMPIA Technology, Inc.) PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) PRC - C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe () PRC - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software) PRC - C:\Program Files (x86)\Common Files\AccSys\accsvc.exe (AccSys GmbH) ========== Modules (SafeList) ========== MOD - C:\Users\Taner\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll () SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe () SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe () SRV:64bit: - (wltrysvc) -- C:\Windows\SysNative\WLTRYSVC.EXE () SRV:64bit: - (yksvc) -- C:\Windows\SysNative\rundll32.exe () SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS) SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe () SRV - (XobniService) -- C:\Program Files (x86)\Xobni\XobniService.exe (Xobni Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (NMSAccessU) -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe () SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (Macromedia Licensing Service) -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe () SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) SRV - (DockLoginService) -- C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe () SRV - (StarWindServiceAE) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software) SRV - (accsvc) -- C:\Program Files (x86)\Common Files\AccSys\accsvc.exe (AccSys GmbH) ========== Driver Services (SafeList) ========== DRV:64bit: - (WPRO_40_1340) WinPcap Packet Driver (WPRO_40_1340) -- C:\Windows\SysNative\drivers\WPRO_40_1340.sys File not found DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found DRV:64bit: - (libusb0) -- C:\Windows\SysNative\drivers\libusb0.sys File not found DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys () DRV:64bit: - (tap0901) -- C:\Windows\SysNative\DRIVERS\tap0901.sys () DRV:64bit: - (avipbb) -- C:\Windows\SysNative\DRIVERS\avipbb.sys () DRV:64bit: - (MotioninJoyUSBFilter) -- C:\Windows\SysNative\DRIVERS\MijUfilt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\Drivers\sptd.sys () DRV:64bit: - (USB28xxBGA) -- C:\Windows\SysNative\DRIVERS\emBDA64.sys () DRV:64bit: - (USB28xxOEM) -- C:\Windows\SysNative\DRIVERS\emOEM64.sys () DRV:64bit: - (xusb21) -- C:\Windows\SysNative\DRIVERS\xusb21.sys () DRV:64bit: - (RTSTOR) -- C:\Windows\SysNative\drivers\RTSTOR64.SYS () DRV:64bit: - (igfx) -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys () DRV:64bit: - (STHDA) -- C:\Windows\SysNative\DRIVERS\stwrt64.sys () DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\DRIVERS\Apfiltr.sys () DRV:64bit: - (BCM42RLY) -- C:\Windows\SysNative\drivers\BCM42RLY.sys () DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys () DRV:64bit: - (yukonx64) -- C:\Windows\SysNative\DRIVERS\yk60x64.sys () DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iastor.sys () DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\Drivers\PxHlpa64.sys () DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys () DRV:64bit: - (e1express) Intel(R) -- C:\Windows\SysNative\DRIVERS\e1e6032e.sys () DRV:64bit: - (PAC7302) -- C:\Windows\SysNative\DRIVERS\PAC7302.SYS () DRV:64bit: - (XPADFL02) -- C:\Windows\SysNative\DRIVERS\xpadfl02.sys () DRV:64bit: - (R300) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys () DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof () DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys () DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (DSDrv4AMD64) -- C:\Program Files (x86)\DScaler\DSDrv4amd64.sys () DRV - (adfs) -- C:\Windows\SysWow64\drivers\adfs.sys (Adobe Systems, Inc.) DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.) DRV - (XPADFL02) -- C:\Windows\SysWOW64\drivers\xPADFL02.sys (Compuware Corporation) DRV - (libusb0) -- C:\Windows\SysWOW64\drivers\libusb0.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8 IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3260002145-3714955562-2182217029-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4 FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.30 21:18:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.10.30 21:18:09 | 000,000,000 | ---D | M] [2009.10.02 17:11:39 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Extensions [2010.11.22 16:32:53 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions [2010.11.13 02:48:49 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2010.04.29 07:30:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.06.21 19:44:49 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2010.09.19 12:06:54 | 000,000,000 | ---D | M] (Quick Translator) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{5C655500-E712-41e7-9349-CE462F844B19} [2010.11.15 21:43:41 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} [2010.06.21 19:44:17 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2010.06.25 01:23:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.10.15 18:06:27 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.01.17 11:54:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(60) [2010.07.01 