| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: SystemTool 2011 - und nun?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.01.2011, 18:26
| #1 |
 |  SystemTool 2011 - und nun? Hallo, ich bin schon ganz verzweifelt. Mein Sohn kam heute aus den USA zurück und erzählte mir, an dem PC seines Vaters war so ein komischer Virus und nichts ging mehr. Dann dauerte es 1 Stunde, und er kam zu mir - mit seinem Lappi - und zeigte mir, "genau so sah es bei Papa auch aus". Nichts ging mehr. Ich habe dann mit meinem PC recherchiert und gefunden, dass es sich um Malware handelt. Verschiedene Freeware Programme habe ich probiert - aber keiner erkennt es. Wenn es einer erkennt - muss man das Programm kaufen. Ein Schlem, wer sich dabei denkt, dass die beiden Firmen zusammenarbeiten  .Die manuelle Entfernung, wie sie oft im Web erwähnt wird, traue ich mir nicht zu. Ich bin noch im abgesicherten Modus. Er vermutet übrigens, dass auf dem Chip aus der Kamera seines Vaters etwas drauf gewesen sein muss - denn er hatte hier noch nichts installiert oder so - nur den Chip in den Slot gesteckt, wie bei seinem Vater auch. Kann mir jemand sagen, was ich genau machen muss, um den Mist wieder runterzubekommen? Danke. |
|
09.01.2011, 18:50
| #2 |
| /// Malware-holic   |  SystemTool 2011 - und nun? du bist im abgesicherten modus? bleib gleich dort.
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten.
__________________ |
|
09.01.2011, 19:24
| #3 |
| | SystemTool 2011 - und nun? OK, gemacht. Also:
__________________OTL.TxTOTL Logfile: Code:
ATTFilter OTL logfile created on: 09.01.2011 19:10:51 - Run 1 OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Brandon\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com) SRV - (AVKService) -- C:\Program Files\G Data\AntiVirus\AVK\AVKService.exe (G Data Software AG) SRV - (AVKProxy) -- C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) SRV - (AVKWCtl) -- C:\Program Files\G Data\AntiVirus\AVK\AVKWCtl.exe () SRV - (GDScan) -- C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WisLMSvc) -- C:\Program Files\Launch Manager\WisLMSvc.exe (Wistron Corp.) SRV - (GoogleDesktopManager-022208-143751) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (FSCLBaseUpdaterService) -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe () ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.) DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.) DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.) DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG) DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG) DRV - (GDBehave) -- C:\Windows\system32\drivers\GDBehave.sys (G Data Software AG) DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G DATA Software AG) DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2008.01.12 20:05:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2008.01.12 21:13:26 | 000,000,000 | ---D | M] [2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Extensions [2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Firefox\Profiles\wb3p44e5.default\extensions [2011.01.09 10:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1} [2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG) O4 - HKLM..\Run: [FSCRecovery] c:\Programme\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe (Fujitsu Siemens Computers GmbH) O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( ) O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe () O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WisKeyState] C:\Program Files\Launch Manager\WisKeyState.exe (Wistron Corp.) O4 - HKU\.DEFAULT..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-18..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com) O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe () O7 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\..Trusted Ranges: GD ([http] in Local intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg O24 - Desktop BackupWallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - File not found SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) %SYSTEMROOT%\SYSTEM32\*.DLL /LOCKEDFILES CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2011.01.09 17:44:38 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator [2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Terminator [2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator [2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator [2011.01.09 17:29:15 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch [2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool [2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804 [2011.01.09 15:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment [2011.01.09 15:45:24 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Blizzard Entertainment [2011.01.09 10:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2011.01.09 10:56:03 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\skypePM [2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype [2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.01.09 10:54:16 | 000,000,000 | R--D | C] -- C:\Programme\Skype [2011.01.09 10:54:15 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Skype [2011.01.09 10:54:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.01.09 09:14:36 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD [2011.01.09 