| |
| |||||||
Log-Analyse und Auswertung: Pc gesperrt durch GVU 2.07Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
16.07.2012, 22:23
| #1 |
| |  Pc gesperrt durch GVU 2.07 Hallo ich habe mir heute Mittag leider den Trojaner GVU 2.07 eingefangen und seitdem sperrt sich mein PC immer wieder. Die ersten Schritte habe ich bereits abgearbeitet und die Logfiles erstellt. Ich hoffe ihr könnt mir helfen. Bei Malwarebytes Anti-Malware kamen beim ersten Scan 2 infizierte Objekte zum Vorschein welche erfolgreich entfernt wurden. Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.16.11 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7601.17514 Stephen :: WINTENDO [Administrator] Schutz: Deaktiviert 16.07.2012 22:56:43 mbam-log-2012-07-16 (22-56-43).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 225462 Laufzeit: 1 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Stephen\AppData\Local\Temp\fest0r_ot.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Stephen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Anti-Malware: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.16.11 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7601.17514 Stephen :: WINTENDO [Administrator] Schutz: Deaktiviert 16.07.2012 23:01:40 mbam-log-2012-07-16 (23-01-40).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 225231 Laufzeit: 2 Minute(n), 16 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Otl.txt: Code:
ATTFilter OTL logfile created on: 16.07.2012 23:17:26 - Run 3 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Stephen\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,99 Gb Total Physical Memory | 6,99 Gb Available Physical Memory | 87,47% Memory free 15,98 Gb Paging File | 15,07 Gb Available in Paging File | 94,33% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 62,40 Gb Total Space | 18,23 Gb Free Space | 29,21% Space Free | Partition Type: NTFS Drive D: | 37,49 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Drive F: | 235,59 Gb Total Space | 36,46 Gb Free Space | 15,48% Space Free | Partition Type: NTFS Drive G: | 931,51 Gb Total Space | 424,53 Gb Free Space | 45,57% Space Free | Partition Type: NTFS Computer Name: WINTENDO | User Name: Stephen | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Stephen\Desktop\OTL.exe (OldTimer Tools) PRC - F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.) ========== Modules (No Company Name) ========== MOD - F:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (MBAMService) -- f:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AntiVirService) -- F:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirSchedulerService) -- F:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (DAUpdaterSvc) -- f:\Spiele\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation) DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation) DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation) DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (RTL8187B) -- C:\Windows\SysNative\drivers\wg111v3.sys (NETGEAR Inc. ) DRV:64bit: - (USBMULCD) -- C:\Windows\SysNative\drivers\CM10664.sys (C-Media Electronics Inc) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (tandpl) -- C:\Windows\SysWOW64\drivers\tandpl.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 C8 8F 56 B1 A7 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.eintracht.de/aktuell/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: cache@status.org:0.7.10 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2 FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.9.3 FF - prefs.js..extensions.enabledItems: {9fb7d178-155a-4318-9173-1a8eaaea7fe4}:2.1.10 FF - prefs.js..extensions.enabledItems: {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}:0.9.6 FF - prefs.js..extensions.enabledItems: {6e764c17-863a-450f-bdd0-6772bd5aaa18}:1.0.3 FF - prefs.js..extensions.enabledItems: {1f91cde0-c040-11da-a94d-0800200c9a66}:4.1 FF - prefs.js..extensions.enabledItems: unplug@compunach:2.047 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 5 FF - prefs.js..extensions.enabledItems: 3 FF - prefs.js..extensions.enabledItems: 1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: F:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: F:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.06.28 20:14:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: f:\Programme\Mozilla Thunderbird\components [2012.07.11 19:23:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: f:\Programme\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: F:\Programme\Mozilla Firefox\components [2012.06.28 20:14:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: F:\Programme\Mozilla Thunderbird\components [2012.07.11 19:23:36 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: F:\Programme\Mozilla Thunderbird\plugins [2011.11.20 21:21:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Extensions [2012.07.15 20:10:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions [2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Forecastbar Enhanced) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8} [2012.03.23 15:06:48 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} [2011.11.20 21:23:52 | 000,000,000 | ---D | M] (Media Converter) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18} [2012.03.29 20:19:51 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.11.20 21:23:51 | 000,000,000 | ---D | M] (Cache Status) -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\cache@status.org [2011.11.20 21:23:51 | 000,000,000 | ---D | M] ("VideoDownloader") -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\extensions\videodowloader@videodownloader.net [2007.09.04 22:40:48 | 000,005,310 | ---- | M] () -- C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\searchplugins\footiefox.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] F:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKCU..\Run: [spdetector3] F:\Spiele\Spyware Process Detector\spd322.exe TRAY File not found O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] f:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3FE1837E-A7A5-454D-AF63-834A229B0B55}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AC9CBB97-2633-4264-93F3-82DF373F475C}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{61170929-13a0-11e1-8fb8-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{61170929-13a0-11e1-8fb8-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe O33 - MountPoints2\{a3657d68-9a94-11e1-aa06-90e6ba1df6b9}\Shell - "" = AutoRun O33 - MountPoints2\{a3657d68-9a94-11e1-aa06-90e6ba1df6b9}\Shell\AutoRun\command - "" = E:\launcher.exe O33 - MountPoints2\{b5fba9fa-3db7-11e1-a19f-90e6ba1df6b9}\Shell - "" = AutoRun O33 - MountPoints2\{b5fba9fa-3db7-11e1-a19f-90e6ba1df6b9}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.16 22:54:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\Malwarebytes [2012.07.16 22:54:37 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.16 22:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.16 22:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.16 22:39:27 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Stephen\Desktop\OTL.exe [2012.07.16 13:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis [2012.07.12 13:23:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jagged Alliance 2 Unfinished Business [2012.07.12 13:20:32 | 000,305,664 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe [2012.07.11 15:59:25 | 000,000,000 | ---D | C] -- C:\Windows\Robin Hood 1.0 [2012.07.11 14:38:54 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012.07.11 14:38:54 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012.07.11 14:38:49 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.07.11 14:38:44 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.07.11 14:38:44 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.07.11 14:38:38 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012.07.11 14:38:38 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012.07.10 22:41:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\LucasArts [2012.07.10 22:41:46 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\LucasArts [2012.07.10 19:38:12 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\SIX_Projects [2012.07.10 13:09:45 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\ArmA 2 Other Profiles [2012.07.10 13:02:38 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\six-zsync [2012.07.10 13:02:38 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Roaming\six-updater [2012.07.10 13:00:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Six Projects [2012.07.10 12:59:41 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Downloaded Installations [2012.07.10 12:57:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2012.07.10 12:46:12 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\ArmA 2 OA [2012.07.10 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Stephen\Documents\ArmA 2 [2012.07.10 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\ArmA 2 [2012.07.10 12:34:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive [2012.07.08 14:44:55 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Activision [2012.07.05 00:52:25 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2012.06.26 13:23:50 | 000,000,000 | ---D | C] -- C:\Users\Stephen\AppData\Local\Macromedia [2012.06.26 11:42:59 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.06.25 18:40:19 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012.06.25 18:40:19 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012.06.25 18:40:18 