| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Befall vom Windows VerschlüsselungstrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.06.2012, 13:09
| #1 |
| |  Befall vom Windows Verschlüsselungstrojaner Hallo, auch mich hat es nun mit dem Windows Verschlüsselungs Trojaner erwischt. Ich hab den Scan mit Malewarebites durchgeführt und hab das Ergebnis des Logs wie beschrieben unten eingefügt. Leider bin ich ab jetzt trotz Anleitungen hier im Forum total überfordert, was ich nun weiterhin tun muss, um mein System wieder sauber zu bekommen. Was bedeutet verschlüsselte Dateien entschlüsseln und wie gehe ich dabei vor? Für Hilfe wäre ich sehr dankbar, da ich wie gesagt ein absoluter Laie und total überfordert bin. Anbei das Log: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.06.07.03 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7601.17514 TomTom :: TOMTOM-PC [Administrator] 07.06.2012 13:58:49 mbam-log-2012-06-07 (13-58-49).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 201703 Laufzeit: 50 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|C62BB140 (Trojan.Agent) -> Daten: C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg\80A76A04C62BB140317D.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg\80A76A04C62BB140317D.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) habe nun noch, wie beschrieben defogger und OTL durchgeführt, dabei sind folgende Ergebnisse herausgekommen: Defogger: defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:14 on 07/06/2012 (TomTom) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 07.06.2012 14:15:55 - Run 1 OTL by OldTimer - Version 3.2.46.2 Folder = C:\Users\TomTom\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 16,00 Gb Total Physical Memory | 14,84 Gb Available Physical Memory | 92,76% Memory free 32,00 Gb Paging File | 30,89 Gb Available in Paging File | 96,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 55,80 Gb Total Space | 12,78 Gb Free Space | 22,90% Space Free | Partition Type: NTFS Drive D: | 2,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive E: | 300,00 Gb Total Space | 252,81 Gb Free Space | 84,27% Space Free | Partition Type: NTFS Drive F: | 631,51 Gb Total Space | 86,56 Gb Free Space | 13,71% Space Free | Partition Type: NTFS Computer Name: TOMTOM-PC | User Name: TomTom | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2012.04.05 21:57:34 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc) SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess) SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.05.26 17:32:39 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.05.10 16:41:27 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.05.10 15:53:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.10 15:53:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- E:\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.12.10 18:16:49 | 000,189,248 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB) SRV - [2011.12.10 18:16:41 | 000,075,136 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.02.16 00:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) DRV:64bit: - [2012.02.16 00:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) DRV:64bit: - [2011.11.15 11:14:02 | 000,126,464 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RzSynapse.sys -- (RzSynapse) DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd) DRV:64bit: - [2011.06.10 08:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.06.02 11:32:50 | 000,401,896 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:64bit: - [2011.06.02 11:32:50 | 000,128,488 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2010.09.29 12:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM) DRV:64bit: - [2010.09.29 12:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2) DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2009.08.24 00:55:32 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl) DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1) DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 17 AB 3D 6E A4 44 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Appz\Java\bin\new_plugin\npjp2.dll File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Appz\Adope Reader X\Reader\AIR\nppdf32.dll File not found FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: E:\Appz\Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: E:\Appz\Firefox\plugins [2011.11.11 18:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Extensions [2012.05.03 18:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions [2012.06.07 12:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Appz\Java\bin\jp2ssv.dll File not found O4:64bit: - HKLM..\Run: [EvtMgr6] E:\Appz\Setpoint\SetPointP\SetPoint.exe /launchGaming File not found O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [avgnt] E:\Appz\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Logitech G35] E:\Appz\Logitech G35\G35.exe File not found O4 - HKLM..