09:09:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices [2010.12.26 18:13:51 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll [2010.12.26 18:13:50 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll [2010.12.26 18:13:50 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll [2010.12.26 18:12:33 | 000,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2010.12.26 18:12:33 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll [2010.12.26 18:12:33 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2010.12.26 18:12:33 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll [2010.12.26 18:12:32 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll [2010.12.26 18:12:32 | 001,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2010.12.26 18:12:32 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2010.12.26 18:12:32 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll [2010.12.26 18:12:32 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll [2010.12.26 18:12:32 | 000,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2010.12.26 18:12:32 | 000,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll [2010.12.26 18:12:32 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe [2010.12.26 18:12:32 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll [2010.12.26 18:12:32 | 000,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2010.12.26 18:12:32 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2010.12.26 18:12:32 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2010.12.26 18:12:32 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll [2010.12.26 18:12:32 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2010.12.26 18:12:32 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe [2010.12.26 18:12:32 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2010.12.26 18:12:32 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll [2010.12.26 18:12:32 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2010.12.26 18:12:32 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll [2010.12.26 18:12:32 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2010.12.26 18:12:32 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2010.12.26 18:11:24 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll [2010.12.26 18:11:24 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe [2010.12.26 18:11:23 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll [2010.12.26 18:11:22 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll [2010.12.26 18:11:22 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll [2010.12.26 18:11:22 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll [2010.12.26 18:11:22 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll [2010.12.26 18:11:21 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll [2010.12.26 18:11:21 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll [2010.12.26 18:09:11 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll [2010.12.26 18:09:11 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll [2010.12.26 17:50:09 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe [2010.12.26 17:50:09 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll [2010.12.26 17:50:09 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll [2010.12.26 17:48:38 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [2010.12.26 17:30:46 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll [2010.12.26 17:30:45 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll [2010.12.26 17:29:33 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0 [2010.12.26 16:22:57 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2010.12.26 16:22:34 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll [2010.12.26 16:22:33 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE [2010.12.26 16:22:33 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE [2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE [2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll [2010.12.26 16:22:33 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE [2010.12.26 16:22:33 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe [2010.12.26 16:22:33 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE [2010.12.26 16:22:20 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll [2010.12.26 16:22:20 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll [2010.12.26 16:22:20 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll [2010.12.26 16:22:19 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll [2010.12.26 16:22:11 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll [2010.12.26 16:22:06 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL [2010.12.26 16:22:05 | 002,868,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2010.12.26 16:22:04 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll [2010.12.26 16:22:03 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.12.26 16:21:48 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.12.26 16:21:45 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010.12.26 16:21:39 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl [2010.12.26 16:21:36 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll [2010.12.26 16:21:34 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll [2010.12.26 16:21:34 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll [2010.12.26 16:21:32 