Mahlzeit,

in der Vergangenheit konnte ich als stiller Mitleser schon mehrfach meine Probleme durch Threads im Trojaner-Board schon lösen. Im aktuellen Fall habe ich mich jedoch dazu entschlossen meinen Befall selbst zu Veröffentlichen.
Gestern Abend hat sich Firefox mitsamt Taskmanager verabschiedet, letzterer lässt sich seitdem nicht mehr öffnen, nach dem Affengriff wird er auch nicht mehr als Option angezeigt.
Boot tut gut, dachte ich mir also gesagt getan.
Damit begann die Odysee. Der Befall besteht aus folgenden Bestandteilen:
- CCC stürzt nach Windowsanmeldung ab
- "RAM memory reliability is extremly low"-Meldung
- Weitere Meldungen (Gedächtnisprotokoll): "Windows detected a hard disk problem" mit den Optionen "Scan and fix" und "Delay scan", "Failed to save all the components for the file...(system32)" (ca. 20-fache Meldung), "Files indexation process failed"
- Bei ungewolltem Scanstart öffnet sich ein Programm, welches auf "Choice Guard" verweist
- Desktop wurde resettet, Startmenü leer, Dateien in system32 zwar sichtbar, aber nicht startbar
- Auch nach der Anwendung der win7-32-sm-reset.exe bleiben Desktop und Startmenü verborgen
- Unter Systemstart hat sich "PD C0sEd" eingenistet, zu finden unter ProgramData/RFBHhGvgqyIOxPW.exe
- Abgesicherter Modus wird seit dem 3. Neustart nicht mehr angezeigt, nur noch Starthilfe, welche nicht funktioniert
- HDD arbeitet stetig, ich hoffe mal die Probleme nehmen nicht noch weiter zu

Windows Defender hat als Adware Win32/OpenCandy erkannt. Wie oben aufgeführt, bleibt auch nach Unhide der Desktophintergrund schwarz und im Startmenü ist lediglich "Accessories" und "Maintenance" erschienen (Startup ist leer). Allerdings sind zumindest die zahlreichen Meldungen nun verschwunden. Beim manuellen Startversuch der taskmgr.exe erscheint nun "Task-Manager wurde durch den Administrator deaktiviert" (vorher regte sich rein gar nichts).
Nachfolgend die OTL-Dateien.

Extras.txt:
OTL Logfile:

OTL Extras logfile created on: 23.12.2011 09:10:55 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ethanhund\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 73,83% Memory free
6,50 Gb Paging File | 5,56 Gb Available in Paging File | 85,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 260,37 Gb Free Space | 27,95% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: ethanhund | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00639918-023C-30DD-BB03-CE9DEA98A7D7}" = CCC Help Chinese Traditional
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CB2A228-2E05-888C-3C38-FD242D66A37E}" = Catalyst Control Center InstallProxy
"{10CDB54A-AC21-DF5D-D7C3-D5E3687E88D5}" = CCC Help Japanese
"{13D86932-8D64-5BF1-A852-38F6D22F6A2F}" = Catalyst Control Center Graphics Previews Common
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18EBEFCE-AF96-6EAF-A5AF-F8A5BAC23171}" = CCC Help Spanish
"{1954240A-76A3-673C-1FC1-8F779A1A3A35}" = Catalyst Control Center Graphics Previews Vista
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{19B94155-40AF-17AE-4551-1B0094652B5A}" = CCC Help Czech
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1DDC7779-8B48-35E2-B9F0-C904EB02031C}" = CCC Help Portuguese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22764EFF-300F-8F3D-564D-7A4C4662D120}" = CCC Help Polish
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2365558E-D15A-D3DA-67E5-4B67FAB71280}" = CCC Help English
"{25D1A13B-46CB-5730-3651-8C91BA8F1754}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 26
"{277F7DBD-76BB-49C8-AB60-3CD12F6F7BD0}" = QIP 2012 6904 Jeak-Edition
"{2894AAC3-9A08-FF3A-6737-41A6178D0A09}" = CCC Help Chinese Standard
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{33A22B2D-55BA-4508-B767-BF2E9C21A73F}" = Assassin's Creed Revelations
"{33B2A67D-96DD-3D8D-94B4-5918960F4E7E}" = CCC Help Thai
"{3536AD21-940C-D198-DD10-078011A5C13B}" = CCC Help Thai
"{3A1B1652-D70A-4D19-981E-BB15D0DBF253}" = Ghostbusters (TM): The Video Game
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A68AA19-5C83-4BC3-ABA4-161E940799DB}" = QIP Infium 9044 Jeak-Edition
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D15698E-4DD8-81CB-0A8E-4E21162D2FBE}" = ccc-utility
"{3E8ADCB3-4297-3A65-8E76-A88B09104AB9}" = AMD Catalyst Install Manager
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43430FA2-C625-49DA-8882-351000008300}" = Dead Rising 2: OTR
"{434D0FA0-AB8C-497F-B30A-7A1000018201}" = DiRT 3
"{434D0FA0-AB8C-497F-B30A-7A1000018202}" = DiRT 3
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{4614BE8A-0C7D-D86C-CBAD-61F9C7B3AA26}" = AMD Media Foundation Decoders
"{49D87A8F-D04F-7749-DD32-BDBF9B24B232}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CC0A6BA-792E-5AE7-8993-C521798A8910}" = CCC Help Chinese Standard
"{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"{4D53090A-CE35-42BD-B377-831000018301}" = Fable III
"{50EF1220-57F7-432E-9217-E5FAF61F93C9}" = Catalyst Control Center Localization All
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{555827C1-F292-3660-A9B2-963243286E18}" = Catalyst Control Center HydraVision Full
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56EF8482-50F6-019C-8D1D-ED8EE66E731D}" = CCC Help Polish
"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{63CEA2E4-4FE7-4F2C-B388-C1313D24157C}" = SPORE™ Galaktische Abenteuer
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist
"{660C748F-A503-B771-7BD6-2D7C5AA1DBB4}" = CCC Help Dutch
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{69FB248E-690D-434F-94A7-248D5F1ECD70}" = AMD OverDrive
"{69FD94CB-D8E8-E05F-B076-D8F8566A29D6}" = Catalyst Control Center InstallProxy
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A272B84-3E10-8AB8-1188-2246459457A6}" = ccc-core-static
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6E03FAB5-6253-58B8-B939-AA83F64C3278}" = CCC Help Swedish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71513F2C-F2BD-E07D-1320-093517D7EEC9}" = CCC Help Finnish
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7522ED5B-5670-5B76-A8C2-77B6F8E189FA}" = CCC Help French
"{75D5C946-C7D4-8653-1A81-6BE2DE960D4C}" = CCC Help Turkish
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{7A75AFE3-A0C3-951D-4804-54721360FF90}" = CCC Help Hungarian
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8EED73E3-E049-5A57-D1AB-5C9872AB504E}" = CCC Help Danish
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{915726DF-7891-444A-AA03-0DF1D64F561A}" = L.A. Noire
"{946BA0C5-DE16-4C0B-C436-796EF98EE4B7}" = Catalyst Control Center Graphics Full New
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B415AF9-72E7-2FF3-EB54-609E0B7ECFFF}" = CCC Help Italian
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C049499-055C-4a0c-A916-1D8CA1FF45EB}" = Sitecom 300N USB Wireless LAN Driver and Utility
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{9F218882-4CF1-F411-111A-B9B68770C0CE}" = CCC Help Czech
"{9F81DEEE-D63C-86D6-750A-23E0EC3F6A1E}" = AMD Drag and Drop Transcoding
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A1EF8DA8-E0CB-C805-4ACA-B7C028CF36F2}" = CCC Help Italian
"{A9F27D99-8478-C124-8978-09595FA9D805}" = CCC Help Portuguese
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAB0D88E-85D7-22CC-6935-0D2247152700}" = CCC Help French
"{AB0A4CB6-60DC-C3D6-2100-C16D89795529}" = CCC Help Korean
"{ABD7DBE3-E344-4BCA-B8AD-4360494DD1D9}" = LG MC USB U330 driver
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{B00220C8-AD02-4DA8-BEF4-E0552A4AC1E2}_is1" = Panopticum Lens Pro 3.5 For Vegas
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B6A24D2D-1ADB-4553-87FD-38F3FAADC18E}_is1" = The Book of Unwritten Tales 1.0.0.0
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BEEA9F9D-0F9D-1F7E-8BA5-C3888A93798C}" = CCC Help Swedish
"{C048F019-9EF3-7F49-0D36-10013A466F17}" = CCC Help Hungarian
"{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}" = SPORE™ Süß & Schrecklich Ergänzungs-Pack
"{C104E9E6-F21E-2762-FBF0-6FE820B2D739}" = CCC Help Korean
"{C270BC04-1540-4673-960F-A546B2C860CD}" = Commandos 3 - Destination Berlin
"{C41DF3CA-5F40-DB8C-D747-DC68BC2010D8}" = Catalyst Control Center
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5632631-95E3-4DAF-2EB1-487EBE04DE19}" = AMD VISION Engine Control Center