20:55:16 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8} [2010.11.03 13:20:25 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.10.08 20:53:54 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2010.05.29 21:05:40 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2010.11.15 21:43:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2010.11.18 09:22:55 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2010.02.18 21:00:01 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\FasterFox_Lite@BigRedBrent [2010.05.24 23:06:54 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\firebug@software.joehewitt.com [2010.09.05 17:00:05 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\foxyproxy@eric.h.jung [2010.02.16 15:26:35 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\moveplayer@movenetworks.com [2010.11.13 02:48:48 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mozilla\Firefox\Profiles\5lziysr9.default\extensions\qtl.co.il@gmail.com [2010.02.01 02:09:34 | 000,002,108 | ---- | M] () -- C:\Users\Taner\AppData\Roaming\Mozilla\FireFox\Profiles\5lziysr9.default\searchplugins\qtl.xml [2010.10.30 22:06:42 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions [2009.12.06 22:27:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.09.05 23:21:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.30 22:06:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.09.15 03:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll [2010.02.12 15:37:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.02.12 15:37:37 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml [2010.02.12 15:37:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.02.12 15:37:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.02.12 15:37:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.08.30 11:44:17 | 000,001,342 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 adobe.activate.com O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\SysNative\WLTRAY.exe () O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe () O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe () O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe () O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.) O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe (Softthinks) O4 - Startup: C:\Users\Taner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta () O8:64bit: - Extra context menu item: Display Toolbar and Menubar - C:\Program Files (x86)\IEInspector\IEWebDeveloperV2\cmd_display.html () O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Taner\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8:64bit: - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Display Toolbar and Menubar - C:\Program Files (x86)\IEInspector\IEWebDeveloperV2\cmd_display.html () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Taner\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra Button: IE WebDeveloper V2 - {D851CEE8-86A0-440C-B8F4-DA7DA99B5765} - C:\Program Files (x86)\IEInspector\IEWebDeveloperV2\IEWebDeveloperV2.dll (IEInspector Software) O9 - Extra 'Tools' menuitem : IE WebDeveloper V2 - {D851CEE8-86A0-440C-B8F4-DA7DA99B5765} - Reg Error: Value error. File not found O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll () O32 - HKLM CDRom: AutoRun - 1 O32 - Unable to obtain root file information for disk E:\ O32 - Unable to obtain root file information for disk H:\ O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll () SafeBootMin:64bit: AppMgmt - Service SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: mcmscsvc - Service SafeBootMin:64bit: MCODS - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: mcmscsvc - Service SafeBootMin: MCODS - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - Service SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: mcmscsvc - Service SafeBootNet:64bit: MCODS - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: MpfService - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: mcmscsvc - Service SafeBootNet: MCODS - Service SafeBootNet: Messenger - Service SafeBootNet: MpfService - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {0054537B-3C98-3924-FB2E-A337E1A7D6B8} - Themes Setup ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {868A4D73-C5EF-43DE-FA47-966077706B33} - Internet Explorer ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {954FDC3A-6B1F-C716-DA1C-C6D4DE10E5FF} - Themes Setup ActiveX: {A84FD820-EFD7-80C4-0441-2F0C69F468F2} - Internet Explorer ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {D879C23C-3409-699A-8499-95D1FB5D8349} - Browser Customizations ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: {FD0E14D1-5CD4-251C-14BB-8591F2048D5F} - Microsoft VM ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm () Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll () Drivers32: vidc.i420 - C:\Windows\SysWow64\i420vfw.dll (www.helixcommunity.org) Drivers32: vidc.MP42 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation) Drivers32: vidc.MP43 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation) Drivers32: vidc.MPG4 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation) Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation) Drivers32: VIDC.WMV3 - C:\Windows\SysWow64\wmv9vcm.dll (Microsoft Corporation) Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.11.21 22:40:21 | 000,000,000 | ---D | C] -- C:\Users\Taner\AppData\Roaming\Avira [2010.11.21 22:33:49 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\SysWow64\drivers\avgntdd.sys [2010.11.21 22:33:49 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\SysWow64\drivers\avgntmgr.sys [2010.11.21 22:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2010.11.21 22:33:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2010.11.21 22:04:02 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\RE-RPG (Forum) [2010.11.21 16:07:32 | 000,000,000 | ---D | C] -- C:\_OTL [2010.11.21 00:45:03 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Taner\Desktop\OTL.exe [2010.11.20 21:59:51 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Taner\Desktop\HiJackThis204.exe [2010.11.19 18:44:44 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\Biohazard Archive 2 - Ordner [2010.11.18 13:51:04 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\wesker_theme [2010.11.18 12:12:11 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msshsq.dll [2010.11.18 12:00:10 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll [2010.11.18 12:00:09 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll [2010.11.18 12:00:08 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll [2010.11.18 11:49:30 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\rev2_theme [2010.11.16 23:18:49 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\jill2_theme [2010.11.13 01:07:11 | 000,000,000 | ---D | C] -- C:\Users\Taner\Desktop\PSP INHALT [2010.10.30 22:10:42 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2010.10.30 22:10:42 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2010.10.30 22:10:41 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2010.10.30 22:10:41 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2010.10.30 22:10:40 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2010.10.30 22:10:40 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2010.10.30 22:10:40 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2010.10.30 22:10:40 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe [2010.10.30 22:10:40 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2010.10.30 22:10:40 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2010.10.30 22:10:40 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2010.10.30 22:10:40 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2010.10.30 22:10:40 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2010.10.30 22:10:40 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2010.10.30 22:10:26 | 010,624,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll [2010.10.30 22:10:24 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL [2010.10.30 22:09:37 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll [2010.10.30 22:09:37 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll [2010.10.30 22:09:25 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll [2010.10.30 22:09:25 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll [2010.10.30 22:08:43 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll [2010.10.30 22:08:43 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll [2010.10.30 22:08:39 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll [2010.10.30 22:06:40 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.10.30 22:06:40 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.10.30 22:06:40 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.10.30 22:02:48 | 000,866,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll [2010.10.29 16:02:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJScan [2010.10.29 16:02:44 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJ [2010.10.29 16:01:17 | 000,000,000 | ---D | C] -- C:\Users\Taner\AppData\Roaming\Canon [2010.10.29 15:47:12 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJSolutionMenu [2010.10.29 15:47:00 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJPLM [2010.10.29 15:45:51 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\CANON [2010.10.29 15:44:39 | 000,000,000 | -H-D | C] -- C:\Windows\SysNative\CanonIJ Uninstaller Information [2010.10.29 15:34:03 | 000,000,000 | -H-D | C] -- C:\Programme\CanonBJ ========== Files - Modified Within 30 Days ========== [2010.11.23 15:43:39 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7672CC44-7C72-4067-8D28-BC9EABBFD706}.job [2010.11.23 15:26:38 | 001,453,908 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.11.23 15:26:38 | 000,632,242 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.11.23 15:26:38 | 000,598,900 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.11.23 15:26:38 | 000,127,472 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.11.23 15:26:38 | 000,104,914 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.11.23 