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL [2010.12.26 16:21:31 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll [2010.12.26 16:21:29 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll [2010.12.26 16:21:29 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll [2010.12.26 16:21:27 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll [2010.12.26 16:21:16 | 001,259,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll [2010.12.26 16:21:12 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.12.26 16:21:12 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.12.26 16:21:10 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2010.12.26 16:21:09 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010.12.26 16:21:09 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010.12.26 16:21:06 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2010.12.26 16:21:01 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010.12.26 16:21:00 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010.12.26 16:20:59 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010.12.26 16:20:57 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010.12.26 16:20:55 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.12.26 16:20:55 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010.12.26 16:20:55 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.12.26 16:20:55 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll [2010.12.26 16:20:52 | 002,452,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2010.12.26 16:20:48 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.12.26 16:20:48 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.12.26 16:20:47 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.12.26 16:20:47 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.12.26 16:20:47 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.12.26 16:20:47 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2010.12.26 16:20:46 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2010.12.26 16:20:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.12.26 16:20:14 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb [2010.12.26 16:20:14 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb [2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll [2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll [2010.12.26 16:20:10 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe [2010.12.26 16:20:10 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe [2010.12.26 16:20:10 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe [2010.12.26 16:20:09 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe [2010.12.26 16:20:09 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll [2010.12.26 16:20:09 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll [2010.12.26 16:20:09 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll [2010.12.26 16:19:50 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll [2010.12.26 16:19:48 | 000,355,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll [2010.12.26 16:19:22 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll [2010.12.26 16:19:20 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2010.12.26 16:19:19 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvfw32.dll [2010.12.26 16:19:19 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll [2010.12.26 16:19:19 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll [2010.12.26 16:19:17 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL [2010.12.26 16:19:06 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe [2010.12.26 16:19:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll [2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx [2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll [2010.12.26 15:50:06 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010.12.26 15:48:35 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Macromedia [2010.12.25 22:09:21 | 000,029,992 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys [2010.12.25 21:55:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc [2010.12.25 21:54:56 | 000,000,000 | ---D | C] -- C:\Programme\IZArc ========== Files - Modified Within 30 Days ========== [2011.01.09 19:05:43 | 000,620,966 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.01.09 19:05:43 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.01.09 19:05:43 | 000,123,268 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.01.09 19:05:43 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.01.09 18:42:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.01.09 18:40:45 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.09 17:44:46 | 000,000,925 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk [2011.01.09 17:44:39 | 000,142,592 | ---- | M] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2011.01.09 17:02:59 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk [2011.01.09 14:36:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2011.01.09 10:56:46 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2011.01.09 10:56:12 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat [2011.01.09 10:54:17 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2011.01.09 09:12:36 | 000,380,136 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.12.26 16:27:05 | 000,029,992 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys [2010.12.25 22:08:23 | 000,002,631 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Word 2007.lnk [2010.12.25 21:56:48 | 000,002,735 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Outlook 2007.lnk ========== Files Created - No Company Name ========== [2011.01.09 17:44:46 | 000,000,925 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk [2011.01.09 17:44:39 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2011.01.09 16:38:48 | 000,000,772 | ---- | C] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk [2011.01.09 14:36:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2011.01.09 10:56:46 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2011.01.09 10:56:12 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.01.09 10:55:46 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.01.09 10:55:45 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.01.09 10:54:17 | 000,001,880 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2010.12.26 16:22:19 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf [2008.10.22 13:02:51 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys [2008.10.22 13:01:42 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.10.22 12:53:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll [2008.01.12 20:27:13 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2008.01.12 19:30:48 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== LOP Check ========== [2011.01.09 17:46:25 | 000,000,000 | ---D | M] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator [2011.01.09 18:39:16 | 000,009,658 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. > < %APPDATA%\*.exe /s > [2008.01.12 19:30:53 | 000,008,704 | R--- | M] () -- C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}\Icon9A3BC1573.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: AHCIX86S.SYS > [2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\DRIVER\SATA\AMD\ahcix86s.sys [2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\drivers\ahcix86s.sys [2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_c617648e\ahcix86s.sys < MD5 for: ATAPI.SYS > [2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_181d523c\atapi.sys [2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22245_none_dd9b888d3ac35a04\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTOR.SYS > [2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys [2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys [2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_41af7b1f\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll [2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > ========== Alternate Data Streams ========== @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > Extras.Txt OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 09.01.2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Brandon\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS
Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS
Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{099A04C9-9840-40F7-8A67-2ABDE9D9A08E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3E48C035-0396-4DE6-8F0C-956A06124BFC}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{5D1602A8-F88E-44B6-9CAD-672D96FDBFE4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{7D451B0E-3D95-4F83-AFE7-48E7FB21AEC4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{8A51C416-37E4-4620-A8EA-D388962C784F}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{D3DBF350-7B60-4353-B56F-7B66A572CB30}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{EC113663-81B6-48F6-8AE6-52D51DFDEEC1}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{FB55B487-F0AE-432B-968C-601E404181F5}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{FF07C710-2504-4828-842E-C7042B226CCE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{8944A0F0-3A9A-40F3-9A83-8271E89E77BF}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{BA2F84DC-2EC3-4B8D-B0FB-A622D3809D8C}F:\brandon!\wow\blizzard downloader.exe" = protocol=6 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{63C55140-173C-46BF-AE51-C43886711065}F:\brandon!\wow\blizzard downloader.exe" = protocol=17 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{6C36225E-ACBE-4FAB-B84C-1EF73747061E}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{016F5FA1-FD85-FA69-885F-96A03EEEF9C1}" = CCC Help Dutch
"{017C6E75-766C-DE1C-1B48-D0230CB155BC}" = Catalyst Control Center Localization Korean
"{021C8270-F2A6-C941-3A19-EBE139C966E7}" = Catalyst Control Center Graphics Full Existing
"{04FC3DE9-BC19-E2A2-2FB9-24684DA82A36}" = CCC Help Spanish
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05DD3745-0898-FCA7-0A52-689F128B84F9}" = CCC Help French
"{0739951F-27F4-F7FF-C26D-3C44A681933F}" = ccc-utility
"{099F2D26-B862-F04A-FC7B-E7B0B6196CA7}" = CCC Help Chinese Standard
"{0C58BA84-88A3-39FD-61DB-4DF780D1E0B9}" = CCC Help Polish
"{0C8DFC9B-FB65-1444-3E12-9DF64270347A}" = CCC Help Korean
"{139B7164-4C7B-BF85-4CA6-0DD5C611179B}" = Catalyst Control Center Localization Turkish
"{14D68B6D-4C3E-6771-1C77-4384BB653B9E}" = Catalyst Control Center Localization Chinese Traditional
"{22E719FE-F76D-0BF3-229D-7A9337458CD0}" = CCC Help German
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26D421BE-752E-1070-0C26-2DE993ED00B0}" = CCC Help Portuguese
"{2A63E819-5359-62CF-FCDB-3707391A08A0}" = CCC Help Chinese Traditional