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C95E964C-FCF4-13DB-1445-4FA8062271F8}" = CCC Help Spanish
"{CAF243F5-1B4E-A8D7-2EF9-6398EF2C5032}" = AMD AVIVO Codecs
"{CBA7495B-744F-F056-648B-636ADE9E7015}" = ccc-utility
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CC8E8BD8-8F84-35FA-4DC4-D41D31DFA3E4}" = Catalyst Control Center Graphics Full Existing
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.9 Game
"{D3BBE95D-7E2F-1D0C-82CB-1AB333854E2C}" = CCC Help Norwegian
"{D5395E5F-4D45-4665-8F00-234FA33678AF}" = SlimDX Redistributable (March 2009)
"{D7A8C334-7974-54A4-6533-EB84D19D7133}" = CCC Help English
"{D7F681C7-C93C-7591-F4CB-8EC80138F326}" = Catalyst Control Center Graphics Light
"{D872D294-5E06-2C4B-B2F5-D3E19F097917}" = ccc-utility
"{D89F00EB-7868-A817-D618-AA446C0D56B3}" = CCC Help Chinese Traditional
"{D94BA408-F110-488B-A65E-3AE7945F79E6}_is1" = LG PC Suite III deinstallieren
"{D9AB20FE-5267-7A1A-2064-8F18969DF88D}" = CCC Help German
"{DA45F8EC-4226-EA6A-4DA9-F1148F801BDA}" = CCC Help Russian
"{DA7747E1-1F8D-BBC5-BE66-00B21BE5B81B}" = CCC Help Turkish
"{DADEC9BB-66FC-A3E4-8BC9-83E73BA1B5B2}" = CCC Help Greek
"{DC0F655C-E322-1AEF-263E-4E1BEC409BDC}" = AMD Fuel
"{DC785DB7-D389-48C3-B146-96FE99BF4E2B}" = Vegas Pro 9.0
"{DD0FDF02-6AA4-8C7D-AAB0-4C8C7207C0C1}" = CCC Help Japanese
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX
"{E0D5CB1C-7D35-709E-7F58-6CF6FFC3D6B7}" = Catalyst Control Center Graphics Previews Common
"{E1640DA5-89B4-4F52-B15D-5DA3D14F29D4}" = LG USB Modem Drivers
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E839DC72-1FF9-968E-AEC4-084D8C6C7661}" = Catalyst Control Center Core Implementation
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = Impulse
"{EB20F561-2AF5-0368-E353-AF093FBBADC2}" = CCC Help Norwegian
"{ECDE16E7-E3FC-F094-F14D-0326D03B9D96}" = Catalyst Control Center InstallProxy
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EFABE688-3FA7-EB97-9E6F-4B74B51EF164}" = CCC Help Russian
"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1A7536D-5037-E775-CB9C-7712CB7BAE21}" = CCC Help English
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F33E2414-B742-0589-5E9D-FCC24996EFE2}" = CCC Help Dutch
"{F38AF6F6-059C-C683-826F-00539526D86D}" = CCC Help Danish
"{F420C456-2EAC-89C9-4A5B-EC85393FBDC9}" = CCC Help Greek
"{F48A622B-DC1D-79A5-380D-29C6493B6987}" = Catalyst Control Center Graphics Previews Common
"{F59A3B93-6C1C-4C3E-BCC4-4897490E2963}" = LG Bluetooth Drivers
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA02ACAC-9E14-4878-A257-92A22A647C2C}" = LG USB Modem Drivers
"{FCD58710-F023-E26C-6373-79C72FED0B90}" = Catalyst Control Center Localization All
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFCA5FC5-6069-0115-E2C1-785A0CA5D4C3}" = AMD Fuel
"33B31D6D-7EFB-45A3-AC50-4DAF98042443_is1" = The Book Of Unwritten Tales: Die Vieh Chroniken Version 1.2
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_3dcb365ab9e01871fb8c6f27b0ea079" = Adobe After Effects CS4
"Battlelog Web Plugins" = Battlelog Web Plugins
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Cities XL 2012" = Cities XL 2012
"D00BE5C1A47F2FE0C07F4CA85ABDD5DD95E57E0E" = Windows-Treiberpaket - Realtek Semiconductor Corp. (RTL8192su) Net  (05/12/2010 1086.19.0512.2010)
"DAEMON Tools Pro" = DAEMON Tools Pro
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DTProTS_is1" = DTProTS 2.01
"Dungeon Siege III_is1" = Dungeon Siege III
"DX2 texture pack" = DX2 texture pack
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESN Sonar-0.70.0" = ESN Sonar
"ESN Sonar-0.70.4" = ESN Sonar
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FL Studio 9" = FL Studio 9
"Fraps" = Fraps (remove only)
"GFWL_{43430FA2-C625-49DA-8882-351000008300}" = Dead Rising 2: OTR
"GFWL_{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"Hardcore" = Hardcore
"Haunted_is1" = Haunted
"HDD Health_is1" = HDD Health v3.3 Beta
"IL Download Manager" = IL Download Manager
"Impulse" = Impulse
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.2.0
"LogMeIn Hamachi" = LogMeIn Hamachi
"Magic Bullet Editors 2.0 Vegas" = Magic Bullet Editors 2.0 Vegas
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"NewBlue 3D Explosions for Vegas" = NewBlue 3D Explosions for Vegas
"NewBlue 3D Transformations for Vegas" = NewBlue 3D Transformations for Vegas
"NewBlue Art Blends 2.0 for Vegas" = NewBlue Art Blends 2.0 for Vegas
"NewBlue Art Effects 2.0 for Vegas" = NewBlue Art Effects 2.0 for Vegas
"NewBlue Film Effects for Vegas" = NewBlue Film Effects for Vegas
"NewBlue Motion Blends 2.0 for Vegas" = NewBlue Motion Blends 2.0 for Vegas
"NewBlue Motion Effects 2.0 for Vegas" = NewBlue Motion Effects 2.0 for Vegas
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"OpenAL" = OpenAL
"Origin" = Origin
"PluginPac" = DebugMode PluginPac (remove only)
"PoiZone" = PoiZone
"Project64 1.7.0.55" = Project64 1.7.0.55
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"QIP 2012 6904 Jeak-Edition 4.0.6904" = QIP 2012 6904 Jeak-Edition
"RADVideo" = RAD Video Tools
"Rockstar Games Social Club" = Rockstar Games Social Club
"RPG Maker VX 1.02" = RPG Maker VX 1.02
"RPG Maker VX RTP =XWareM2 Group=_is1" = RPG Maker VX RTP
"Saints Row The Third_is1" = Saints Row The Third
"Sawer" = Sawer
"Sins of a Solar Empire" = Sins of a Solar Empire
"Sins of a Solar Empire - Diplomacy" = Sins of a Solar Empire - Diplomacy
"Sins of a Solar Empire - Entrenchment" = Sins of a Solar Empire - Entrenchment
"SpeedFan" = SpeedFan (remove only)
"SpiceMASTER 2.5 PRO for Vegas" = SpiceMASTER 2.5 PRO for Vegas
"Steam App 12210" = Grand Theft Auto IV
"Steam App 12220" = Grand Theft Auto: Episodes from Liberty City
"Steam App 240" = Counter-Strike: Source
"Steam App 260" = Counter-Strike: Source Beta
"Toxic Biohazard" = Toxic Biohazard
"Tunngle beta_is1" = Tunngle beta
"Two Worlds II" = Two Worlds II
"Venetica_is1" = Venetica
"Verbindungsassistent" = Verbindungsassistent
"VLC media player" = VLC media player 1.1.11
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"YTdetect" = Yahoo! Detect
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"InstallShield_{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist
"jlGui 3.1" = jlGui 3.1
"QIP 2005" = QIP 2005 8095
"QIP 2010" = QIP 2010 10.10.22.4290
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---