\Run: [Razer Naga Driver] E:\Appz\Razer Naga\RazerNagaSysTray.exe File not found O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] E:\Appz\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O4 - Startup: C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D483E299-B9BB-4BCF-BE63-A0A55FBD9C60}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012.01.05 21:30:20 | 000,000,039 | R--- | M] () - D:\Autorun.inf -- [ UDF ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.06.07 14:15:37 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe [2012.06.07 13:58:03 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Malwarebytes [2012.06.07 13:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.06.07 13:57:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.06.07 13:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.06.07 13:56:51 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe [2012.06.07 12:30:10 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg [2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Ubisoft [2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft [2012.06.06 19:24:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Rockstar Games [2012.06.06 19:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games [2012.06.06 18:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Rockstar Games [2012.06.06 17:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games [2012.06.03 11:07:55 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\dxhr [2012.06.03 11:07:21 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\28050 [2012.06.03 10:53:01 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDE2B48A-5632-4D42-8BF5-924CF1E0A57F} [2012.06.03 10:52:45 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{EF77C2FA-D8A8-4F52-AECC-AB51AB55B532} [2012.06.03 10:31:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft [2012.06.02 09:39:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{D4FCE0F8-EE3C-4659-A466-90AD2767B776} [2012.06.02 09:39:37 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{4D8BE728-AAC9-49FD-856C-738C3AB88B8C} [2012.06.01 11:51:26 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{366E1564-1267-49A6-B826-DA6C8B61DA38} [2012.06.01 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDBACFB2-5880-4096-A400-873055DC2C7C} [2012.05.31 16:41:39 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{9CFDFF90-2890-4445-94CB-B9F7058E0A24} [2012.05.31 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{661A89E0-C6B3-4623-AA5B-E2C9268527BC} [2012.05.27 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Star_Vault [2012.05.24 23:00:52 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs [2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\ArmA 2 OA [2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\ArmA 2 [2012.05.24 19:00:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.05.24 18:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.05.18 15:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.05.18 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.05.18 15:50:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2012.05.18 15:45:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA [2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA [2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\es-ES [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\es [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0C0A [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\es-ES [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\es [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0C0A [2012.05.18 15:42:06 | 000,000,000 | ---D | C] -- C:\Windows\es-ES [2012.05.18 15:39:13 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\es-ES\pscr.sys.mui [2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerId.sys.mui [2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerIb.sys.mui [2012.05.18 15:39:05 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrParwdm.sys.mui [2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\he-IL [2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\he [2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\he-IL [2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\he [2012.05.18 15:38:18 | 000,000,000 | ---D | C] -- C:\Windows\he-IL [2012.05.18 15:35:43 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\he-IL\pscr.sys.mui [2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerId.sys.mui [2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerIb.sys.mui [2012.05.18 15:35:35 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrParwdm.sys.mui [2012.05.18 15:35:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sl-SI [2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sl-SI [2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\sl-SI [2012.05.18 15:30:03 | 000,000,000 | ---D | C] -- C:\Windows\it-IT [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\it-IT [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\it [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0410 [2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\it-IT [2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0410 [2012.05.18 15:29:55 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\it [2012.05.18 15:27:36 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\it-IT\pscr.sys.mui [2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerId.sys.mui [2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerIb.sys.mui [2012.05.18 15:27:28 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrParwdm.sys.mui [2012.05.18 15:26:47 | 000,000,000 | ---D | C] -- C:\Windows\fr-FR [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\fr-FR [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\fr [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ar-SA [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ar [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\040C [2012.05.18 15:26:42 | 000,000,000 | ---D | C] -- C:\Windows\ar-SA [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\fr-FR [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\fr [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\ar-SA [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ar [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\040C [2012.05.18 15:24:05 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\ar-SA\pscr.sys.mui [2012.05.18 15:23:56 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerIb.sys.mui [2012.05.18 15:23:55 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerId.sys.mui [2012.05.18 15:23:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrParwdm.sys.mui [2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en [2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409 [2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sk-SK [2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US [2012.05.18 15:23:13 | 000,000,000 | ---D | C] -- C:\Windows\sk-SK [2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en [2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409 [2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sk-SK [2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\en-US [2012.05.18 15:21:02 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\en-US\pscr.sys.mui [2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerId.sys.mui [2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerIb.sys.mui [2012.05.18 15:20:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrParwdm.sys.mui [2012.05.17 10:53:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{485CB5D6-D82B-484D-8685-62226625857B} [2012.05.17 10:53:41 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{C63D01E7-01B2-46D1-90FF-3C75C3FE8FEE} [2012.05.16 10:02:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{155D2572-F3BA-4937-879B-EF0A706D2CE1} [2012.05.16 10:02:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{B46C1653-E8A2-413E-A21E-383DC3AE93F3} [2012.05.15 12:19:05 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{83791854-B717-4965-BA8C-F00286A6A129} [2012.05.15 12:18:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F3085A7-AF42-4D51-A241-70534BD8AF2F} [2012.05.15 11:08:28 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Diablo III [2012.05.15 10:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III [2012.05.15 10:44:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net [2012.05.12 07:47:36 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{5AF14BF9-9DF2-4142-B46F-D3B1039A393C} [2012.05.12 07:47:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{2FCF4905-C1B9-4892-B100-6DDF75C1CD52} [2012.05.10 16:34:19 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\SysWow64\QtCore4.dll [2012.05.10 16:34:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2012.05.10 16:34:18 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll [2012.05.10 16:34:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2012.05.10 16:12:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{E607B543-B60F-4376-BDB2-66B2DFA75FAB} [2012.05.10 16:12:31 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F33CB26-54CB-4A64-B414-F74CBD817B83} [2012.05.10 15:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funcom ========== Files - Modified Within 30 Days ========== [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe [2012.06.07 14:13:49 | 000,000,000 | ---- | M] () -- C:\Users\TomTom\defogger_reenable [2012.06.07 14:13:37 | 000,050,477 | ---- | M] () -- C:\Users\TomTom\Desktop\Defogger.exe [2012.06.07 14:11:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.07 14:11:00 | 4294,254,590 | -HS- | M] () -- C:\hiberfil.sys [2012.06.07 13:58:50 | 005,308,760 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.07 13:58:50 | 000,744,532 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat [2012.06.07 13:58:50 | 000,739,584 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat [2012.06.07 13:58:50 | 000,707,316 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.07 13:58:50 | 000,689,572 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat [2012.06.07 13:58:50 | 000,660,934 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.07 13:58:50 | 000,477,168 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat [2012.06.07 13:58:50 | 000,389,634 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat [2012.06.07 13:58:50 | 000,162,318 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat [2012.06.07 13:58:50 | 000,152,908 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.07 13:58:50 | 000,150,420 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat [2012.06.07 13:58:50 | 000,133,296 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat [2012.06.07 13:58:50 | 000,125,124 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.07 13:58:50 | 000,097,384 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat [2012.06.07 13:58:50 | 000,087,494 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat [2012.06.07 13:57:59 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.07 13:57:27 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe [2012.06.07 12:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.03 10:33:40 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk [2012.05.25 08:16:49 | 000,002,072 | ---- | M] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.05.25 08:16:49 | 000,002,001 | ---- | M] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk [2012.05.24 22:39:55 | 000,000,761 | ---- | M] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk [2012.05.24 19:00:59 | 000,000,731 | ---- | M] () -- C:\Users\Public\Desktop\ARMA II starten.lnk [2012.05.18 15:42:01 | 000,341,432 | ---- | M] () -- C:\Windows\SysNative\perfi00A.dat [2012.05.18 15:42:01 | 000,041,390 | ---- | M] () -- C:\Windows\SysNative\perfd00A.dat [2012.05.18 15:38:14 | 000,229,316 | ---- | M] () -- C:\Windows\SysNative\perfi00D.dat [2012.05.18 15:38:14 | 000,032,166 | ---- | M] () -- C:\Windows\SysNative\perfd00D.dat [2012.05.18 15:29:50 | 000,335,478 | ---- | M] () -- C:\Windows\SysNative\perfi010.dat [2012.05.18 15:29:50 | 000,037,534 | ---- | M] () -- C:\Windows\SysNative\perfd010.dat [2012.05.18 15:26:30 | 000,344,522 | ---- | M] () -- C:\Windows\SysNative\perfi00C.dat [2012.05.18 15:26:30 | 000,289,060 | ---- | M] () -- C:\Windows\SysNative\perfi001.dat [2012.05.18 15:26:30 | 000,042,056 | ---- | M] () -- C:\Windows\SysNative\perfd001.dat [2012.05.18 15:26:30 | 000,038,160 | ---- | M] () -- C:\Windows\SysNative\perfd00C.dat [2012.05.16 08:18:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.05.15 11:02:28 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.12 07:41:26 | 000,294,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.05.10 16:34:19 | 000,000,967 | ---- | M] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk [2012.05.10 15:57:13 | 000,000,757 | ---- | M] () -- C:\Users\Public\Desktop\The Secret World.lnk [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys ========== Files Created - No Company Name ========== [2012.06.07 14:13:49 | 000,000,000 | ---- | C] () -- C:\Users\TomTom\defogger_reenable [2012.06.07 14:13:33 | 000,050,477 | ---- | C] () -- C:\Users\TomTom\Desktop\Defogger.exe [2012.06.07 13:57:59 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.03 10:33:40 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk [2012.05.25 08:16:49 | 000,002,072 | ---- | C] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.05.25 08:16:49 | 000,002,001 | ---- | C] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk [2012.05.24 22:39:55 | 000,000,761 | ---- | C] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk [2012.05.24 19:00:59 | 000,000,731 | ---- | C] () -- C:\Users\Public\Desktop\ARMA II starten.lnk [2012.05.18 15:42:32 | 000,744,532 | ---- | C] () -- C:\Windows\SysNative\perfh00A.dat [2012.05.18 15:42:32 | 000,341,432 | ---- | C] () -- C:\Windows\SysNative\perfi00A.dat [2012.05.18 15:42:32 | 000,162,318 | ---- | C] () -- C:\Windows\SysNative\perfc00A.dat [2012.05.18 15:42:32 | 000,041,390 | ---- | C] () -- C:\Windows\SysNative\perfd00A.dat [2012.05.18 15:38:39 | 000,389,634 | ---- | C] () -- C:\Windows\SysNative\perfh00D.dat [2012.05.18 15:38:39 | 000,229,316 | ---- | C] () -- C:\Windows\SysNative\perfi00D.dat [2012.05.18 15:38:39 | 000,087,494 | ---- | C] () -- C:\Windows\SysNative\perfc00D.dat [2012.05.18 15:38:39 | 000,032,166 | ---- | C] () -- C:\Windows\SysNative\perfd00D.dat [2012.05.18 15:30:20 | 000,739,584 | ---- | C] () -- C:\Windows\SysNative\perfh010.dat [2012.05.18 15:30:20 | 000,335,478 | ---- | C] () -- C:\Windows\SysNative\perfi010.dat [2012.05.18 15:30:20 | 000,150,420 | ---- | C] () -- C:\Windows\SysNative\perfc010.dat [2012.05.18 15:30:20 | 000,037,534 | ---- | C] () -- C:\Windows\SysNative\perfd010.dat [2012.05.18 15:27:05 | 000,289,060 | ---- | C] () -- C:\Windows\SysNative\perfi001.dat [2012.05.18 15:27:04 | 000,689,572 | ---- | C] () -- C:\Windows\SysNative\perfh00C.dat [2012.05.18 15:27:04 | 000,477,168 | ---- | C] () -- C:\Windows\SysNative\perfh001.dat [2012.05.18 15:27:04 | 000,344,522 | ---- | C] () -- C:\Windows\SysNative\perfi00C.dat [2012.05.18 15:27:04 | 000,133,296 | ---- | C] () -- C:\Windows\SysNative\perfc00C.dat [2012.05.18 15:27:04 | 000,097,384 | ---- | C] () -- C:\Windows\SysNative\perfc001.dat [2012.05.18 15:27:04 | 000,042,056 | ---- | C] () -- C:\Windows\SysNative\perfd001.dat [2012.05.18 15:27:04 | 000,038,160 | ---- | C] () -- C:\Windows\SysNative\perfd00C.dat [2012.05.16 08:18:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.05.15 10:46:27 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.10 16:34:19 | 000,000,967 | ---- | C] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk [2012.05.10 15:57:13 | 000,000,757 | ---- | C] () -- C:\Users\Public\Desktop\The Secret World.lnk [2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.01.28 19:48:26 | 000,000,094 | ---- | C] () -- C:\Users\TomTom\AppData\Local\fusioncache.dat [2012.01.28 19:47:55 | 001,619,178 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.11.11 21:28:27 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.11 21:28:26 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.11.11 16:49:12 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.11.11 16:49:06 | 000,028,829 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2011.11.11 16:47:56 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2012.06.07 12:43:28 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\.minecraft [2011.11.29 12:07:09 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Bioshock [2012.05.10 16:34:27 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoft [2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers [2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\GetRightToGo [2012.06.07 14:01:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg [2012.06.07 12:43:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\ICQ [2011.11.11 21:41:54 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Leadertech [2011.11.13 13:28:23 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\OpenOffice.org [2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Origin [2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\RIFT [2012.01.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Sytexis Software [2012.04.29 01:18:53 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Ubisoft [2012.02.20 13:02:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Extras.