| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: VerschluesselungsTrojaner eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.08.2012, 14:03
| #1 |
| |  VerschluesselungsTrojaner eingefangen hallo leute! Bei mir duerfte er es sich gemuetlich gemacht haben  hab das system zuerst mit Malwarebytes gescannt und dann mit OTL ebenso. logfiles untenstehend Wuerde mich sehr freuen falls mir jemand von den pros Loesungswege vorschlagen koennte. An und fuer sich hab ich das OS auf einer SSD, wichtige dinge sind da nicht drauf, also koennt ich drueberformatieren. Sollte es natuerlich eine andere loesung geben, waere mir das natuerlich lieber. Falls noch weitere Details notwendig sind bitte bescheid geben! Besten Dank schon jetzt! zocker30 Malwarebytes LOG Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.11.02 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 Marco :: MARCO-PC [Administrator] Schutz: Deaktiviert 11.08.2012 14:16:29 mbam-log-2012-08-11 (14-27-30).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|H:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 314318 Laufzeit: 8 Minute(n), 27 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Marco\Downloads\ADLSoft_UnCompressor_v2.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt. C:\Users\Marco\Downloads\SoftonicDownloader_fuer_xpadder.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter OTL Extras logfile created on: 11.08.2012 14:32:53 - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Marco\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 4,78 Gb Available Physical Memory | 59,85% Memory free
9,93 Gb Paging File | 6,83 Gb Available in Paging File | 68,78% Paging File free
Paging file location(s): c:\pagefile.sys 2000 4000 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 10,66 Gb Free Space | 8,95% Space Free | Partition Type: NTFS
Drive D: | 929,56 Gb Total Space | 133,37 Gb Free Space | 14,35% Space Free | Partition Type: NTFS
Drive E: | 1,95 Gb Total Space | 1,19 Gb Free Space | 61,12% Space Free | Partition Type: NTFS
Drive F: | 106,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 100,00 Mb Total Space | 86,24 Mb Free Space | 86,25% Space Free | Partition Type: NTFS
Drive H: | 1397,17 Gb Total Space | 1261,83 Gb Free Space | 90,31% Space Free | Partition Type: NTFS
Computer Name: MARCO-PC | User Name: Marco | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-4164087047-2249941583-4205170742-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008A657D-BCE4-4AE6-8639-CDF5BFE598B1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{028BAB05-C5F4-43AE-A361-7D5B9D75C942}" = rport=139 | protocol=6 | dir=out | app=system |
"{12A1095D-00EA-4F71-A188-E0429D7BA1C6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{21AB2DCF-52BC-42B6-AE53-9AE1DBE0BE10}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{33CF0771-7A66-44AC-9CE7-03167DAEF264}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{365C1161-BC89-4060-A86E-03B45C17856B}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{43C514A5-3C31-4C83-9761-0915DFBD37E0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{50B523A8-74AA-40A7-8001-2E13F126F1CA}" = lport=137 | protocol=17 | dir=in | app=system |
"{6510E710-772C-4CC6-9961-1469E5BDEE66}" = lport=2869 | protocol=6 | dir=in | app=system |
"{689FEABB-1BAC-45F2-B43D-80106C41245E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7F09BFCC-4EB2-4242-AC4B-F0FCE282BC51}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A0F23670-FC74-416F-A4A5-8AEDEB24D3FB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{A788A05B-0B10-4297-BF0C-634C874EE3A7}" = lport=445 | protocol=6 | dir=in | app=system |
"{AF7F4A09-D9E0-45A0-A8D2-97CA4C9C74CC}" = lport=138 | protocol=17 | dir=in | app=system |
"{B1A44B44-CB49-4274-8DAB-9BA4E5120861}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B251E988-C4DC-4374-A900-E2789EAEFDD4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BF105AF0-0FA6-4C59-ADE0-45F28F7DF66A}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C548D162-6904-44DC-B3D8-9DAD81264E82}" = rport=137 | protocol=17 | dir=out | app=system |
"{C614C5EE-97CE-4B60-8DE2-83D6FF9B45C7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D29A8273-725B-42BA-8330-982FA148F206}" = lport=139 | protocol=6 | dir=in | app=system |
"{DB47301E-B268-49A8-A81D-F1E012F63187}" = rport=445 | protocol=6 | dir=out | app=system |