"{2F926AE7-9FB7-4B34-906F-9C29A6D146A7}" = SystemDiagnostics
"{31F2D65F-84A8-D3AD-E3AF-DF127860E39E}" = CCC Help Turkish
"{373C3C97-2FA9-4E18-85A2-255060C21031}" = Nero 8 Essentials
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F026B88-D153-93DB-A99B-2A78AFEFF813}" = Catalyst Control Center Localization Polish
"{3F03121C-CA62-D0E1-7957-5C82A4CF3C69}" = Catalyst Control Center Localization Norwegian
"{45A34A3F-3597-AA37-E44B-9B95852055A9}" = CCC Help Swedish
"{4811A487-6830-E60D-CD37-816E46C8988D}" = Catalyst Control Center Localization Portuguese
"{49083280-8601-EF0D-EC78-6A8FD9C54172}" = CCC Help Thai
"{4A5DC837-AD1B-D80E-FDE5-4793DC47F695}" = CCC Help Finnish
"{4AAF1376-9CB5-B232-22EE-D0EE53ED9148}" = Catalyst Control Center Localization Danish
"{4EBE8518-B14F-B69E-082B-E6FB85F6B52E}" = CCC Help Italian
"{4F2E897D-39A4-73B7-6614-F1EC2B43A1B5}" = CCC Help Czech
"{5413DF9C-4FCC-39A1-FB67-6945428DA718}" = Catalyst Control Center Localization Russian
"{55035C7B-61D2-1DC1-EC53-CFD01C3F82F9}" = CCC Help Hungarian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{60DCEC40-8854-B0B5-7828-A6E14DBE71EC}" = Catalyst Control Center Graphics Previews Vista
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DC0B476-B032-83DE-9637-3F6809A344C1}" = Skins
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774715EC-6B2F-092E-0221-B464A80F565A}" = Catalyst Control Center Localization Italian
"{78B1919F-EFDD-5A23-7393-7887C53BE013}" = CCC Help Danish
"{7E1043B7-AA4D-A877-9A26-D1B3E78DF051}" = CCC Help Norwegian
"{81758E18-D5EA-4049-844A-E2DDDDDA9798}" = CCC Help English
"{81794E08-21DA-189A-1DD5-AEDBBE0BE37B}" = CCC Help Russian
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUSR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUSR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROPLUSR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95104E32-1B84-0E33-14BE-BA115643629C}" = Catalyst Control Center Graphics Light
"{9687697B-1055-E1E5-2D31-061CC502AB31}" = ATI Catalyst Install Manager
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{98383302-798D-2089-9143-D64E35D666BD}" = Catalyst Control Center Localization Greek
"{9860F761-0ADB-1149-1A0D-1CBBFD693A3D}" = Catalyst Control Center Localization Finnish
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9D26F264-EFA2-31BB-D49F-380FD60207FA}" = Catalyst Control Center Core Implementation
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A777FF2A-942F-CBB0-C36B-F9B72E95B7D9}" = Catalyst Control Center Localization Czech
"{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}" = G Data AntiVirus 2011
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AFC454ED-A26F-4816-826B-C35129D82E1F}" = Fujitsu Siemens Computers Recovery
"{B1EEB795-48EE-AA3B-7CF9-5CE4B7883792}" = Catalyst Control Center Localization German
"{B3905755-64EC-422E-A4D9-644D6D8FDE5E}" = ccc-core-static
"{B3D068F7-34DD-2BB7-6F2F-D67274819ACC}" = Catalyst Control Center Localization Swedish
"{C698749A-7BB4-BE2A-9551-EC85C8A65E2F}" = CCC Help Greek
"{CA45B622-88F9-4836-A529-DBF14698498D}" = Catalyst Control Center - Branding
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF06DB43-2F14-EA98-AB1B-124FD65A8AEE}" = Catalyst Control Center InstallProxy
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.5.4
"{D21E879C-8400-BEE3-23AB-9399DEF9F7D1}" = Catalyst Control Center Localization Hungarian
"{DCA2E1BC-7FB4-217C-54C6-B99D4EA7FFCF}" = Catalyst Control Center Localization Dutch
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E7B4D6A2-D6B1-29A3-7720-C35599A8718B}" = Catalyst Control Center Localization Thai
"{EBFD0EFA-9AEF-D432-9330-717FE34FB717}" = Catalyst Control Center Localization French
"{ED3B736A-7C2E-35DB-0F33-E8C9CF101662}" = Catalyst Control Center Localization Chinese Standard
"{EECA2BE9-BB32-8E29-3293-536B600B04B4}" = Catalyst Control Center Localization Spanish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2E272DA-CB23-936D-268E-030DE425AD11}" = Catalyst Control Center Graphics Full New
"{F87C6FBE-FBD2-CC11-FF28-AC687D08EDF0}" = CCC Help Japanese
"{FD65BBF8-5EEB-BE96-44E8-5887B035E0F6}" = Catalyst Control Center Localization Japanese
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Picasa2" = Picasa 2
"PROPLUSR" = Microsoft Office Professional Plus 2007
"Spyware Terminator_is1" = Spyware Terminator
"SynTPDeinstKey" = Synaptics Pointing Device Driver
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12.01.2008 14:39:52 | Computer Name = Brandon-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.01.2008 14:41:55 | Computer Name = Brandon-PC | Source = VSS | ID = 8194
Description =
[ System Events ]
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = HTTP | ID = 15016
Description =
Error - 12.01.2008 15:28:20 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139235
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
+54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
funktionsfähig ist.
Error - 12.01.2008 15:50:24 | Computer Name = Brandon-PC | Source = DCOM | ID = 10010
Description =
Error - 12.01.2008 15:57:30 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
Error - 12.01.2008 15:58:05 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139234
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
+54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
funktionsfähig ist.