15:23:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3260002145-3714955562-2182217029-1000UA.job [2010.11.23 15:20:29 | 000,000,432 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics [2010.11.23 15:20:08 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.11.23 15:20:08 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.11.23 15:19:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.11.23 15:19:53 | 4253,405,184 | -HS- | M] () -- C:\hiberfil.sys [2010.11.23 14:35:06 | 000,021,642 | ---- | M] () -- C:\Users\Taner\Desktop\Unbenannt-2.jpg [2010.11.22 22:35:04 | 000,083,120 | ---- | M] () -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.11.22 00:23:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3260002145-3714955562-2182217029-1000Core.job [2010.11.22 00:00:58 | 000,005,028 | ---- | M] () -- C:\Users\Taner\Desktop\fightMainM.png [2010.11.21 21:59:17 | 000,053,951 | ---- | M] () -- C:\Users\Taner\Desktop\arena.png [2010.11.21 13:35:00 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Taner\Desktop\OTL.exe [2010.11.20 21:59:52 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Taner\Desktop\HiJackThis204.exe [2010.11.19 11:06:59 | 000,016,896 | ---- | M] () -- C:\Users\Taner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.11.19 10:23:19 | 003,129,648 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.11.15 21:07:33 | 000,606,700 | ---- | M] () -- C:\Users\Taner\Desktop\seth_avatar.psd [2010.11.14 22:06:35 | 001,201,314 | ---- | M] () -- C:\Users\Taner\Desktop\mgs_pw_signatur_seb.psd [2010.11.14 21:47:12 | 001,016,226 | ---- | M] () -- C:\Users\Taner\Desktop\mgs_pw_avatar_seb.psd [2010.11.07 21:59:03 | 249,608,142 | R--- | M] () -- C:\Users\Taner\Desktop\Pachislot_Biohazard_Promo.divx ========== Files Created - No Company Name ========== [2010.11.23 14:35:05 | 000,021,642 | ---- | C] () -- C:\Users\Taner\Desktop\Unbenannt-2.jpg [2010.11.21 23:21:22 | 000,005,028 | ---- | C] () -- C:\Users\Taner\Desktop\fightMainM.png [2010.11.21 22:33:49 | 000,116,568 | ---- | C] () -- C:\Windows\SysNative\drivers\avipbb.sys [2010.11.21 22:33:49 | 000,083,120 | ---- | C] () -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.11.21 21:59:16 | 000,053,951 | ---- | C] () -- C:\Users\Taner\Desktop\arena.png [2010.11.20 21:48:00 | 4253,405,184 | -HS- | C] () -- C:\hiberfil.sys [2010.11.18 12:12:11 | 000,316,416 | ---- | C] () -- C:\Windows\SysNative\msshsq.dll [2010.11.15 20:50:45 | 000,606,700 | ---- | C] () -- C:\Users\Taner\Desktop\seth_avatar.psd [2010.11.14 21:43:02 | 001,201,314 | ---- | C] () -- C:\Users\Taner\Desktop\mgs_pw_signatur_seb.psd [2010.11.14 21:37:41 | 001,016,226 | ---- | C] () -- C:\Users\Taner\Desktop\mgs_pw_avatar_seb.psd [2010.11.07 21:59:03 | 249,608,142 | R--- | C] () -- C:\Users\Taner\Desktop\Pachislot_Biohazard_Promo.divx [2010.10.30 22:11:38 | 000,002,048 | ---- | C] () -- C:\Windows\SysNative\tzres.dll [2010.10.30 22:10:53 | 001,923,584 | ---- | C] () -- C:\Windows\SysNative\ole32.dll [2010.10.30 22:10:48 | 009,257,472 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll [2010.10.30 22:10:45 | 012,474,368 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll [2010.10.30 22:10:42 | 001,486,848 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll [2010.10.30 22:10:42 | 001,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll [2010.10.30 22:10:42 | 000,710,656 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll [2010.10.30 22:10:42 | 000,479,232 | ---- | C] () -- C:\Windows\SysNative\html.iec [2010.10.30 22:10:41 | 002,335,744 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll [2010.10.30 22:10:41 | 001,062,912 | ---- | C] () -- C:\Windows\SysNative\mstime.dll [2010.10.30 22:10:41 | 000,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll [2010.10.30 22:10:41 | 000,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll [2010.10.30 22:10:41 | 000,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll [2010.10.30 22:10:41 | 000,096,768 | ---- | C] () -- C:\Windows\SysNative\mshtmled.dll [2010.10.30 22:10:41 | 000,056,832 | ---- | C] () -- C:\Windows\SysNative\licmgr10.dll [2010.10.30 22:10:40 | 001,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl [2010.10.30 22:10:40 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll [2010.10.30 22:10:40 | 000,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe [2010.10.30 22:10:40 | 000,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll [2010.10.30 22:10:40 | 000,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll [2010.10.30 22:10:40 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll [2010.10.30 22:10:40 | 000,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll [2010.10.30 22:10:40 | 000,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe [2010.10.30 22:10:40 | 000,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll [2010.10.30 22:10:40 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe [2010.10.30 22:10:39 | 001,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb [2010.10.30 22:10:30 | 013,425,152 | ---- | C] () -- C:\Windows\SysNative\wmp.dll [2010.10.30 22:10:24 | 008,147,968 | ---- | C] () -- C:\Windows\SysNative\wmploc.DLL [2010.10.30 22:09:37 | 000,032,256 | ---- | C] () -- C:\Windows\SysNative\Apphlpdm.dll [2010.10.30 22:09:36 | 004,240,384 | ---- | C] () -- C:\Windows\SysNative\GameUXLegacyGDFs.dll [2010.10.30 22:09:33 | 002,751,488 | ---- | C] () -- C:\Windows\SysNative\win32k.sys [2010.10.30 22:09:25 | 000,461,824 | ---- | C] () -- C:\Windows\SysNative\drivers\srv.sys [2010.10.30 22:09:25 | 000,179,712 | ---- | C] () -- C:\Windows\SysNative\srvsvc.dll [2010.10.30 22:09:25 | 000,175,104 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys [2010.10.30 22:09:25 | 000,144,896 | ---- | C] () -- C:\Windows\SysNative\drivers\srvnet.sys [2010.10.30 22:09:25 | 000,017,920 | ---- | C] () -- C:\Windows\SysNative\netevent.dll [2010.10.30 22:09:25 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\sscore.dll [2010.10.30 22:08:49 | 000,633,856 | ---- | C] () -- C:\Windows\SysNative\comctl32.dll [2010.10.30 22:08:39 | 000,189,952 | ---- | C] () -- C:\Windows\SysNative\t2embed.dll [2010.10.30 22:08:36 | 000,343,040 | ---- | C] () -- C:\Windows\SysNative\schannel.dll [2010.10.30 22:02:48 | 001,090,048 | ---- | C] () -- C:\Windows\SysNative\wmpmde.dll [2010.10.29 15:34:04 | 000,677,888 | ---- | C] () -- C:\Windows\SysNative\CNQ2413L.DLL [2010.10.29 15:34:04 | 000,229,888 | ---- | C] () -- C:\Windows\SysNative\CNQ2413O.DLL [2010.10.29 15:34:04 | 000,092,672 | ---- | C] () -- C:\Windows\SysNative\CNQ2413I.DLL [2010.10.29 15:34:03 | 001,354,240 | ---- | C] () -- C:\Windows\SysNative\CNQ2413C.DLL [2010.10.17 18:26:31 | 001,449,296 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.10.17 18:26:28 | 000,000,106 | ---- | C] () -- C:\Users\Taner\AppData\Local\xobni_installer_updater.log [2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2010.07.19 03:51:45 | 000,000,732 | ---- | C] () -- C:\Users\Taner\AppData\Local\d3d9caps64.dat [2010.03.09 12:01:03 | 000,007,168 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2010.02.26 19:36:48 | 000,197,874 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_depcheck_NETFX_EXP_35.txt [2010.02.26 19:36:42 | 000,193,476 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_dotnetfx35install.txt [2010.02.26 19:36:42 | 000,000,002 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_dotnetfx35error.txt [2010.02.19 12:57:35 | 000,422,130 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistMSI2CD6.txt [2010.02.19 12:57:35 | 000,011,694 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistUI2CD6.txt [2010.01.29 21:05:22 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2010.01.24 03:00:39 | 000,076,407 | ---- | C] () -- C:\Users\Taner\AppData\Roaming\Smiley.ico [2010.01.20 10:46:35 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll [2010.01.19 18:04:54 | 000,007,197 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_depcheck_NETFX20_EXP_35.txt [2010.01.19 18:04:51 | 000,025,456 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_dotnetfx20install.txt [2010.01.19 18:04:51 | 000,006,004 | ---- | C] () -- C:\Users\Taner\AppData\Local\uxeventlog.txt [2010.01.19 18:04:51 | 000,000,754 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_dotnetfx20error.txt [2010.01.01 10:08:09 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.12.17 13:31:40 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2009.12.04 01:02:23 | 000,000,176 | ---- | C] () -- C:\Users\Taner\AppData\Roaming\default.rss [2009.11.25 13:26:27 | 000,003,330 | ---- | C] () -- C:\Users\Taner\AppData\Roaming\wklnhst.dat [2009.11.18 10:01:26 | 000,000,680 | ---- | C] () -- C:\Users\Taner\AppData\Local\d3d9caps.dat [2009.11.16 23:21:49 | 000,333,746 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistMSI0BF9.txt [2009.11.16 23:21:49 | 000,011,142 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistUI0BF9.txt [2009.11.16 20:24:44 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2009.11.14 15:02:39 | 000,000,566 | ---- | C] () -- C:\Windows\SysWow64\SP7302.INI [2009.10.27 00:15:55 | 000,000,314 | ---- | C] () -- C:\Windows\SysWow64\Remover.ini [2009.10.23 17:32:12 | 000,000,552 | ---- | C] () -- C:\Users\Taner\AppData\Local\d3d8caps.dat [2009.10.15 16:48:52 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2009.10.15 16:31:17 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2009.10.04 21:20:14 | 000,033,792 | ---- | C] () -- C:\Windows\SysWow64\drivers\libusb0.sys [2009.10.03 01:36:43 | 000,421,346 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistMSI373C.txt [2009.10.03 01:36:43 | 000,012,306 | ---- | C] () -- C:\Users\Taner\AppData\Local\dd_vcredistUI373C.txt [2009.10.02 21:05:13 | 000,016,896 | ---- | C] () -- C:\Users\Taner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.01.21 03:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini [2008.01.21 03:49:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2007.01.23 09:26:58 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\GTTunerCard.dll [2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\SysWow64\SP207.ini [2004.07.29 