OTL.txt:
OTL Logfile:

OTL logfile created on: 23.12.2011 09:10:55 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ethanhund\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 73,83% Memory free
6,50 Gb Paging File | 5,56 Gb Available in Paging File | 85,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 260,37 Gb Free Space | 27,95% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: ethanhund | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
PRC - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) -- C:\Programme\Tunngle\TnglCtrl.exe
PRC - [2011.10.07 04:28:52 | 000,397,312 | -H-- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () -- C:\Programme\Verbindungsassistent\WTGService.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) -- C:\Programme\Common Files\Nuance\dgnsvc.exe
PRC - [2010.06.08 16:41:22 | 001,118,208 | -H-- | M] (Sitecom Corp.) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe
PRC - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe
PRC - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () -- C:\Programme\DTProTS\DTProTS.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.10.05 01:20:35 | 011,819,520 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\33b601c8e2cf4993e68d763389246197\System.Web.ni.dll
MOD - [2011.10.05 01:20:26 | 000,771,584 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e3e3b399b69c569ab1ed3b0ace2c8c20\System.Runtime.Remoting.ni.dll
MOD - [2011.10.05 01:20:07 | 012,433,408 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0d43c5e77ee7b8466700b16d7e7d4bb7\System.Windows.Forms.ni.dll
MOD - [2011.10.05 01:20:03 | 001,587,200 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\9e87dd8fe5d0f925d80a6a6eaf74fdb9\System.Drawing.ni.dll
MOD - [2011.10.05 01:19:47 | 007,963,648 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\3da7c6c1a0f26ae91883fd8b03ec192d\System.ni.dll
MOD - [2011.10.05 01:19:42 | 011,490,304 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll
MOD - [2010.11.13 00:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 02:59:41 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.08.16 16:06:02 | 000,141,312 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.07.14 09:47:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () [Auto | Running] -- C:\Programme\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2011.04.16 20:52:50 | 000,403,240 | -H-- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Programme\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010.04.23 04:39:00 | 000,136,616 | -H-- | M] () [Auto | Stopped] -- C:\Programme\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) [Auto | Running] -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU)
SRV - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2010.01.06 19:49:12 | 000,655,624 | -H-- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () [Auto | Running] -- C:\Programme\DTProTS\DTProTS.exe -- (DTProTS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.10.07 06:20:28 | 008,598,528 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011.10.07 03:45:38 | 000,257,024 | -H-- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011.08.24 00:51:40 | 000,281,760 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.08.24 00:51:37 | 000,025,888 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.06.24 05:25:26 | 000,039,424 | -H-- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.01)
DRV - [2011.06.06 23:06:54 | 000,211,984 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011.02.17 01:36:33 | 000,431,672 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.11.20 13:30:15 | 000,175,360 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)
DRV - [2010.11.20 10:14:45 | 000,017,920 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.05.12 17:29:32 | 000,600,096 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.04.23 04:33:12 | 000,036,864 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Programme\AMD\OverDrive\i386\AODDriver2.sys -- (AODDriver2)
DRV - [2010.03.09 11:21:26 | 000,107,024 | -H-- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010.02.24 11:22:10 | 000,185,472 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2010.02.18 08:18:22 | 000,037,944 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2010.02.03 14:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.09.26 18:05:22 | 000,004,992 | -H-- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\enport.sys -- (enport)
DRV - [2009.09.16 07:02:40 | 000,027,136 | -H-- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.06.11 18:39:16 | 000,012,928 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.06.11 18:39:14 | 000,012,032 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.06.11 18:39:14 | 000,010,496 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.05.12 14:53:04 | 000,016,896 | -H-- | M] (Danish Wireless Design A/S) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlashUsb.sys -- (FlashUSB)
DRV - [2008.11.19 16:09:10 | 000,024,832 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 16:09:08 | 000,019,968 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 16:09:08 | 000,013,056 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.07.24 10:03:56 | 000,101,760 | -H-- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.06.29 13:47:34 | 000,034,304 | -H-- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006.09.24 14:28:46 | 000,005,248 | -H-- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [1996.04.03 20:33:26 | 000,005,248 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.yahoo.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?btnG=Google+Search&q="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files\OnLive\Plugin\npolgdet.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 13:39:48 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.20 12:09:43 | 000,000,000 | -H-D | M]
 