Error - 26.12.2010 10:37:38 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
< End of report >
....... und nun??? |
|
09.01.2011, 20:00
| #4 |
| /// Malware-holic | SystemTool 2011 - und nun? • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe () [2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch [2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming [2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804 [2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk :Files :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. öffne computer, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.01.2011, 20:07
| #5 |
| | SystemTool 2011 - und nun? Den Rechner dann wieder im angesicherten Modus hochfahren? sonst bekomme ich ja vielleicht keinen Zugang zum Internet. |
|
09.01.2011, 20:08
| #6 |
| /// Malware-holic | SystemTool 2011 - und nun? doch solltest du. falls nicht, im abgesicherten :-)
__________________ --> SystemTool 2011 - und nun? |
|
09.01.2011, 20:19
| #7 |
| | SystemTool 2011 - und nun? All processes killed ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\eFjBp01804 deleted successfully. C:\ProgramData\eFjBp01804\eFjBp01804.exe moved successfully. C:\ProgramData\WindowsSearch\MiniDumps folder moved successfully. C:\ProgramData\WindowsSearch folder moved successfully. C:\Users\Brandon\AppData\Roaming\Spyware Terminator\Reports folder moved successfully. C:\Users\Brandon\AppData\Roaming\Spyware Terminator\LanguageAct folder moved successfully. C:\Users\Brandon\AppData\Roaming\Spyware Terminator folder moved successfully. C:\Users\Brandon\AppData\Roaming\skypePM folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_httpfe folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\production folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\languages folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\fancybox folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\buttons folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\avatarview folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js\languages folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\promotions folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\buttons folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\backgrounds folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\css folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets\promotions folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_html folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\shared_dynco folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\My Skype Received Files folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\voicemail folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\httpfe folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\ff folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\fe folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\dc folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\61 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\3e folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype\graardor2 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Skype folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\minidumps folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\extensions folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\chrome folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\bookmarkbackups folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Crash Reports folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions folder moved successfully. C:\Users\Brandon\AppData\Roaming\Mozilla folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Word\STARTUP folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Word folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Templates folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fujitsu Siemens Computers folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programme folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\SendTo folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Recent folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Printer Shortcuts folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Network Shortcuts folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies\Low folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Windows folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\UProof folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Templates folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My folder moved successfully. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot. C:\Users\Brandon\AppData\Roaming\Microsoft\Proof folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Outlook folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Office\Recent folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Office folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655} folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Installer folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks\1031 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA folder moved successfully. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot. C:\Users\Brandon\AppData\Roaming\Microsoft\AddIns folder moved successfully. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot. C:\Users\Brandon\AppData\Roaming\Media Center Programs folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.daredorm.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mpsnare.iesnare.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.livejasmin.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.6waves.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#freeporn.youngleafs.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chatango.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdnbakmi.kaltura.