01:19:46 | 000,175,104 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll [2003.06.28 13:34:20 | 000,069,707 | ---- | C] () -- C:\Windows\SysWow64\DISP_OPT1.dll [2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI ========== LOP Check ========== [2010.10.17 18:25:22 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\.purple [2010.11.21 16:07:35 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\AC1A12E8268861D57F5D40C7B092D34B [2010.01.13 03:02:47 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\AnvSoft [2010.01.19 18:23:27 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Autodesk [2010.02.04 16:55:38 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\avidemux [2010.06.27 21:05:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\BOM [2010.03.09 12:01:23 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Canneverbe Limited [2010.10.29 16:03:49 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Canon [2010.04.10 11:31:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\com.allergie.pollenflug.3050FB5128FEC1DEC54E712B37D3D876472C4367.1 [2010.05.29 21:17:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\com.doubleperfect.ggpo.0753AD3679DBFCA1E7F470171B7D0DB8B404A7EA.1 [2010.03.16 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DeepBurner [2009.10.24 15:02:48 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DScaler4 [2010.06.25 01:23:31 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DVDVideoSoftIEHelpers [2010.04.29 10:06:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\elsterformular [2009.10.15 18:22:41 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\FireShot [2009.12.06 22:28:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\ICQ [2010.11.21 01:04:37 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\IrfanView [2009.11.12 22:16:04 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\MotioninJoy [2009.10.06 22:58:42 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\NoNameScript [2009.12.09 12:57:25 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Opera [2010.09.30 20:05:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Raptr [2010.02.19 12:57:25 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Sony [2010.02.19 12:57:58 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Sony Setup [2010.02.08 15:49:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Supercade [2009.11.25 13:26:29 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Template [2010.10.17 18:28:12 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Trillian [2010.01.24 16:16:59 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\TuneUp Software [2010.11.21 01:04:37 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\uTorrent [2009.11.02 23:33:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\WebcamMax [2010.11.23 15:19:13 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.11.23 15:43:39 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{7672CC44-7C72-4067-8D28-BC9EABBFD706}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.10.17 18:25:22 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\.purple [2010.11.21 16:07:35 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\AC1A12E8268861D57F5D40C7B092D34B [2010.11.23 14:51:19 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Adobe [2010.01.13 03:02:47 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\AnvSoft [2010.01.19 18:23:27 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Autodesk [2010.02.04 16:55:38 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\avidemux [2010.11.21 22:40:21 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Avira [2010.06.27 21:05:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\BOM [2010.03.09 12:01:23 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Canneverbe Limited [2010.10.29 16:03:49 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Canon [2010.04.10 11:31:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\com.allergie.pollenflug.3050FB5128FEC1DEC54E712B37D3D876472C4367.1 [2010.05.29 21:17:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\com.doubleperfect.ggpo.0753AD3679DBFCA1E7F470171B7D0DB8B404A7EA.1 [2010.08.25 22:47:30 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\CyberLink [2010.03.16 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DeepBurner [2009.10.02 15:06:26 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Dell [2009.10.24 15:02:48 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DScaler4 [2010.04.10 07:37:51 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\dvdcss [2010.06.25 01:23:31 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\DVDVideoSoftIEHelpers [2010.04.29 10:06:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\elsterformular [2009.10.23 10:15:49 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\FastStone [2009.10.15 18:22:41 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\FireShot [2009.12.06 22:28:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\ICQ [2009.10.02 15:04:47 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Identities [2009.10.14 13:37:31 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\InstallShield [2010.11.21 01:04:37 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\IrfanView [2009.10.03 00:55:04 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Macromedia [2010.07.19 04:00:17 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Malwarebytes [2006.11.02 16:07:25 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Media Center Programs [2010.09.30 11:25:28 | 000,000,000 | --SD | M] -- C:\Users\Taner\AppData\Roaming\Microsoft [2010.06.20 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\mIRC [2009.11.12 22:16:04 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\MotioninJoy [2010.02.18 19:20:33 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Move Networks [2009.10.02 17:11:39 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Mozilla [2010.05.25 18:45:07 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Nero [2009.10.06 22:58:42 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\NoNameScript [2009.12.09 12:57:25 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Opera [2010.11.21 01:04:37 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\PSpad [2010.09.30 20:05:11 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Raptr [2010.01.01 10:08:08 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\skypePM [2010.02.19 12:57:25 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Sony [2010.02.19 12:57:58 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Sony Setup [2010.02.08 15:49:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Supercade [2009.11.25 13:26:29 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Template [2010.10.17 18:28:12 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\Trillian [2010.01.24 16:16:59 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\TuneUp Software [2010.11.21 01:04:37 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\uTorrent [2010.11.09 16:36:14 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\vlc [2009.11.02 23:33:50 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\WebcamMax [2009.10.03 00:44:58 | 000,000,000 | ---D | M] -- C:\Users\Taner\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2009.02.12 19:37:34 | 000,097,144 | ---- | M] () -- C:\Users\Taner\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe [2010.02.18 19:20:33 | 000,034,062 | ---- | M] () -- C:\Users\Taner\AppData\Roaming\Move Networks\ie_bin\Uninst.exe [2010.02.04 21:16:22 | 000,040,960 | ---- | M] () -- C:\Users\Taner\AppData\Roaming\Mozilla\Firefox\Profiles\5lziysr9.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe [2010.04.18 13:33:56 | 000,307,200 | ---- | M] (Simon Tatham) -- C:\Users\Taner\AppData\Roaming\Mozilla\Firefox\Profiles\5lziysr9.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe [2010.04.18 13:33:56 | 000,172,032 | ---- | M] (Simon Tatham) -- C:\Users\Taner\AppData\Roaming\Mozilla\Firefox\Profiles\5lziysr9.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe [2010.09.24 03:25:08 | 003,827,696 | ---- | M] () -- C:\Users\Taner\AppData\Roaming\Raptr\raptr-update-1.1.13-to-1.1.15-r43712-release.exe [2010.02.19 12:58:38 | 032,494,896 | ---- | M] (Apple Inc.) -- C:\Users\Taner\AppData\Roaming\Sony Setup\9234765D-29DF-48d0-93FB-284B7B6009B9\QuickTimeInstaller.exe [2010.02.07 22:46:34 | 006,544,384 | ---- | M] (Damdai) -- C:\Users\Taner\AppData\Roaming\Supercade\Supercade.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.19 09:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\drivers\AGP440.sys [2008.01.19 09:09:09 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\DriverStore\FileRepository\machine.inf_f5ca717d\AGP440.sys [2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys < MD5 for: ATAPI.SYS > [2008.01.19 09:07:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\drivers\atapi.sys [2008.01.19 09:07:46 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\DriverStore\FileRepository\mshdc.inf_2a832bf7\atapi.sys [2008.01.21 03:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys [2009.04.30 11:21:29 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=5EB9EF6EEC5D873E94992095A1719BF6 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_39c3f1ccf31998cb\atapi.sys [2009.04.30 11:21:29 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=F988BB0690CD660318037908E9B8DBF7 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_393a5501d9fbf901\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\cngaudit.dll [2008.01.19 12:11:13 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6001.18000_none_448286a8e7f1eef0\cngaudit.dll [2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2010.01.27 14:55:24 | 000,024,576 | ---- | M] () MD5=BF4811EDD902692339C135DCFB26F2AB -- C:\Perl64\lib\auto\Win32\EventLog\EventLog.dll < MD5 for: EXPLORER.EXE > [2009.04.30 11:48:37 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe [2009.04.30 11:48:36 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\SysWOW64\explorer.exe [2009.04.30 11:48:36 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\SysWOW64\explorer.exe [2009.04.30 11:48:36 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe [2009.04.30 11:48:37 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe [2009.04.30 11:48:36 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe [2009.04.30 11:48:36 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe [2009.04.30 11:48:36 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\explorer.exe [2009.04.30 11:48:36 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe [2009.04.30 11:48:35 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe [2009.04.30 11:48:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe [2008.01.21 03:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe [2008.01.21 03:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe < MD5 for: IASTOR.SYS > [2008.06.14 23:12:08 | 000,395,800 | ---- | M] (Intel Corporation) MD5=0B6C9C8F2E00E8B61C8379E62A9F921B -- C:\Drivers\storage\R228145\f6flpy64\IaStor.sys [2008.06.15 12:12:08 | 000,395,800 | ---- | M] (Intel Corporation) MD5=0B6C9C8F2E00E8B61C8379E62A9F921B -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys [2008.06.15 12:11:58 | 000,318,488 | ---- | M] (Intel Corporation) MD5=692830B048AACD7E0D6EDEDF098ACC01 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys < MD5 for: IASTORV.SYS > [2008.01.19 09:11:31 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\drivers\iaStorV.sys [2008.01.19 09:11:31 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\DriverStore\FileRepository\iastorv.inf_6e60dfcd\iaStorV.sys [2008.01.21 03:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys < MD5 for: NETLOGON.DLL > [2008.01.19 09:03:01 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\netlogon.dll [2008.01.19 12:11:16 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll [2008.01.21 03:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll [2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SysWOW64\netlogon.dll [2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SysWOW64\netlogon.dll [2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll < MD5 for: NVSTOR.SYS > [2008.01.19 09:08:50 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\drivers\nvstor.sys [2008.01.19 09:08:50 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\DriverStore\FileRepository\nvraid.inf_fbac0125\nvstor.sys [2008.01.21 03:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SysWOW64\scecli.dll [2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SysWOW64\scecli.dll [2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll [2008.01.19 09:03:55 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\scecli.dll [2008.01.19 12:10:33 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll [2008.01.21 03:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll < MD5 for: USER32.DLL > [2008.01.19 09:04:23 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\user32.dll [2008.01.19 12:09:52 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll [2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\SysWOW64\user32.dll [2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\SysWOW64\user32.dll [2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll [2008.01.21 03:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe [2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe [2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2008.01.19 09:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\userinit.exe [2008.01.19 12:10:31 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe [2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe < MD5 for: WINLOGON.EXE > [2008.01.19 09:00:45 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\winlogon.exe [2008.01.19 12:10:32 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe [2008.01.21 03:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe [2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SysWOW64\winlogon.exe [2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SysWOW64\winlogon.exe [2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.19 07:37:47 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\System32\drivers\ws2ifsl.sys [2008.01.19 12:10:27 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\$Recycle.Bin\S-1-5-21-3260002145-3714955562-2182217029-1000\$RNE9IBG\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys [2008.01.21 03:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < End of report > |
|
23.11.2010, 16:53
| #26 |
| /// Malware-holic | CPU Auslastung 100% (Seven Gold Soft Version 2011) sieht gut aus
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
23.11.2010, 16:54
| #27 |
| | CPU Auslastung 100% (Seven Gold Soft Version 2011) Nochmals vielen Dank für den guten Support.  |
|
| Themen zu CPU Auslastung 100% (Seven Gold Soft Version 2011) |
| 32-bit, antivir, antivir guard, auslastung, auslastung 100%, avira, bho, bonjour, canon, cdburnerxp, computer, converter, desktop, excel, firefox, google, hijack, hijack.zones, hijackthis, home, internet explorer, logfile, mozilla, mp3, object, plug-in, software, system, syswow64, usb, vista, windows |