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.18 22:52:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Firefox\Profiles\8u9rtd2e.default\extensions
[2009.10.03 20:45:30 | 000,001,720 | -H-- | M] () -- C:\Users\ethanhund\AppData\Roaming\Mozilla\Firefox\Profiles\8u9rtd2e.default\searchplugins\youtube-videosuche.xml
[2011.11.09 13:39:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
() (No name found) -- C:\USERS\ETHANHUND\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8U9RTD2E.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.09 13:39:48 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.03 20:51:01 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.03 20:51:01 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.03 20:51:01 | 000,001,153 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.03 20:51:01 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.03 20:51:01 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.03 20:51:01 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2000.01.01 00:00:00 | 000,000,794 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 secure.disc-soft.com 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\ethanhund\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{508DA2EB-470E-488A-8334-53195C972FB4}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58FD8014-B197-4FFC-898C-49CEF9574F16}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C473E33D-D975-42FC-AD51-7FBBBE88B282}: DhcpNameServer = 7.254.254.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.07.10 19:00:38 | 000,063,372 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 13:46:33 | 000,003,232 | ---- | M] () - C:\AutoRun_Log(0000).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,978 | ---- | M] () - C:\AutoRun_Log(0001).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,973 | ---- | M] () - C:\AutoRun_Log(0002).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:10:34 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0003).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:11:02 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0004).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,961 | ---- | M] () - C:\AutoRun_Log(0005).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:21:58 | 000,003,074 | ---- | M] () - C:\AutoRun_Log(0006).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:04:55 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0007).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:35:20 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0008).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 23:07:50 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0009).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.15 00:58:05 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0010).txt -- [ NTFS ]
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.23 09:10:12 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.23 08:50:57 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011.12.22 22:14:59 | 000,218,688 | -H-- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:07:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jeak.de
[2011.12.15 00:43:02 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011.12.15 00:43:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\RELOADED
[2011.12.07 03:16:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock Games
[2011.11.29 17:41:31 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\WB Games
[2011.11.28 18:37:42 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\Assassin's Creed Revelations
[2011.11.28 18:29:45 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\Documents\NFSTR
[2009.09.17 13:52:18 | 059,158,448 | -H-- | C] (Macrovision Corporation) -- C:\Users\ethanhund\AppData\Roaming\file1.exe
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:08:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.23 09:08:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.23 09:03:35 | 000,000,388 | -H-- | M] () -- C:\Windows\tasks\QIPdater 2012.job
[2011.12.23 09:03:33 | 000,000,344 | -H-- | M] () -- C:\Windows\tasks\qipdater.exe.job
[2011.12.23 09:03:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.23 09:03:17 | 2616,057,856 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.23 09:01:29 | 000,322,393 | ---- | M] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.23 08:53:24 | 000,700,130 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.23 08:53:24 | 000,654,842 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.23 08:53:24 | 000,148,926 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.23 08:53:24 | 000,121,714 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.23 08:52:33 | 000,001,136 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000UA.job
[2011.12.23 08:52:08 | 000,000,424 | -H-- | M] () -- C:\ProgramData\8KAso99F2EWrrQ
[2011.12.23 08:50:57 | 000,000,664 | -H-- | M] () -- C:\Users\ethanhund\Desktop\System Fix.lnk
[2011.12.23 08:49:56 | 000,375,808 | -H-- | M] () -- C:\ProgramData\8KAso99F2EWrrQ.exe
[2011.12.22 22:19:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\Access.dat
[2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:00:47 | 000,470,016 | -H-- | M] () -- C:\ProgramData\RFBHhGvgqyIOxPW.exe
[2011.12.22 20:52:00 | 000,001,084 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000Core.job
[2011.12.22 05:51:27 | 000,140,072 | -H-- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.12.22 05:51:18 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2011.12.22 05:11:56 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2011.12.12 02:05:38 | 000,337,452 | -H-- | M] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.23 09:01:59 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.12.23 09:01:59 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2011.12.23 09:01:59 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011.12.23 09:01:59 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2011.12.23 09:01:59 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2011.12.23 09:01:58 | 000,001,417 | ---- | C] () -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.23 09:01:29 | 000,322,393 | ---- | C] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.23 08:50:57 | 000,000,664 | -H-- | C] () -- C:\Users\ethanhund\Desktop\System Fix.lnk
[2011.12.23 08:50:52 | 000,000,424 | -H-- | C] () -- C:\ProgramData\8KAso99F2EWrrQ
[2011.12.23 08:49:56 | 000,375,808 | -H-- | C] () -- C:\ProgramData\8KAso99F2EWrrQ.exe
[2011.12.22 22:01:40 | 000,470,016 | -H-- | C] () -- C:\ProgramData\RFBHhGvgqyIOxPW.exe
[2011.12.12 02:05:32 | 000,337,452 | -H-- | C] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[2011.11.13 23:40:31 | 000,451,072 | -H-- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2011.10.14 12:53:07 | 000,053,248 | -H-- | C] () -- C:\Windows\System32\CommonDL.dll
[2011.10.14 12:53:07 | 000,002,413 | -H-- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2011.10.04 23:00:01 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.09.22 15:33:23 | 000,000,043 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_local.cfg
[2011.09.22 15:04:46 | 000,011,099 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_live.bin
[2011.09.14 10:47:40 | 000,053,760 | -H-- | C] () -- C:\Windows\System32\OVDecode.dll
[2011.09.08 17:51:22 | 000,037,376 | -H-- | C] () -- C:\Windows\System32\atitmpxx.dll
[2011.08.24 00:51:40 | 000,281,760 | -H-- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.08.24 00:51:37 | 000,025,888 | -H-- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.08.17 20:48:44 | 000,237,701 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.07.24 02:06:29 | 000,000,082 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\X-Plane Installer.prf
[2011.07.11 16:17:35 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2011.04.09 17:55:28 | 000,179,261 | -H-- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.03.17 18:51:44 | 000,003,929 | -H-- | C] () -- C:\Windows\System32\atipblag.dat
[2011.02.28 13:11:17 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.02.28 13:09:51 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.01.22 18:29:49 | 000,020,480 | -H-- | C] () -- C:\Windows\System32\H@tKeysH@@k.DLL
[2010.10.31 10:31:39 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.12 20:14:31 | 000,012,800 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.10 01:36:48 | 000,036,734 | -H-- | C] () -- C:\Windows\System32\OggDSuninst.exe
[2010.09.17 23:24:08 | 000,001,395 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\SAS7_000.DAT
[2010.08.19 12:49:54 | 001,970,176 | -H-- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.08.02 14:31:53 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2010.07.21 01:35:51 | 000,165,376 | -H-- | C] () -- C:\Windows\System32\unrar.dll
[2010.07.21 01:35:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.07.21 01:35:50 | 000,790,528 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.07.21 01:35:50 | 000,134,144 | -H-- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.07.21 01:35:50 | 000,108,032 | -H-- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.06.25 16:55:46 | 000,017,408 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\WebpageIcons.db
[2010.06.16 22:40:07 | 000,000,853 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_sta
[2010.06.16 22:39:10 | 000,000,849 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_prof
[2010.06.12 19:30:42 | 000,036,892 | -H-- | C] () -- C:\Windows\System32\BASSMOD.dll
[2010.06.12 19:30:11 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.06.12 19:30:11 | 000,000,001 | ---- | C] () -- C:\Windows\audi20.dat
[2010.05.26 20:01:44 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.05.21 23:39:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.03 16:27:30 | 000,000,170 | ---- | C] () -- C:\Windows\game.ini
[2010.03.17 22:00:27 | 002,434,856 | -H-- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2009.11.09 14:21:02 | 000,066,560 | -H-- | C] () -- C:\Windows\System32\ntrights.exe
[2009.10.17 20:06:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\Access.dat
[2009.10.09 15:12:59 | 000,138,056 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\PnkBstrK.sys
[2009.10.09 15:12:29 | 003,360,624 | -H-- | C] () -- C:\Windows\System32\pbsvc.exe
[2009.10.05 14:09:42 | 001,658,973 | -H-- | C] () -- C:\Windows\System32\libmmd.dll
[2009.10.05 14:09:42 | 000,122,880 | -H-- | C] () -- C:\Windows\System32\PtSSE2.dll
[2009.10.05 14:09:42 | 000,019,968 | -H-- | C] () -- C:\Windows\System32\Cpuinf32.dll
[2009.09.26 18:05:22 | 000,008,192 | -H-- | C] () -- C:\Windows\System32\gsimrxnp.dll
[2009.09.26 18:05:22 | 000,004,992 | -H-- | C] () -- C:\Windows\System32\drivers\enport.sys
[2009.09.19 02:48:22 | 000,140,072 | -H-- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.09.19 02:47:12 | 000,280,904 | -H-- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009.09.19 02:45:01 | 000,075,136 | -H-- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.09.13 00:49:25 | 000,007,604 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\Resmon.ResmonCfg
[2009.07.14 09:47:43 | 000,700,130 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,148,926 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 002,340,040 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,654,842 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,121,714 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.10.06 19:42:57 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\OggDS.dll
[2002.10.05 00:04:25 | 000,921,600 | -H-- | C] () -- C:\Windows\System32\vorbisenc.dll
[2002.10.05 00:04:24 | 000,188,416 | -H-- | C] () -- C:\Windows\System32\vorbis.dll
[2002.10.05 00:04:17 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\ogg.dll
[1996.04.03 20:33:26 | 000,005,248 | -H-- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.11.24 03:20:26 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\.minecraft
[2010.05.03 16:36:16 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Activision
[2011.05.27 13:11:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Amazon
[2011.10.26 01:47:35 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Audacity
[2010.09.17 22:01:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Avid
[2010.05.07 21:29:22 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Bioshock2
[2009.12.19 00:08:31 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\COWON
[2010.06.06 22:57:01 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Crayon Physics Deluxe
[2009.09.13 17:40:03 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DAEMON Tools Lite
[2011.02.17 01:28:06 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DAEMON Tools Pro
[2011.07.06 12:15:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Day 1 Studios
[2011.08.25 15:48:13 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\DYA_NVURBDAHNPILDSNTI
[2010.06.03 13:53:38 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Hardcore
[2011.12.22 22:06:02 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\jeak.de
[2010.06.03 13:55:08 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Juce VST Host
[2011.08.21 01:17:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Kalypso Media
[2011.10.14 13:20:47 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\LG Electronics
[2011.05.19 13:11:29 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Lionhead Studios
[2009.11.26 21:32:33 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\MAXON
[2010.06.12 19:09:13 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\mkvtoolnix
[2010.07.31 00:41:16 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Need for Speed World
[2011.07.20 00:09:43 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\New Technology Studio
[2010.09.17 23:00:27 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Nuance
[2010.05.29 22:47:18 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Octoshape
[2011.07.16 18:07:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\OnLive App
[2011.10.22 14:11:30 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Origin
[2010.09.17 22:00:55 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PACE Anti-Piracy
[2010.06.21 23:35:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PQube
[2010.06.03 15:25:12 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Propellerhead Software
[2011.02.17 03:00:15 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\ProtectDISC
[2009.12.31 14:14:36 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Publish Providers
[2011.03.17 12:15:58 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\PunkBuster
[2010.10.26 08:43:02 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\QIP
[2010.08.27 15:20:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Quest3D
[2009.12.02 19:22:24 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\QuickScan
[2010.08.27 15:20:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Roaming
[2009.12.31 15:10:09 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Sony
[2010.10.11 02:04:36 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\SpieleEntwicklungsKombinat
[2009.09.24 14:31:24 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\SPORE
[2010.01.09 10:23:39 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Stardock
[2010.05.21 23:39:25 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Thunderbird
[2011.10.25 02:49:54 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\TS3Client
[2011.11.14 17:54:34 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Tunngle
[2011.11.28 17:50:50 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Ubisoft
[2011.06.25 12:21:40 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\Verbindungsassistent
[2011.10.14 20:14:26 | 000,000,000 | -H-D | M] -- C:\Users\ethanhund\AppData\Roaming\{D94BA408-F110-488B-A65E-3AE7945F79E6}
[2011.12.23 09:03:35 | 000,000,388 | -H-- | M] () -- C:\Windows\Tasks\QIPdater 2012.job
[2011.12.23 09:03:33 | 000,000,344 | -H-- | M] () -- C:\Windows\Tasks\qipdater.exe.job
[2009.07.14 05:53:46 | 000,026,080 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 971 bytes -> C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1V4WG4H6PT4KGM8HTV4K6N636VFSVF7JB4VPJGF
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0FF263E8
@Alternate Data Stream - 1092 bytes -> C:\ProgramData\Microsoft:UAsVNu1uw2nqZLcJkAcFB
@Alternate Data Stream - 1029 bytes -> C:\ProgramData\Microsoft:lC2B3dLetnnc2juaDhYJr7C