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 07.06.2012 14:15:55 - Run 1 OTL by OldTimer - Version 3.2.46.2 Folder = C:\Users\TomTom\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 16,00 Gb Total Physical Memory | 14,84 Gb Available Physical Memory | 92,76% Memory free 32,00 Gb Paging File | 30,89 Gb Available in Paging File | 96,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 55,80 Gb Total Space | 12,78 Gb Free Space | 22,90% Space Free | Partition Type: NTFS Drive D: | 2,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive E: | 300,00 Gb Total Space | 252,81 Gb Free Space | 84,27% Space Free | Partition Type: NTFS Drive F: | 631,51 Gb Total Space | 86,56 Gb Free Space | 13,71% Space Free | Partition Type: NTFS Computer Name: TOMTOM-PC | User Name: TomTom | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2012.04.05 21:57:34 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc) SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess) SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.05.26 17:32:39 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.05.10 16:41:27 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.05.10 15:53:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.10 15:53:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- E:\Appz\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- E:\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.12.10 18:16:49 | 000,189,248 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB) SRV - [2011.12.10 18:16:41 | 000,075,136 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.02.16 00:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) DRV:64bit: - [2012.02.16 00:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) DRV:64bit: - [2011.11.15 11:14:02 | 000,126,464 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RzSynapse.sys -- (RzSynapse) DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd) DRV:64bit: - [2011.06.10 08:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.06.02 11:32:50 | 000,401,896 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:64bit: - [2011.06.02 11:32:50 | 000,128,488 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2010.09.29 12:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM) DRV:64bit: - [2010.09.29 12:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2) DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2009.08.24 00:55:32 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV:64bit: - [2009.08.13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl) DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1) DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 17 AB 3D 6E A4 44 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Appz\Java\bin\new_plugin\npjp2.dll File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Appz\Adope Reader X\Reader\AIR\nppdf32.dll File not found FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: E:\Appz\Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: E:\Appz\Firefox\components [2012.06.07 12:39:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: E:\Appz\Firefox\plugins [2011.11.11 18:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Extensions [2012.05.03 18:56:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions [2012.06.07 12:43:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TomTom\AppData\Roaming\mozilla\Firefox\Profiles\79319225.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Appz\Java\bin\jp2ssv.dll File not found O4:64bit: - HKLM..\Run: [EvtMgr6] E:\Appz\Setpoint\SetPointP\SetPoint.exe /launchGaming File not found O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [avgnt] E:\Appz\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Logitech G35] E:\Appz\Logitech G35\G35.exe File not found O4 - HKLM..\Run: [Razer Naga Driver] E:\Appz\Razer Naga\RazerNagaSysTray.exe File not found O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] E:\Appz\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O4 - Startup: C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - E:\Appz\ICQ7.7\ICQ.exe File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D483E299-B9BB-4BCF-BE63-A0A55FBD9C60}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012.01.05 21:30:20 | 000,000,039 | R--- | M] () - D:\Autorun.inf -- [ UDF ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.06.07 14:15:37 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe [2012.06.07 13:58:03 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Malwarebytes [2012.06.07 13:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.06.07 13:57:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.06.07 13:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.06.07 13:56:51 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe [2012.06.07 12:30:10 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg [2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Ubisoft [2012.06.07 00:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft [2012.06.06 19:24:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Rockstar Games [2012.06.06 19:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games [2012.06.06 18:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Rockstar Games [2012.06.06 17:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games [2012.06.03 11:07:55 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\dxhr [2012.06.03 11:07:21 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\28050 [2012.06.03 10:53:01 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDE2B48A-5632-4D42-8BF5-924CF1E0A57F} [2012.06.03 10:52:45 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{EF77C2FA-D8A8-4F52-AECC-AB51AB55B532} [2012.06.03 10:31:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft [2012.06.02 09:39:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{D4FCE0F8-EE3C-4659-A466-90AD2767B776} [2012.06.02 09:39:37 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{4D8BE728-AAC9-49FD-856C-738C3AB88B8C} [2012.06.01 11:51:26 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{366E1564-1267-49A6-B826-DA6C8B61DA38} [2012.06.01 11:51:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{CDBACFB2-5880-4096-A400-873055DC2C7C} [2012.05.31 16:41:39 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{9CFDFF90-2890-4445-94CB-B9F7058E0A24} [2012.05.31 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{661A89E0-C6B3-4623-AA5B-E2C9268527BC} [2012.05.27 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\Star_Vault [2012.05.24 23:00:52 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs [2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\ArmA 2 OA [2012.05.24 22:47:47 