"{DC457660-51D8-4AC2-AC87-E7E8301EED27}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{DCB1EC36-32B6-4256-8732-25984CB0F026}" = rport=138 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0323E7A0-662D-4255-AE7F-60BB8B518E77}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{037BBC28-CBDA-4335-AA67-67882F22B5CB}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe |
"{04BFADD1-7AB7-4EC4-8321-12C279B9E425}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{073B9D71-2DF8-4AC8-8057-348D3A8B7A5A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{08F61123-2C82-47A6-8254-9489B985957A}" = protocol=17 | dir=in | app=d:\vmware-authd.exe |
"{0A6085F8-0F1C-4CF9-991C-4DEB027B536D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{100B5098-60A5-4120-951F-98C6F847AD08}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1160B8D8-7A48-4C68-AB94-51622CF5233E}" = protocol=6 | dir=in | app=d:\vmware-authd.exe |
"{11C5394B-DB05-44EA-95D2-BAC885F645EA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam 3\bin\sam3_unrestricted.exe |
"{18107C98-1E8E-491D-8268-3215EC70AE52}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{19806B6E-5B37-4DDC-96F9-BE42EB524E40}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\game_launcher.exe |
"{1A7C7DF1-4E88-4152-86E4-25788EEA4789}" = protocol=17 | dir=in | app=d:\steam\nation red\nationred.exe |
"{1BE8302B-3BE3-409D-A30E-943DD84C32C1}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alice madness returns\binaries\win32\alicemadnessreturns.exe |
"{1DD515EF-7E98-40C3-AAF7-E9E6DDE0A0E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{23A00AEC-25C7-4980-94B7-6A379149C07F}" = protocol=17 | dir=in | app=d:\vmware-authd.exe |
"{299FEE65-8F63-4980-A853-E4CE8755160F}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{2BE16589-DE61-47FC-B26E-A5DDCD44B357}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{36AE0C87-D909-4C06-B8C0-2508D2181F43}" = protocol=6 | dir=in | app=d:\vmware-authd.exe |
"{3BE50B70-08CC-49E9-83DD-3C6C070E8385}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{44DFC200-2756-4E66-956A-FA756A7DF851}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrsp.exe |
"{46842470-67F0-4120-ACED-AA829598D5F8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_dx11.exe |
"{46DD9E1A-2423-46E8-80DD-9F9C88037D7F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{4E1779CE-B06C-4B3F-B5D2-A4C9C095A50C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alice madness returns\binaries\win32\alicemadnessreturns.exe |
"{4E4D866F-56B4-4F3D-854C-BB3D2AB640A9}" = protocol=6 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe |
"{4FC16F40-6531-4928-8728-7625116E3389}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam 3\bin\sam3.exe |
"{54A12EE8-8DB6-4E21-AD75-F64CC7D66A0D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam 3\bin\sam3.exe |
"{599A7DE8-6F74-4038-9B10-990925B5F23C}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{59AF8B60-DA10-49DF-AF87-B9FB6C837E16}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mirrors edge\binaries\mirrorsedge.exe |
"{5A50AA44-615C-43C6-8EA6-CE89DADC1FE5}" = protocol=6 | dir=in | app=d:\flatout ultimate carnage\fouc.exe |
"{61894EA4-3016-459A-B83B-6DC4A3A4AE88}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{618EAD75-7F06-4031-9CEE-46CB33748341}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam 3\bin\sam3_unrestricted.exe |
"{640DCF56-6901-4677-ACE8-644A536C85CA}" = protocol=6 | dir=in | app=d:\steam\assassin's creed revelations\acrsp.exe |
"{64F47D89-10E4-4EE0-9C93-B46402EF008A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\nation red\nationred.exe |
"{6EC3B2D8-D043-42B8-84B1-61CD23330F8D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7085826D-4842-47A8-96F8-236BAA610FBC}" = protocol=6 | dir=in | app=d:\steam\nation red\nationred.exe |
"{77E65B3F-928C-4A87-9E90-D84F655580CF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f.e.a.r. 3\f.e.a.r. 3.exe |
"{78403425-D2C0-498A-8637-F21AE8904DE4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\game_launcher.exe |
"{7AA2D923-6870-4CDF-AD9A-B8EEB7B60CFA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f.e.a.r. 3\f.e.a.r. 3.exe |
"{851D4EC1-55E8-4EFA-899E-1A2DDB0BF2F6}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8641897F-88A4-4BEA-94B9-DABD05CC269F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird.exe |
"{8B980F6A-4DA5-4AB1-854E-250007516915}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbsp.exe |
"{8BAAF2E1-E64A-4674-BEE5-CB3990A837F1}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{90512214-6AF9-4409-A698-3398E9B02FB3}" = protocol=17 | dir=in | app=d:\steam\assassin's creed revelations\acrsp.exe |