< End of report >
         

--- --- ---



Für eure Bemühungen bedanke ich mich im Voraus.

P.S.:
Zur Herkunft der Schadsoftware kann ich leider keine Angaben machen, Browser hat sich unmittelbar vor seiner Verabschiedung lediglich auf unverfänglichen Seiten befunden, daher halte ich eine zeitgetriggerte Infektion für wahrscheinlicher.

Hi,

das sieht nach Rootkit aus...


Fix für OTL:

• Doppelklick auf die OTL.exe, um das Programm auszuführen.

• Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

• Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

:OTL
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.07.10 19:00:38 | 000,063,372 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 13:46:33 | 000,003,232 | ---- | M] () - C:\AutoRun_Log(0000).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,978 | ---- | M] () - C:\AutoRun_Log(0001).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,973 | ---- | M] () - C:\AutoRun_Log(0002).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:10:34 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0003).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:11:02 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0004).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:20:54 | 000,001,961 | ---- | M] () - C:\AutoRun_Log(0005).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 20:21:58 | 000,003,074 | ---- | M] () - C:\AutoRun_Log(0006).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:04:55 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0007).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 21:35:20 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0008).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.14 23:07:50 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0009).txt -- [ NTFS ]
O32 - AutoRun File - [2011.10.15 00:58:05 | 000,001,918 | ---- | M] () - C:\AutoRun_Log(0010).txt -- [ NTFS ]
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell - "" = AutoRun
O33 - MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
[2009.09.17 13:52:18 | 059,158,448 | -H-- | C] (Macrovision Corporation) -- C:\Users\ethanhund\AppData\Roaming\file1.exe
[2011.12.23 08:52:08 | 000,000,424 | -H-- | M] () -- C:\ProgramData\8KAso99F2EWrrQ
@Alternate Data Stream - 971 bytes -> C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1V4WG4H6PT4KGM8HTV4K6N636VFSVF7JB4VPJGF
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0FF263E8
@Alternate Data Stream - 1092 bytes -> C:\ProgramData\Microsoft:UAsVNu1uw2nqZLcJkAcFB
@Alternate Data Stream - 1029 bytes -> C:\ProgramData\Microsoft:lC2B3dLetnnc2juaDhYJr7C
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.


:Commands
[emptytemp]
[Reboot]
         

• Den roten Run Fixes! Button anklicken.

• Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

• Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

• %systemroot%\_OTL

Combofix
Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Antivierenlösung komplett auschalten und zwar so, dass sie sich auch nach einem Reboot NICHT einschaltet!

Achtung: In einigen wenigen Fällen kann es vorkommen, das der Rechner nicht mehr booten kann und Neuaufgesetzt werden muß!

Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen.

chris

Danke für die zeitnahe Antwort.
Ist in diesem Fall Combofix wirklich vonnöten? Das Programm soll ja nicht gerade von schlechten Eltern sein, u.a. wird ja auch in diesem Forum warnend auf die teilweise schwerwiegenden Folgen einer Anwendung hingewiesen.
Gibt es noch eine alternative, weniger invasive Therapiemöglichkeit?

Hi,

ja CF ist eine Art Dampfwalze und ein "massives Kaliber"...
Dafür hält ihn auber auch fast nichts auf...

Ok...

32 Bit...

OTL-abfahren... Log posten

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
Danach bitte update der Signaturdateien (Reiter "Update" -> Suche nach Aktualisierungen")
Fullscan und alles bereinigen lassen! Log posten.

Dann:
Gmer:
http://www.trojaner-board.de/74908-a...t-scanner.html
Den Downloadlink findest Du links oben (GMER - Rootkit Detector and Remover), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein. Stürzt GMER ab, bitte im abgesicherten Modus (F8 beim Booten) probieren!