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\ArmA 2 [2012.05.24 19:00:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.05.24 18:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.05.18 15:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.05.18 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.05.18 15:50:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2012.05.18 15:45:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA [2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA [2012.05.18 15:45:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\es-ES [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\es [2012.05.18 15:42:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0C0A [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\es-ES [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\es [2012.05.18 15:42:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0C0A [2012.05.18 15:42:06 | 000,000,000 | ---D | C] -- C:\Windows\es-ES [2012.05.18 15:39:13 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\es-ES\pscr.sys.mui [2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerId.sys.mui [2012.05.18 15:39:05 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrSerIb.sys.mui [2012.05.18 15:39:05 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\es-ES\BrParwdm.sys.mui [2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\he-IL [2012.05.18 15:38:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\he [2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\he-IL [2012.05.18 15:38:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\he [2012.05.18 15:38:18 | 000,000,000 | ---D | C] -- C:\Windows\he-IL [2012.05.18 15:35:43 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\he-IL\pscr.sys.mui [2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerId.sys.mui [2012.05.18 15:35:35 | 000,008,704 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrSerIb.sys.mui [2012.05.18 15:35:35 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\he-IL\BrParwdm.sys.mui [2012.05.18 15:35:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sl-SI [2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sl-SI [2012.05.18 15:35:05 | 000,000,000 | ---D | C] -- C:\Windows\sl-SI [2012.05.18 15:30:03 | 000,000,000 | ---D | C] -- C:\Windows\it-IT [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\it-IT [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\it [2012.05.18 15:30:01 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0410 [2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\it-IT [2012.05.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0410 [2012.05.18 15:29:55 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\it [2012.05.18 15:27:36 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\it-IT\pscr.sys.mui [2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerId.sys.mui [2012.05.18 15:27:28 | 000,011,264 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrSerIb.sys.mui [2012.05.18 15:27:28 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\it-IT\BrParwdm.sys.mui [2012.05.18 15:26:47 | 000,000,000 | ---D | C] -- C:\Windows\fr-FR [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\fr-FR [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\fr [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ar-SA [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ar [2012.05.18 15:26:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\040C [2012.05.18 15:26:42 | 000,000,000 | ---D | C] -- C:\Windows\ar-SA [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\fr-FR [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\fr [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\ar-SA [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ar [2012.05.18 15:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\040C [2012.05.18 15:24:05 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\ar-SA\pscr.sys.mui [2012.05.18 15:23:56 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerIb.sys.mui [2012.05.18 15:23:55 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrSerId.sys.mui [2012.05.18 15:23:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\ar-SA\BrParwdm.sys.mui [2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en [2012.05.18 15:23:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409 [2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\sk-SK [2012.05.18 15:23:14 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US [2012.05.18 15:23:13 | 000,000,000 | ---D | C] -- C:\Windows\sk-SK [2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en [2012.05.18 15:23:12 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409 [2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\sk-SK [2012.05.18 15:23:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\en-US [2012.05.18 15:21:02 | 000,003,584 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\en-US\pscr.sys.mui [2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerId.sys.mui [2012.05.18 15:20:55 | 000,010,240 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrSerIb.sys.mui [2012.05.18 15:20:55 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\en-US\BrParwdm.sys.mui [2012.05.17 10:53:53 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{485CB5D6-D82B-484D-8685-62226625857B} [2012.05.17 10:53:41 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{C63D01E7-01B2-46D1-90FF-3C75C3FE8FEE} [2012.05.16 10:02:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{155D2572-F3BA-4937-879B-EF0A706D2CE1} [2012.05.16 10:02:12 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{B46C1653-E8A2-413E-A21E-383DC3AE93F3} [2012.05.15 12:19:05 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{83791854-B717-4965-BA8C-F00286A6A129} [2012.05.15 12:18:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F3085A7-AF42-4D51-A241-70534BD8AF2F} [2012.05.15 