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012.06.25 18:40:11 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012.06.25 18:40:11 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012.06.25 18:40:11 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012.06.25 18:40:00 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012.06.25 18:40:00 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.16 23:05:13 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.16 23:05:13 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.16 23:05:13 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.16 23:00:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.16 23:00:42 | 2140,495,871 | -HS- | M] () -- C:\hiberfil.sys [2012.07.16 22:54:38 | 000,000,754 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.16 15:20:25 | 004,503,728 | ---- | M] () -- C:\ProgramData\to_r0tsef.pad [2012.07.16 13:50:35 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.16 13:50:35 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.16 13:33:39 | 000,000,926 | ---- | M] () -- C:\Users\Stephen\Desktop\HijackThis.lnk [2012.07.12 13:23:50 | 000,000,604 | ---- | M] () -- C:\Users\Public\Desktop\Jagged Alliance 2 Unfinished Business.lnk [2012.07.12 12:33:46 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.11 23:57:07 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Stephen\Desktop\OTL.exe [2012.07.10 19:08:40 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.10 19:08:40 | 000,002,573 | ---- | M] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.10 18:50:12 | 000,001,468 | ---- | M] () -- C:\Users\Stephen\Desktop\Day Z.lnk [2012.07.10 00:38:16 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\ARMA 2.url [2012.07.10 00:38:16 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\ARMA 2 Operation Arrowhead.url [2012.07.08 11:49:20 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops - Multiplayer.url [2012.07.07 17:48:33 | 002,037,347 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-696708.png [2012.07.07 17:43:26 | 000,085,397 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-141766.jpg [2012.07.07 17:43:12 | 001,495,389 | ---- | M] () -- C:\Users\Stephen\Desktop\wallpaper-44535.jpg [2012.07.07 17:11:51 | 000,000,208 | ---- | M] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops.url [2012.07.07 14:57:09 | 000,156,950 | ---- | M] () -- C:\Users\Stephen\Desktop\2012_07_07 - Informationen Landeslager 2012.pdf [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.03 13:34:29 | 000,200,489 | ---- | M] () -- C:\Users\Stephen\Desktop\Foto.jpg [2012.07.03 13:34:29 | 000,002,130 | ---- | M] () -- C:\Users\Stephen\.recently-used.xbel [2012.06.27 13:59:59 | 002,155,392 | ---- | M] () -- C:\Users\Stephen\Desktop\2010_10 - Kirchentag 2010 - Thomas Weyh - 082.jpg [2012.06.26 11:42:59 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.06.26 11:42:59 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.16 22:54:38 | 000,000,754 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.16 13:33:39 | 000,000,926 | ---- | C] () -- C:\Users\Stephen\Desktop\HijackThis.lnk [2012.07.16 13:19:14 | 004,503,728 | ---- | C] () -- C:\ProgramData\to_r0tsef.pad [2012.07.12 13:23:50 | 000,000,604 | ---- | C] () -- C:\Users\Public\Desktop\Jagged Alliance 2 Unfinished Business.lnk [2012.07.10 18:50:12 | 000,001,468 | ---- | C] () -- C:\Users\Stephen\Desktop\Day Z.lnk [2012.07.10 13:00:18 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Updater.lnk [2012.07.10 13:00:18 | 000,002,573 | ---- | C] () -- C:\Users\Public\Desktop\Six Launcher.lnk [2012.07.10 00:38:16 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\ARMA 2.url [2012.07.10 00:38:16 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\ARMA 2 Operation Arrowhead.url [2012.07.08 11:49:20 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops - Multiplayer.url [2012.07.07 17:48:32 | 002,037,347 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-696708.png [2012.07.07 17:43:25 | 000,085,397 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-141766.jpg [2012.07.07 17:43:10 | 001,495,389 | ---- | C] () -- C:\Users\Stephen\Desktop\wallpaper-44535.jpg [2012.07.07 17:11:51 | 000,000,208 | ---- | C] () -- C:\Users\Stephen\Desktop\Call of Duty Black Ops.url [2012.07.07 14:57:09 | 000,156,950 | ---- | C] () -- C:\Users\Stephen\Desktop\2012_07_07 - Informationen Landeslager 2012.pdf [2012.07.03 13:34:29 | 000,200,489 | ---- | C] () -- C:\Users\Stephen\Desktop\Foto.jpg [2012.07.03 13:34:29 | 000,002,130 | ---- | C] () -- C:\Users\Stephen\.recently-used.xbel [2012.06.27 13:59:57 | 002,155,392 | ---- | C] () -- C:\Users\Stephen\Desktop\2010_10 - Kirchentag 2010 - Thomas Weyh - 082.jpg [2012.06.14 21:42:33 | 000,007,552 | ---- | C] () -- C:\Windows\SysWow64\drivers\enodpl.sys [2012.06.14 21:42:33 | 000,004,736 | ---- | C] () -- C:\Windows\SysWow64\drivers\tandpl.sys [2012.04.27 13:09:59 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI [2012.04.27 13:09:59 | 000,000,151 | ---- | C] () -- C:\Windows\BRVIDEO.INI [2012.04.27 13:09:59 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\brlmw03a.ini [2012.04.27 13:09:59 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini [2012.04.27 13:09:54 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2012.04.27 13:09:34 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\bd2030.dat [2012.04.27 13:09:19 | 000,000,324 | ---- | C] () -- C:\Windows\Brownie.ini [2012.03.27 18:44:45 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll [2012.03.27 18:44:45 | 000,000,606 | ---- | C] () -- C:\Windows\Cm106.ini.cfl [2012.03.27 18:44:38 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg [2012.03.27 18:44:38 | 000,001,111 | ---- | C] () -- C:\Windows\Cm106.ini.imi [2012.03.27 18:44:38 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini [2011.12.12 15:09:02 | 000,007,605 | ---- | C] () -- C:\Users\Stephen\AppData\Local\Resmon.ResmonCfg [2011.11.21 21:29:11 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.21 21:29:09 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat ========== LOP Check ========== [2012.05.10 21:14:57 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\DAEMON Tools Lite [2011.11.20 20:29:53 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Firefly Studios [2012.07.03 13:34:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\gtk-2.0 [2012.07.12 19:55:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Mumble [2012.02.07 13:54:20 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\OpenOffice.org [2011.11.20 20:37:42 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Origin [2012.07.10 19:38:28 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\six-updater [2012.07.10 13:02:38 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\six-zsync [2011.11.20 21:21:29 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\Thunderbird [2011.12.18 21:30:37 | 000,000,000 | ---D | M] -- C:\Users\Stephen\AppData\Roaming\TS3Client [2012.07.15 19:18:19 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 16.07.2012 23:17:26 - Run 3
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Stephen\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,99 Gb Total Physical Memory | 6,99 Gb Available Physical Memory | 87,47% Memory free
15,98 Gb Paging File | 15,07 Gb Available in Paging File | 94,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 62,40 Gb Total Space | 18,23 Gb Free Space | 29,21% Space Free | Partition Type: NTFS
Drive D: | 37,49 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 235,59 Gb Total Space | 36,46 Gb Free Space | 15,48% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 424,53 Gb Free Space | 45,57% Space Free | Partition Type: NTFS
Computer Name: WINTENDO | User Name: Stephen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "F:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027451E6-F052-4CF7-AE1D-62942660B277}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe |
"{08B9A03A-1388-46E7-9DE1-6AA033B6EF9B}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe |
"{0DBA2BD6-55C7-4678-BF4D-DA67FE1142BB}" = protocol=17 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe |
"{0F87BEAB-B66C-4277-B96F-747D69611FFF}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{0F90104C-0F88-4C26-8530-BCEDF74684D6}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{180B684A-93B7-442D-9382-F28E4E47FEFF}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"{22350A5F-E0BB-4BCC-AC76-477162271E39}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackops.exe |
"{228C8C18-3155-4162-A381-1FFCC34AA5D3}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2\arma2.exe |
"{25810D1F-1075-42F0-A9C9-7A0F6CC6E443}" = protocol=17 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe |
"{25E7FBFD-9ABF-4250-94C9-BB3908640B48}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{29CD95B5-6BB2-4E81-918E-3EA37F96C644}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{3042F64E-64A0-48AB-A291-AE9CCA7BA143}" = protocol=17 | dir=in | app=f:\spiele\dragon age\daoriginslauncher.exe |
"{318E62F2-6D65-4110-85BE-37135720CB4C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3F6C98C1-26E9-47B1-9FFD-7EE12EE9C745}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe |
"{413C26BA-6D22-4462-87B8-D205F28F79A6}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{46A6D998-C39B-46C4-A0AA-9074C36AEE1E}" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\daupdatersvc.service.exe |
"{4C327D12-65C8-4C7A-85F7-9864AC4699C3}" = protocol=6 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe |
"{4D8097AC-5156-4DEA-ABD4-EFF8F059CA83}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"{500A768E-9F96-44F6-A477-45C1CC4680E4}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{54999449-5A06-4396-9659-84CA1DC26509}" = protocol=17 | dir=in | app=f:\spiele\steam\steam.exe |
"{5566C16B-73CF-479C-A8DA-F3F3DFCF4D87}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{55D2AF4F-9908-41CF-A3B9-07674CE360DA}" = protocol=17 | dir=in | app=f:\spiele\origin\dragon age ii\dragonage2launcher.exe |
"{56EEBE52-0182-46E4-BCA6-94AD8E2F85D7}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackops.exe |
"{57D3909E-A1B4-48E1-9A22-03778CDC5529}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2\arma2.exe |
"{5A6BF72B-27ED-4508-879A-5307F3CC869C}" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\daupdatersvc.service.exe |
"{61134A4D-E671-46AF-A4EB-ED04B45959CA}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{65627542-091A-43E6-91DE-CEC7A9BF02BE}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"{65E5D860-CE44-46E6-A1FC-7CD5A918D0B9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{6B64A522-484A-4D98-B22D-840D523E4323}" = protocol=6 | dir=in | app=f:\spiele\origin\battlefield 3\bf3.exe |
"{7673F7CD-42B9-4AA4-B2D6-45D31199C842}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe |
"{79937271-37D7-4851-9937-6A57B382C262}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{7DF03487-A2DB-4F52-9ABE-31F86720D922}" = protocol=17 | dir=in | app=f:\spiele\origin\origin.exe |
"{88597EEB-1759-4B99-98E7-7C2A1AD9DA90}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{8A9D947E-81A0-4336-AD9E-9A5411573621}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{8B89D069-54AE-40EE-89B0-78EC2FE5CD7C}" = protocol=6 | dir=in | app=f:\spiele\dragon age\daoriginslauncher.exe |
"{8BC8EAD1-D757-4CD0-AFC9-02BE71166F56}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"{93079DDA-091F-40B4-B7BA-D6E587699C3C}" = protocol=6 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"{95888643-2D5B-4189-9A97-34DFBBF0D15B}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{9CB4A215-83CA-48E9-8223-8583A907A33B}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9ED901BC-692C-4EBC-A4E5-CE1DEDA0878D}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{A53E61AD-78B9-4D86-BA22-EA6BABC1D72E}" = protocol=6 | dir=in | app=f:\spiele\origin\dragon age ii\dragonage2launcher.exe |
"{A78E400E-D480-4C00-847F-652FEDBA3F5F}" = dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe |
"{AC4D4C88-0E49-47AD-B63D-C67BBE30323D}" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\daorigins.exe |
"{B105D390-6F9C-45BA-9C32-3ED3B350506E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B9CF66FB-57ED-4805-A27F-80D16DB837EA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BAACAD87-96E5-4EA7-BDEC-F38088AB115A}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{BF193458-FA7F-4B72-8669-DEAB4335B4D4}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{C3E20DA0-BABC-4571-819D-01C00D56616B}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{C6224BFD-D71C-438B-A0DE-C54316D8A53A}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{C8C0C5B5-C8DC-42E2-9DFA-D592F38C9ADA}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{D149632F-329D-4B9A-8A00-ACEC3604D5F0}" = protocol=6 | dir=in | app=f:\spiele\origin\origin.exe |
"{D2D7E517-D0A0-41F8-A2B6-217BDE980140}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{DEFFADF6-1A32-44CA-AF0A-24C4B130812C}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{E3D5B7C5-1DBD-4604-AA93-BE1297A5ABC8}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe |
"{E8854269-3EE0-4044-9987-9533A4CAA5F0}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{EAFFC1AB-CBBA-434D-9311-9E3ACE5D058C}" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{EC4892EF-0E6D-4993-A5A9-3ABCB07868B4}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\swtor\retailclient\swtor.exe |
"{ED0D1FBB-7C9F-455F-BC14-C1AB7241BF29}" = protocol=17 | dir=in | app=f:\spiele\origin\dragon age ii\bin_ship\dragonage2.exe |
"{F06334BF-B1A1-45AB-BB94-C734E339DF02}" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\borderlands\binaries\borderlands.exe |
"{F0D8DE4A-5A91-46B4-9F65-C7859694AEC4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{F11B9749-A66F-4E03-85E0-CB3DC76D1AD9}" = protocol=6 | dir=in | app=f:\spiele\steam\steam.exe |
"{FA3D2268-1152-431D-9C3F-B41C8BD51AA5}" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\daorigins.exe |
"{FA7D0EAF-7035-45BB-9E1C-C5F62BEB7227}" = protocol=6 | dir=in | app=f:\spiele\origin\dragon age ii\bin_ship\dragonage2.exe |
"{FCF3FBE7-C082-4715-B4BF-5D227E309A3B}" = dir=in | app=f:\programme\itunes\itunes.exe |
"{FD6DA577-2806-4DBB-AA83-D094D4214434}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{FF7A2437-7EDF-4771-BF4B-AD23F741E48D}" = protocol=17 | dir=in | app=f:\spiele\origin\star wars - the old republic\launcher.exe |