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer\flowplayer.commercial-3.1.1.swf folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#user folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#ui folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\s.ytimg.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\mpsnare.iesnare.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana\game.swf folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com\#kernelteam folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\chatango.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1\kdp3.swf folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572 folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player folder moved successfully. C:\Users\Brandon\AppData\Roaming\Macromedia folder moved successfully. C:\Users\Brandon\AppData\Roaming\Identities\{E339429E-95C8-4122-ABCE-3B45431A0279} folder moved successfully. C:\Users\Brandon\AppData\Roaming\Identities folder moved successfully. C:\Users\Brandon\AppData\Roaming\ATI\ACE folder moved successfully. C:\Users\Brandon\AppData\Roaming\ATI folder moved successfully. C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache\36AXTJXZ folder moved successfully. C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully. C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player folder moved successfully. C:\Users\Brandon\AppData\Roaming\Adobe folder moved successfully. Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot. Folder C:\ProgramData\eFjBp01804\ not found. C:\Users\Brandon\Desktop\System Tool 2011.lnk moved successfully. ========== FILES ========== ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Brandon User: Default User: Default User User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Brandon ->Temp folder emptied: 64549594 bytes ->Temporary Internet Files folder emptied: 42348258 bytes ->FireFox cache emptied: 85994028 bytes ->Google Chrome cache emptied: 6353877 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 118238874 bytes RecycleBin emptied: 36331389 bytes Total Files Cleaned = 337,00 mb OTL by OldTimer - Version 3.2.20.1 log created on 01092011_201324 Files\Folders moved on Reboot... Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot. Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot. Registry entries deleted on Reboot... Den Rest muss ich mir noch einmal ansehen - was ich da jetzt machen muss... |
|
09.01.2011, 20:30
| #8 |
| /// Malware-holic | SystemTool 2011 - und nun? noch nichts. ich hab nen fehler gemacht. noch nichts, ich hab nen fehler gemacht! öffne mal mein computer. dort öffnest du mal _OTL, dort ist nen ordner mit heutigem datum und den öffnest du ebenfalls. dort findest du doch sicher: C:\Users\Brandon\AppData\Roaming diesen ordner einmal anklicken und mache dann einen rechtsklick, wähle kopieren. der ordner muss dann hier eingefügt werden C:\Users\Brandon\AppData\ also navigiere dort hin, rechtsklick und einfügen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.01.2011, 20:43
| #9 |
| | SystemTool 2011 - und nun? ??? Ich soll den Roaming Ordner aus AppData in AppData einfügen? Das ist doch das gleiche Verzeichnis - oder? Es gibt keinen weiteren AppData Ordner. Oder soll ich ihn in Brandon einfügen - neben AppData ? |
|
09.01.2011, 20:46
| #10 |
| /// Malware-holic | SystemTool 2011 - und nun? wenn du den ordner moved files öffnest, dann den ordner mit heutigem datum findest du dort C:\Users\Brandon\AppData\Roaming und den musst du wieder an seinen ursprungsort einfügen C:\Users\Brandon\AppData\ wenn der ordner C:\Users\Brandon\AppData\ noch vorhanden ist. musst du ihn in moved files öffnen, und den inhalt wieder im original ordner einfügen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.01.2011, 20:56
| #11 |
| | SystemTool 2011 - und nun? Ich steh auf dem Schlauch. Also, ich öffne den Datums-Ordner von heute in moved files Da gibt es 2 Ordner C_ProgramData C_Users In C_Users gibt es den Ordner Brandon - darin AppData - und darin Roaming Und den soll ich jetzt genau Wohin kopieren? |
|
09.01.2011, 21:08
| #12 |
| /// Malware-holic | SystemTool 2011 - und nun? C:\Users\Brandon\AppData\Roaming dort hin. wenn es den ordner Roaming dort bereits gibt. öffnest du ihn jeweils in moved files und im original verzeichniss C:\Users\Brandon\AppData\ und kopierst den inhalt des Roaming von moved files in den original Roaming ordner.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.01.2011, 21:21
| #13 |
| | SystemTool 2011 - und nun? Also in dem regulären Ordner (nicht dem _OTL.....) c:\User\Brandon\ gibt es nur folgende Ordner Bilder Desktop Dokumente Download Favoriten Gespeicherte Spiele Kontakt Links Musik Suchvorgänge Videos Und wenn ich das mit meinem PC vergleiche, da gibt es dort auch keinen AppData Ordner. |
|
09.01.2011, 21:29
| #14 |
| /// Malware-holic | SystemTool 2011 - und nun? blende versteckte datein + ordner ein. Anzeigen versteckter Dateien weiterhin geschützte systemdateien, warnmeldung mit ja bestätigen, und inhalte von systemordnern oder ähnlich. dann solltest du ihn sehen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.01.2011, 21:53
| #15 |
| | SystemTool 2011 - und nun? Vielen Dank - es hat geklappt. Wobei es offenbar ein paar Dateien gab, die nicht kopiert werden konnten, weil irgendwelche Programme geöffnet waren. Aber es war nix auf. Hmmm, na ja. Er ist normal hochgefahren, alles scheint zu klappen. Vielen, vielen Dank für die Mühe und die Geduld. |
|
| Themen zu SystemTool 2011 - und nun? |
| abgesicherte, abgesicherten, arbeiten, chip, entfernung, erkennt, firmen, freeware, gefunde, heute, installier, installiert, kamera, komischer, komischer virus, malware, nichts, probiert, programme, stunde, system, systemtools, vermutet, verschiedene, verzweifel, virus, web |
Linear-Darstellung