11:08:28 | 000,000,000 | ---D | C] -- C:\Users\TomTom\Documents\Diablo III [2012.05.15 10:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III [2012.05.15 10:44:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net [2012.05.12 07:47:36 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{5AF14BF9-9DF2-4142-B46F-D3B1039A393C} [2012.05.12 07:47:25 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{2FCF4905-C1B9-4892-B100-6DDF75C1CD52} [2012.05.10 16:34:19 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\SysWow64\QtCore4.dll [2012.05.10 16:34:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2012.05.10 16:34:18 | 000,405,176 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll [2012.05.10 16:34:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2012.05.10 16:12:52 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{E607B543-B60F-4376-BDB2-66B2DFA75FAB} [2012.05.10 16:12:31 | 000,000,000 | ---D | C] -- C:\Users\TomTom\AppData\Local\{3F33CB26-54CB-4A64-B414-F74CBD817B83} [2012.05.10 15:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funcom ========== Files - Modified Within 30 Days ========== [2012.06.07 14:15:46 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\TomTom\Desktop\OTL.exe [2012.06.07 14:13:49 | 000,000,000 | ---- | M] () -- C:\Users\TomTom\defogger_reenable [2012.06.07 14:13:37 | 000,050,477 | ---- | M] () -- C:\Users\TomTom\Desktop\Defogger.exe [2012.06.07 14:11:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.07 14:11:00 | 4294,254,590 | -HS- | M] () -- C:\hiberfil.sys [2012.06.07 13:58:50 | 005,308,760 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.07 13:58:50 | 000,744,532 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat [2012.06.07 13:58:50 | 000,739,584 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat [2012.06.07 13:58:50 | 000,707,316 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.07 13:58:50 | 000,689,572 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat [2012.06.07 13:58:50 | 000,660,934 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.07 13:58:50 | 000,477,168 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat [2012.06.07 13:58:50 | 000,389,634 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat [2012.06.07 13:58:50 | 000,162,318 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat [2012.06.07 13:58:50 | 000,152,908 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.07 13:58:50 | 000,150,420 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat [2012.06.07 13:58:50 | 000,133,296 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat [2012.06.07 13:58:50 | 000,125,124 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.07 13:58:50 | 000,097,384 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat [2012.06.07 13:58:50 | 000,087,494 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat [2012.06.07 13:57:59 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.07 13:57:27 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\TomTom\Desktop\mbam-setup-1.61.0.1400.exe [2012.06.07 12:40:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.07 11:33:23 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.03 10:33:40 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk [2012.05.25 08:16:49 | 000,002,072 | ---- | M] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.05.25 08:16:49 | 000,002,001 | ---- | M] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk [2012.05.24 22:39:55 | 000,000,761 | ---- | M] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk [2012.05.24 19:00:59 | 000,000,731 | ---- | M] () -- C:\Users\Public\Desktop\ARMA II starten.lnk [2012.05.18 15:42:01 | 000,341,432 | ---- | M] () -- C:\Windows\SysNative\perfi00A.dat [2012.05.18 15:42:01 | 000,041,390 | ---- | M] () -- C:\Windows\SysNative\perfd00A.dat [2012.05.18 15:38:14 | 000,229,316 | ---- | M] () -- C:\Windows\SysNative\perfi00D.dat [2012.05.18 15:38:14 | 000,032,166 | ---- | M] () -- C:\Windows\SysNative\perfd00D.dat [2012.05.18 15:29:50 | 000,335,478 | ---- | M] () -- C:\Windows\SysNative\perfi010.dat [2012.05.18 15:29:50 | 000,037,534 | ---- | M] () -- C:\Windows\SysNative\perfd010.dat [2012.05.18 15:26:30 | 000,344,522 | ---- | M] () -- C:\Windows\SysNative\perfi00C.dat [2012.05.18 15:26:30 | 000,289,060 | ---- | M] () -- C:\Windows\SysNative\perfi001.dat [2012.05.18 15:26:30 | 000,042,056 | ---- | M] () -- C:\Windows\SysNative\perfd001.dat [2012.05.18 15:26:30 | 000,038,160 | ---- | M] () -- C:\Windows\SysNative\perfd00C.dat [2012.05.16 08:18:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.05.15 11:02:28 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.12 07:41:26 | 000,294,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.05.10 16:34:19 | 000,000,967 | ---- | M] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk [2012.05.10 15:57:13 | 000,000,757 | ---- | M] () -- C:\Users\Public\Desktop\The Secret World.lnk [2012.05.10 15:53:01 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.05.10 15:53:01 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys ========== Files Created - No Company Name ========== [2012.06.07 14:13:49 | 000,000,000 | ---- | C] () -- C:\Users\TomTom\defogger_reenable [2012.06.07 14:13:33 | 000,050,477 | ---- | C] () -- C:\Users\TomTom\Desktop\Defogger.exe [2012.06.07 13:57:59 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.03 10:33:40 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\Tom Clancy's Splinter Cell Chaos Theory.lnk [2012.05.25 08:16:49 | 000,002,072 | ---- | C] () -- C:\Users\TomTom\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.05.25 08:16:49 | 000,002,001 | ---- | C] () -- C:\Users\TomTom\Desktop\Avira DE-Cleaner.lnk [2012.05.24 22:39:55 | 000,000,761 | ---- | C] () -- C:\Users\Public\Desktop\ARMA 2 Combined Operations.lnk [2012.05.24 