TDSS-Killer
Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)!
Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe.
Nach dem Start erscheint ein Fenster, dort dann "Start Scan".
Wenn der Scan fertig ist bitte "Report" anwählen. Es öffnet sich ein Fenster, den Text abkopieren und hier posten...

chris

Hier die Auswertung:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
C:\autoexec.bat moved successfully.
C:\AutoMapaSetupLog.txt moved successfully.
C:\AutoRun_Log(0000).txt moved successfully.
C:\AutoRun_Log(0001).txt moved successfully.
C:\AutoRun_Log(0002).txt moved successfully.
C:\AutoRun_Log(0003).txt moved successfully.
C:\AutoRun_Log(0004).txt moved successfully.
C:\AutoRun_Log(0005).txt moved successfully.
C:\AutoRun_Log(0006).txt moved successfully.
C:\AutoRun_Log(0007).txt moved successfully.
C:\AutoRun_Log(0008).txt moved successfully.
C:\AutoRun_Log(0009).txt moved successfully.
C:\AutoRun_Log(0010).txt moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3340457a-765d-11e0-b3ad-00241d8dd9fb}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404580-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404580-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404580-765d-11e0-b3ad-00241d8dd9fb}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404597-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404597-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404597-765d-11e0-b3ad-00241d8dd9fb}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404659-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33404659-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33404659-765d-11e0-b3ad-00241d8dd9fb}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3340465d-765d-11e0-b3ad-00241d8dd9fb}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{456331db-eeea-11e0-9924-00241d8dd9fb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{456331db-eeea-11e0-9924-00241d8dd9fb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{456331db-eeea-11e0-9924-00241d8dd9fb}\ not found.
File G:\USBAutoRun.exe not found.
C:\Users\ethanhund\AppData\Roaming\file1.exe moved successfully.
C:\ProgramData\8KAso99F2EWrrQ moved successfully.
ADS C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BF1V4WG4H6PT4KGM8HTV4K6N636VFSVF7JB4VPJGF deleted successfully.
ADS C:\ProgramData\TEMP:0FF263E8 deleted successfully.
ADS C:\ProgramData\Microsoft:UAsVNu1uw2nqZLcJkAcFB deleted successfully.
ADS C:\ProgramData\Microsoft:lC2B3dLetnnc2juaDhYJr7C deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: blackmirrordrei

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ethanhund
->Temp folder emptied: 3471600459 bytes
->Temporary Internet Files folder emptied: 66370 bytes
->Java cache emptied: 15941819 bytes
->FireFox cache emptied: 5771451 bytes
->Flash cache emptied: 3857404 bytes

User: Public

%systemdrive% .tmp files removed: 37376 bytes
%systemroot% .tmp files removed: 557056 bytes
%systemroot%\System32 .tmp files removed: 9744472 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17966933 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.362,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 12232011_110717

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Hi,

den weiteren Anweisungen folgen (s. vorherigen Post)...

chris

Also CF, oder doch die Alternativroute? Falls letztere weniger effektiv sein sollte, würde ich doch eher das Schlachtschiff vorziehen.

Die Windows FW bzw. Defender stehen CF aber nicht im Weg, oder? Habe darauf keinen Zugriff mehr und kann es daher nicht deaktiveren.

Edit:

Also erste Frage hat sich erledigt, dachte CF muss zunächst installiert werden, nun ist es aber schon am werkeln. Wie lange dauert der Vorgang in etwa?

Hi,

das sollte eigentlich in ca. 30 Minuten erledigt sein..

chris

Hmm also seit nunmehr 70 Minuten sucht das Programm nach infizierten Dateien, ohne dass einer der 40 abgeschlossenen Abschnitte angezeigt wird, auch die Uhrzeit hat sich bis jetzt noch nicht geändert. Weitere Anwendungen habe ich nicht laufen, glaubt man der visuellen Anzeige meines Rechners, ruht meine HDD.
Sollte der Vorgang abgebrochen werden?

Hi,

wenn möglich killen, sonst Rechner runterfahren...
(das wird jetzt interessant, ... bitte Daten soweit möglich sichern, das sieht jetzt wirklich nach Rootkit aus).

II.-Versuch;
In den abgesicherten Modus booten (F8 beim Booten drücken) und nochmal CF probieren, wenn das nicht funktioniert weiter mit Plan B!

Plan B (wie beschrieben):
MAM, GMER und TDSS-Killer...

chris

Stand der Dinge:

CF heute Abend abgebrochen (Neustart, reagierte nicht). Erste Erleichterung, nachdem der Abgesicherte Modus endlich wieder aufrufbar war. Scheinbar hat CF +/- 20 GB an Dateien gelöscht, ich bezweifel, dass es lediglich Inhalte der temporären Ordner waren.
Im abgesicherten Modus abermals CF gestartet...nach 30 Minuten wiederum keine Änderung.

Kann man hier nur einmal je Post editieren?
Also das Grauen nimmt kein Ende; Nachdem MAM nach fast einer Stunde nun doch einige Verdächtige Dateien finden konnte (von denen nur eine ursächlich sein könnte) und auch drei mysteriöse Registryangaben auftauchten (nachfolgend die Logdatei), war nach dem obligatorischen Neustart der Abgesicherte Modus wieder unauffindbar. Daher kann ich momentan GMER und den TDSS-Killer nur per herkömlichen Start verwenden. Meine Frage nun: soll ich es dennoch wagen, oder gibt es eine Möglichkeit den Abgesicherten Modus wieder freizuschalten?

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 911122308

Windows 6.1.7601 Service Pack 1 (Safe Mode)
Internet Explorer 8.0.7601.17514

24.12.2011 00:25:48
mbam-log-2011-12-24 (00-25-35).txt

Scan type: Full scan (C:\|)
Objects scanned: 504007
Time elapsed: 58 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
ZENSIERT, KEINESFALLS ÜBELTÄTER -> No action taken.
c:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.

P.S.: Frohe Weihnachten wünsche ich natürlich allen Mitlesern.

EDIT:

Nach dem versuchtem Start der qbqgb7tt erscheint folgende Fehlermeldung: "LoadDriver("C:\Users\ETHANH~1\AppData\Local\Temp\fgldapow.sys") error 0xC000010E: Es wird bereits eine Instanz des Dienstes ausgeführt.", GMER startet nach Bestätigung derselben jedoch dennoch. Direkt nach Programmstart kommt keine Fundmeldung, ich lasse den Scan jetzt laufen (Services, Registry und Files sind mit Haken versehen, der Rest ist ausgegraut).