"TCP Query User{141A0693-D5B9-467B-B215-421D3F18223F}F:\spiele\six projects\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=f:\spiele\six projects\six updater\tools\bin\rsync.exe |
"TCP Query User{34AF3E86-DD39-4590-94C6-ECA5F540B5D3}F:\spiele\dragon age\bin_ship\eacoreserver.exe" = protocol=6 | dir=in | app=f:\spiele\dragon age\bin_ship\eacoreserver.exe |
"TCP Query User{84650A9F-BE15-48FE-893D-16F060C33D87}F:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"TCP Query User{ACE2BBFC-902A-49BB-A722-676C5978FC89}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{AE09CC18-B536-4AFF-B8DD-A69816EB5E03}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{0833EF93-02D2-4490-B801-8276AC536338}F:\spiele\six projects\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=f:\spiele\six projects\six updater\tools\bin\rsync.exe |
"UDP Query User{53A01890-77D4-4C13-A84F-042ED4A33EB9}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{56A9D6E6-8E13-481A-AADA-46875F8F9CAF}F:\spiele\dragon age\bin_ship\eacoreserver.exe" = protocol=17 | dir=in | app=f:\spiele\dragon age\bin_ship\eacoreserver.exe |
"UDP Query User{681097DF-D70A-455C-9CB7-47A4FCBA87BD}F:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=f:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"UDP Query User{C55314AF-F50C-4469-B3C7-7A794D86151D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"C-Media CM106 Like Sound Driver" = MEDUSA NX USB 5.1 Gaming Headset
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D565319-8B91-41CB-961C-0DDC86101AC5}" = Dragon Age II
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{BAF227A2-E214-49E3-9137-94A300EA85BA}" = iPhone-Konfigurationsprogramm
"{C3E9887A-23BA-4777-8080-191A5AFCAB74}" = Mumble 1.2.3
"{D08A5DFE-F0C2-74FC-DD56-A3B371E9344D}" = EA Shared Game Component: Activation
"{D1D632A2-E249-466D-A094-B1B934D37645}_is1" = Stronghold Kingdoms
"{D4F9AFB7-40AB-494F-AEEB-67EF8DC8A609}" = Brother HL-2035
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Assassins Creed: Revelations Rip_is1" = Assassins Creed Revelations
"Avira AntiVir Desktop" = Avira Free Antivirus
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for A2" = BattlEye Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"com.ea.Activation.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Shared Game Component: Activation
"DAEMON Tools Lite" = DAEMON Tools Lite
"EA Installer.283229647" = EA Installer
"ESN Sonar-0.70.4" = ESN Sonar
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"Fraps" = Fraps (remove only)
"FUSSBALL MANAGER 12" = FUSSBALL MANAGER 12
"HijackThis" = HijackThis 2.0.2
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"Jagged Alliance 2: Unfinished Business" = Jagged Alliance 2: Unfinished Business
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Steam App 33910" = ARMA 2
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 8980" = Borderlands
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 1.1.11
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 13.0.1 (x86 de)" = Mozilla Thunderbird 13.0.1 (x86 de)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 10.07.2012 07:17:30 | Computer Name = Wintendo | Source = Application Error | ID = 1000
Description = Faulting application name: arma2oa.exe, version: 1.60.94.444, time
stamp: 0x4ff2ff98 Faulting module name: arma2oa.exe, version: 1.60.94.444, time
stamp: 0x4ff2ff98 Exception code: 0xc0000005 Fault offset: 0x002a1b23 Faulting process
id: 0x1b5c Faulting application start time: 0x01cd5e8c0c74728c Faulting application
path: F:\Spiele\Steam\steamapps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Faulting
module path: F:\Spiele\Steam\steamapps\common\arma 2 operation arrowhead\Expansion\beta\arma2oa.exe
Report
Id: d5fb3eaa-ca80-11e1-8bfe-90e6ba1df6b9
Error - 10.07.2012 12:32:16 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 11.07.2012 01:31:43 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 12.07.2012 06:35:15 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 13.07.2012 05:23:28 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 15.07.2012 13:19:57 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 16.07.2012 05:49:51 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 16.07.2012 07:44:27 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 16.07.2012 16:39:14 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
Error - 16.07.2012 17:02:22 | Computer Name = Wintendo | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 16.07.2012 16:38:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 16:38:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 16:38:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 16:39:24 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 17:00:25 | Computer Name = Wintendo | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .
Error - 16.07.2012 17:01:02 | Computer Name = Wintendo | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
avipbb avkmgr discache spldr Wanarpv6
Error - 16.07.2012 17:01:08 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 17:01:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 17:01:14 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
Error - 16.07.2012 17:01:15 | Computer Name = Wintendo | Source = DCOM | ID = 10005
Description =
< End of report >
Gruß Daweyh Geändert von Daweyh (16.07.2012 um 22:41 Uhr) |
|
18.07.2012, 19:55
| #2 | |
| /// Malware-holic   | Pc gesperrt durch GVU 2.07 hi
__________________Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
19.07.2012, 02:14
| #3 |
| | Pc gesperrt durch GVU 2.07 Hey ich habe Combofix nun durchlaufen lassen.
__________________Er hat sich beschwert das Antivir noch laufen würde obwohl Antivir und auch alle anderen Anti viren, Malware etc prozesse gestoppt waren. Falls es wichtig ist ich arbeite im Moment nur im abgesicherten Modus. Hier die Logdatei: Code:
ATTFilter ComboFix 12-07-18.04 - Stephen 19.07.2012 3:03.1.8 - x64 NETWORK
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1033.18.8183.7268 [GMT 2:00]
ausgeführt von:: c:\users\Stephen\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\usgwmt
c:\windows\usgwmt\BReWErS.dll
G:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-06-19 bis 2012-07-19 ))))))))))))))))))))))))))))))
.
.
2012-07-17 18:49 . 2004-10-15 16:32 14568 ----a-w- c:\windows\SysWow64\drivers\wg6n.sys
2012-07-17 18:49 . 2004-10-15 16:32 14568 ----a-w- c:\windows\SysWow64\drivers\wg5n.sys
2012-07-17 18:49 . 2004-10-15 16:32 14568 ----a-w- c:\windows\SysWow64\drivers\wg4n.sys
2012-07-17 18:49 . 2004-10-15 16:32 14568 ----a-w- c:\windows\SysWow64\drivers\wg3n.sys
2012-07-17 18:49 . 2004-10-15 16:18 21075 ----a-w- c:\windows\SysWow64\drivers\wpsdrvnt.sys
2012-07-17 18:49 . 2004-10-15 16:17 60496 ----a-w- c:\windows\SysWow64\drivers\Teefer.sys
2012-07-17 18:49 . 2004-10-15 16:32 83096 ----a-w- c:\windows\SysWow64\SSSensor.dll
2012-07-17 18:38 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD4B000C-83F1-41FC-AB44-383FA9FE40B6}\mpengine.dll
2012-07-16 22:00 . 2012-07-16 22:00 -------- d-----w- c:\users\Dokumente und Einstellungen
2012-07-16 20:54 . 2012-07-16 20:54 -------- d-----w- c:\users\Stephen\AppData\Roaming\Malwarebytes
2012-07-16 20:54 . 2012-07-16 20:54 -------- d-----w- c:\programdata\Malwarebytes
2012-07-16 20:54 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-11 19:24 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 13:59 . 2012-07-11 13:59 -------- d-----w- c:\windows\Robin Hood 1.0
2012-07-10 20:41 . 2012-07-10 20:41 -------- d-----w- c:\users\Stephen\AppData\Local\LucasArts
2012-07-10 17:38 . 2012-07-10 17:38 -------- d-----w- c:\users\Stephen\AppData\Local\SIX_Projects
2012-07-10 11:02 . 2012-07-10 17:38 -------- d-----w- c:\users\Stephen\AppData\Roaming\six-updater
2012-07-10 11:02 . 2012-07-10 11:02 -------- d-----w- c:\users\Stephen\AppData\Roaming\six-zsync
2012-07-10 10:59 . 2012-07-10 17:07 -------- d-----w- c:\users\Stephen\AppData\Local\Downloaded Installations
2012-07-10 10:57 . 2012-07-10 10:57 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-07-10 10:46 . 2012-07-12 14:47 -------- d-----w- c:\users\Stephen\AppData\Local\ArmA 2 OA
2012-07-10 10:34 . 2012-07-10 10:35 -------- d-----w- c:\users\Stephen\AppData\Local\ArmA 2
2012-07-08 12:44 . 2012-07-08 12:44 -------- d-----w- c:\users\Stephen\AppData\Local\Activision
2012-07-04 22:52 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-06-26 11:23 . 2012-06-26 11:23 -------- d-----w- c:\users\Stephen\AppData\Local\Macromedia
2012-06-26 09:42 . 2012-07-18 10:37 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-25 16:40 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-25 16:40 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-25 16:40 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-25 16:40 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-25 16:40 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-25 16:40 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-25 16:40 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-25 16:40 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-25 16:40 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-18 10:37 . 2011-11-20 18:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 19:15 . 2011-12-17 16:05 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-05-31 10:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-05-15 04:01 . 2012-06-14 17:06 1188864 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 03:59 . 2012-06-14 17:06 64512 ----a-w- c:\windows\system32\jsproxy.dll