19:00:59 | 000,000,731 | ---- | C] () -- C:\Users\Public\Desktop\ARMA II starten.lnk [2012.05.18 15:42:32 | 000,744,532 | ---- | C] () -- C:\Windows\SysNative\perfh00A.dat [2012.05.18 15:42:32 | 000,341,432 | ---- | C] () -- C:\Windows\SysNative\perfi00A.dat [2012.05.18 15:42:32 | 000,162,318 | ---- | C] () -- C:\Windows\SysNative\perfc00A.dat [2012.05.18 15:42:32 | 000,041,390 | ---- | C] () -- C:\Windows\SysNative\perfd00A.dat [2012.05.18 15:38:39 | 000,389,634 | ---- | C] () -- C:\Windows\SysNative\perfh00D.dat [2012.05.18 15:38:39 | 000,229,316 | ---- | C] () -- C:\Windows\SysNative\perfi00D.dat [2012.05.18 15:38:39 | 000,087,494 | ---- | C] () -- C:\Windows\SysNative\perfc00D.dat [2012.05.18 15:38:39 | 000,032,166 | ---- | C] () -- C:\Windows\SysNative\perfd00D.dat [2012.05.18 15:30:20 | 000,739,584 | ---- | C] () -- C:\Windows\SysNative\perfh010.dat [2012.05.18 15:30:20 | 000,335,478 | ---- | C] () -- C:\Windows\SysNative\perfi010.dat [2012.05.18 15:30:20 | 000,150,420 | ---- | C] () -- C:\Windows\SysNative\perfc010.dat [2012.05.18 15:30:20 | 000,037,534 | ---- | C] () -- C:\Windows\SysNative\perfd010.dat [2012.05.18 15:27:05 | 000,289,060 | ---- | C] () -- C:\Windows\SysNative\perfi001.dat [2012.05.18 15:27:04 | 000,689,572 | ---- | C] () -- C:\Windows\SysNative\perfh00C.dat [2012.05.18 15:27:04 | 000,477,168 | ---- | C] () -- C:\Windows\SysNative\perfh001.dat [2012.05.18 15:27:04 | 000,344,522 | ---- | C] () -- C:\Windows\SysNative\perfi00C.dat [2012.05.18 15:27:04 | 000,133,296 | ---- | C] () -- C:\Windows\SysNative\perfc00C.dat [2012.05.18 15:27:04 | 000,097,384 | ---- | C] () -- C:\Windows\SysNative\perfc001.dat [2012.05.18 15:27:04 | 000,042,056 | ---- | C] () -- C:\Windows\SysNative\perfd001.dat [2012.05.18 15:27:04 | 000,038,160 | ---- | C] () -- C:\Windows\SysNative\perfd00C.dat [2012.05.16 08:18:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.05.15 10:46:27 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk [2012.05.10 16:34:19 | 000,000,967 | ---- | C] () -- C:\Users\TomTom\Desktop\Free YouTube to MP3 Converter.lnk [2012.05.10 15:57:13 | 000,000,757 | ---- | C] () -- C:\Users\Public\Desktop\The Secret World.lnk [2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.01.28 19:48:26 | 000,000,094 | ---- | C] () -- C:\Users\TomTom\AppData\Local\fusioncache.dat [2012.01.28 19:47:55 | 001,619,178 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.11.11 21:28:27 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.11 21:28:26 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.11.11 16:49:12 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.11.11 16:49:06 | 000,028,829 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2011.11.11 16:47:56 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2012.06.07 12:43:28 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\.minecraft [2011.11.29 12:07:09 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Bioshock [2012.05.10 16:34:27 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoft [2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\DVDVideoSoftIEHelpers [2012.06.07 12:43:44 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\GetRightToGo [2012.06.07 14:01:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Gxpnnufkiqg [2012.06.07 12:43:48 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\ICQ [2011.11.11 21:41:54 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Leadertech [2011.11.13 13:28:23 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\OpenOffice.org [2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Origin [2012.06.07 12:44:01 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\RIFT [2012.01.07 16:09:20 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Sytexis Software [2012.04.29 01:18:53 | 000,000,000 | ---D | M] -- C:\Users\TomTom\AppData\Roaming\Ubisoft [2012.02.20 13:02:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Geändert von Taproot1976 (07.06.2012 um 13:20 Uhr) |
|
10.06.2012, 00:56
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Befall vom Windows Verschlüsselungstrojaner Allgemeine Hinweise bzgl. des Verschlüsselungstrojaners:
__________________Wann genau deine Daten entschlüsselt werden können wird dir niemand genau sagen können außer vllt einer  es kann sein, dass du eine neuere Variante hast, deren Verschlüsselungsalgorithmus noch unbekannt ist. Sowas kann man (noch) nicht entschlüsseln und ohne Schlüssel schon garnicht - ist ja auch logisch, sonst wär es ja keine vernünftige Verschlüsselung Einfach hier nochmal reinsehen in regelmäßigen Abständen, obige Hinweise beachten. 8 Tools mitsamt hunderten Diskussionsbeiträgen stehen da schon Eine Notlösung für Vista und Win7-User => http://www.trojaner-board.de/115496-...erstellen.html Entschlüsselungsversuche der verschlüsselten Dateien sind nur auf zusätzliche Kopien der verschlüsselten Dateien anzuwenden, sonst zerhackt man sich die noch weiter ohne die "original" verschlüsselte Datei mehr zu haben. Das willst du sicher nicht! Man darf sich aber keine falschen Hoffnungen machen. Mittlerweile sieht es finster aus => Delphi-PRAXiS - Einzelnen Beitrag anzeigen - Verschlüsselungs-Trojaner, Hilfe benötigt Und in Zukunft willst du sicher mal an ein besseres Backupkonzept denken. Hier ein Denkanstoß => http://www.trojaner-board.de/115678-...r-backups.html Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
| Themen zu Befall vom Windows Verschlüsselungstrojaner |
| administrator, anti-malware, appdata, autostart, befall, dateien, dateisystem, device driver, entschlüsseln, ergebnis, explorer, forum, gelöscht, gen, heuristiks/extra, heuristiks/shuriken, langs, launch, microsoft, plug-in, quarantäne, roaming, scan, searchscopes, software, speicher, system, total, trojan.agent, trojaner, version, version=1.0, windows, windows verschlüsselungstrojaner |