EDIT 2:

Hier die Auswertung von GMER:

GMER Logfile:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-12-24 01:23:19
Windows 6.1.7601 Service Pack 1 
Running: qbqgb7tt.exe; Driver: C:\Users\ETHANH~1\AppData\Local\Temp\fgldapow.sys


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  2
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                    
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                 1
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                              0x25 0x9A 0xB7 0xB1 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x69 0x1A 0xE2 0xDC ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Pro\
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x19 0xEB 0x9A 0x7D ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x71 0x6A 0xCD 0x0A ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x8E 0x30 0x27 0x80 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                0x86 0x2F 0x2D 0x87 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                0x82 0xCA 0x7D 0xA6 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq4                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq4@hdf12                0x8E 0xB2 0xB0 0x30 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq5                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq5@hdf12                0xC6 0x2F 0x4C 0x9B ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002                           
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a1                        0x10 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0                        0x7C 0x01 0x00 0x00 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12                     0x8D 0x42 0xF5 0x22 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12                0x8E 0x9B 0xCA 0xE9 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                     1
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                  0x25 0x9A 0xB7 0xB1 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x69 0x1A 0xE2 0xDC ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Pro\
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x19 0xEB 0x9A 0x7D ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x71 0x6A 0xCD 0x0A ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x8E 0x30 0x27 0x80 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                    0x86 0x2F 0x2D 0x87 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                    0x82 0xCA 0x7D 0xA6 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq4 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq4@hdf12                    0x8E 0xB2 0xB0 0x30 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq5 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq5@hdf12                    0xC6 0x2F 0x4C 0x9B ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002 (not active ControlSet)       
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a1                            0x10 0x00 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0                            0x7C 0x01 0x00 0x00 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12                         0x8D 0x42 0xF5 0x22 ...
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0 (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12                    0x8E 0x9B 0xCA 0xE9 ...

---- EOF - GMER 1.0.15 ----
         

--- --- ---

TDSS-Killer:

Nach dem Start des TDSS Scans (der im Übrigen lediglich 15 Sekunden dauerte und offenbar lediglich den Windowsordner durchsuchte) erscheinen zwei Gefährdungen:

Locked file
Service: sptd
Suspicious object, medium risk

sowie

Rootkit.Boot.SST.b
Physical drive:\Device\Harddisk0\DR0
Malware object, high risk

Während ich ersteres Objekt nur löschen, in die Quarantäne verschieben oder Überspringen kann, besteht bei letzterem die zusätzliche Möglichkeit einer Heilung. Von einer Reportfunktion ist dort jedoch nichts zu finden. Da ich nun nicht genau weiß, welcher Schritt der sinnvollste ist, warte ich auf eine Info, wie nun zu verfahren ist.

Hi,

Du hast im MBR der Festplatte ein Rootkit...
Versuche das mit TDSS-Killer zu beseitigen...
Vorher MAM updaten und dann offline gehen (INET-Stecker ziehen)..

Vorher noch das hier:
MBR-Check
Lade Dir http://ad13.geekstogo.com/MBRCheck.exe und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.

• Vista und Win7 User mit Rechtsklick "als Administrator starten"

• Das Tool braucht nur eine Sekunde.

• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste bitte den Inhalt des .txt Dokumentes

MBR-code sichern und hochladen
Lass MBRCheck.exe nochmal laufen, die Frage mit yes beantworten,
dann 1, zu dumpende Festplatte 0 und Dateiname mbr.dat.
Hier das Ganze als Bildchen: [/url]
Den gesicherten MBR (die mbr.dat) dann bitte hier hochladen:
http://www.trojaner-board.de/54791-a...ner-board.html

So, jetzt den Stecker ziehen, TDSS-Killer verwenden und dann offline gleicht MAM hinterher...

Dann Online und Logs posten....

chris

Hiho,

also die vom TDSS-Killer angezeigte Datei habe ich zwischenzeitlich behandeln lassen, nach einem neustart findet TDSS dieselbe auch nicht mehr.
Wie kommst du darauf, dass sich der Schädling im MBR eingenistet hat?
Das Problem des nicht mehr startbaren Taskmanagers trat ja bereits während des regulären Betriebs auf, nicht erst nach einem Neustart.
Die Komplexität des Einbaus und die durch's MBR ohnehin gestiegenen Erfordernisse sprechen ja eher für eine professionellere Quelle, oder gibt es auch Rootkit-Generatoren, die das gleiche ermöglichen? Dann grenzt das den möglichen Übertragungsweg schon recht ein.
Mit einer herkömlichen, tiefen Formatierung wäre mir demnach ja auch nicht geholfen, oder würde es genügen und die im MBR verbliebenen Reste könnten sich nicht revitalisieren und neu verteilen?
Momentan habe ich zusätzlich noch eine SSD eingebaut als Notbehelf. Ferndiagnosen sind häufig problematisch, aber wäre es deiner Einschätzung nach wahrscheinlich, dass sich der Befall der HDD auf die SSD ausweiten könnte, wenn man erstere als sekundäres und letztere als primäres Laufwerk nutzt?
Wäre die Nutzung der HDD als externe Platte gefahrloser? Immerhin würde sie dann ja nicht im Bootvorgang ausgelesen und im OS-Auswahlmenü auftauchen.

Hi,

das Ganze fängt erstmal mit der Ausnutzung einer Sicherheitslücke (z. B. ucash) an, oder durch den User der sich was verseuchtes runterlädt (Keygens, gecrackte-SW). Im ersten Fall ist es meist ein Dropper der dann die eigentliche Schad-SW rutnerlädt, im zweiten Fall kann es dann gleich das Rootkit sein, dass sich installiert. Daher immer mit beschränkten Rechten surfen (d.h. Gast-Account). Ein Ausbreitung auf den Bootblock/MBR der zweiten Platte (SSD) ist möglich, muss aber nicht sein. Wenn die bereits beim TDSS-Killer-Scan angeschlossen war, hätte er es gemeldet.
Als externe HDD kann die interne betrieben werden, es ist allerdings sicherzustellen, dass kein autorun/start beim anschließen durchgeführt wird, daher die SHIFT-Taste solange gedrückt halten, bis sie vollständig erkannt und eingebunden ist (das unterdrückt den autorun). Dann erstmal den Virenscanner drüber jagen.
Meist zieht so ein Rootkit noch andere Trojaner/Keylogger hinterher...ZeroAccess überschreibt einen regulären Treiber und verankert noch ein Programm was den Rootkit nach Löschung wieder installiert... Dann überschreibt er den nächsten Treiber bis er einen vitalen Treiber erwischt..

Scanne nochmal alles mit SASW:
Superantispyware (SASW):
http://www.trojaner-board.de/51871-a...tispyware.html

chris

Ps.: Wie ich auf den MBR komme:
Rootkit.Boot.SST.b
Physical drive:\Device\Harddisk0\DR0