2012-05-15 03:03 . 2012-06-14 17:06 981504 ----a-w- c:\windows\SysWow64\wininet.dll
2012-05-10 11:36 . 2011-12-28 11:36 560184 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-05-08 11:20 . 2011-11-20 18:14 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-08 11:20 . 2011-11-20 18:14 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-04 11:06 . 2012-06-14 17:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 17:05 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 17:05 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-28 05:32 . 2012-06-14 17:05 1112064 ----a-w- c:\windows\system32\rdpcorets.dll
2012-04-28 03:55 . 2012-06-14 17:05 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 17:06 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 17:06 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 17:06 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-20 05:42 . 2012-06-14 17:06 1494016 ----a-w- c:\windows\system32\urlmon.dll
2012-04-20 05:42 . 2012-06-14 17:06 134144 ----a-w- c:\windows\system32\url.dll
2012-04-20 05:42 . 2012-06-14 17:06 9059840 ----a-w- c:\windows\system32\mshtml.dll
2012-04-20 05:42 . 2012-06-14 17:06 735744 ----a-w- c:\windows\system32\msfeeds.dll
2012-04-20 05:42 . 2012-06-14 17:06 97792 ----a-w- c:\windows\system32\mshtmled.dll
2012-04-20 05:42 . 2012-06-14 17:06 12297216 ----a-w- c:\windows\system32\ieframe.dll
2012-04-20 05:42 . 2012-06-14 17:06 247808 ----a-w- c:\windows\system32\ieui.dll
2012-04-20 05:42 . 2012-06-14 17:06 2454528 ----a-w- c:\windows\system32\iertutil.dll
2012-04-20 03:45 . 2012-06-14 17:06 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2012-04-20 03:16 . 2012-06-14 17:06 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="f:\programme\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="f:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="f:\programme\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"Malwarebytes' Anti-Malware"="f:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"SmcService"="f:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111v3 Setup-Assistent.lnk - f:\programme\Netgear\WG111v3.exe [2009-11-6 2080768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-19 27760]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
R2 AntiVirSchedulerService;Avira Planer;f:\programme\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;f:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 250056]
R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;f:\spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-21 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-21 88960]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-21 34816]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [2009-10-01 1307648]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2009-11-18 446976]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 10:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.hiergehtslos.de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\f1ge3pvc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.eintracht.de/aktuell/
FF - prefs.js: keyword.URL - hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-spdetector3 - f:\spiele\Spyware Process Detector\spd322.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-BattlEye for A2 - f:\spiele\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
AddRemove-BattlEye for OA - f:\spiele\steam\steamapps\common\arma 2 operation arrowheadExpansion\BattlEye\UnInstallBE.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsdatant]
"ImagePath"=""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-07-19 03:10:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-07-19 01:10
.
Vor Suchlauf: 18.636.705.792 bytes free
Nach Suchlauf: 20.782.657.536 bytes free
.
- - End Of File - - 04D688955143A9DEE208FBB191BC775F
|
|
20.07.2012, 19:56
| #4 |
| /// Malware-holic | Pc gesperrt durch GVU 2.07 der normalemodus sollte gehen, testen bitte. falls ja: lade den CCleaner standard: CCleaner Download - CCleaner 3.20.1750 falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Pc gesperrt durch GVU 2.07 |
| autorun, avira, bho, black, bonjour, call of duty, converter, ctfmon.lnk, defender, error, failed, firefox, flash player, format, heuristiks/extra, heuristiks/shuriken, hijack, install.exe, jdownloader, langs, launch, mozilla, netgear, nvidia update, object, plug-in, realtek, registry, rundll, scan, searchscopes, security, software, spyware, teamspeak, thomas, trojaner, trojaner gvu, udp, usb 2.0 |