"{9308C3D9-B59A-4C03-B5EA-C4823C933DC0}" = protocol=17 | dir=in | app=d:\rockstar\playmaxpayne3.exe |
"{94621FFC-3DE0-46D3-8330-C4ACB2850277}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_dx11.exe |
"{9548C610-F049-4243-AAFB-004A46F2B099}" = protocol=6 | dir=in | app=d:\vmware-authd.exe |
"{96BD3823-26E8-43A7-BF9A-89456F578499}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{97656A91-6683-4C21-8845-AA5DC08FF683}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alan wakes american nightmare\alan_wakes_american_nightmare.exe |
"{9FD8F748-FE59-4CB0-BC14-F6F5B42FBDD6}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{A8DC5FD6-BEA5-4BFF-9A93-204AB4A38190}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A91BA198-91C4-4F82-BD1A-5BB8C632DB2D}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe |
"{AC8E6297-D02A-4A7D-AD52-ADD8B794049F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{ACB99039-1CE8-453E-9EB0-28C873C22C64}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{ADDCB8F7-FF58-4476-979A-F4661CDD8AC7}" = protocol=17 | dir=in | app=d:\vmware-authd.exe |
"{B20DD0E4-C8C9-4B69-B14A-D1A1CE0FC06D}" = protocol=6 | dir=out | app=system |
"{BA9C77A4-1EE0-4FF5-A2D8-BD3B5A36523B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\nation red\nationred.exe |
"{BC468382-54FB-4CD8-B8E4-C40A6228E27F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\just cause 2\justcause2.exe |
"{C15B3EE4-C7F4-44A4-8105-5317F92F712C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C17BFD4F-736E-417E-BAA4-039FFECC3B0E}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{C3169B6E-B815-4FA7-85B7-928623188A90}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbsp.exe |
"{C68A8FF4-1951-417F-A2A6-D8CCC249C4A9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CC487B91-F552-4DF0-BC87-41E59B56046C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{CDE1B15B-76C5-4A23-808D-65955A785B4B}" = protocol=17 | dir=in | app=d:\flatout ultimate carnage\fouc.exe |
"{CE86B036-BBFD-451C-8B80-97FE7C1FBB84}" = protocol=6 | dir=in | app=d:\rockstar\playmaxpayne3.exe |
"{D59C2BEC-2645-481A-A37F-75D121D0ED6A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D85C25ED-B285-4856-9505-D6742D776EF5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mirrors edge\binaries\mirrorsedge.exe |
"{DBE355E7-3DAA-4657-BCA5-C6C090ABC83C}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{E2ACB3F8-155A-4DD9-9649-E0AA671D281D}" = protocol=17 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe |
"{E44D2187-7BEE-4562-BAFD-CCCDEF6C7D38}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{EBD7F1D0-8D5B-41AF-A509-969A9F272E72}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EC5BA38C-6177-4737-BEFA-3D95E53238BB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird.exe |
"{ECD00D4E-30D3-4C28-A47F-50BFE0055C76}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F05E5B77-BB88-4372-A613-6CD0B00C2EE2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrsp.exe |
"{F5F1BE70-663A-4338-8565-C9E8A2DF111A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alan wakes american nightmare\alan_wakes_american_nightmare.exe |
"{F5FC36AE-E331-4DFA-A4B3-136682517519}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F69407AF-B20C-4725-9860-15912F348004}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{F73EE7DB-E071-4DE5-8179-DFA5832AB7A5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mirrors edge\support\ea help\electronic_arts_technical_support.htm |
"{FC5B366A-9835-4D89-8D0D-DE371678C69A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\just cause 2\justcause2.exe |
"{FE85A696-2E9A-414C-9759-AD74370FA0D9}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{FF125200-4801-4316-AE17-654EBE1C3FC3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mirrors edge\support\ea help\electronic_arts_technical_support.htm |
"TCP Query User{1C87913B-2209-4C3F-87A6-4A935321C36A}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe |
"TCP Query User{48369BC0-7301-4897-8A4A-82050520C9A7}C:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbmp.exe |
"TCP Query User{49D52FB6-F0DE-4EF9-B7C3-E99EEB1950B8}D:\steam\assassins creed brotherhood\acbsp.exe" = protocol=6 | dir=in | app=d:\steam\assassins creed brotherhood\acbsp.exe |
"TCP Query User{55308B0E-4362-46E8-97CF-DB71ECA62E3D}C:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrmp.exe |
"TCP Query User{AA3083A7-9383-4B9B-87F2-2EAE4B849758}D:\steam\assassin's creed revelations\acrmp.exe" = protocol=6 | dir=in | app=d:\steam\assassin's creed revelations\acrmp.exe |
"TCP Query User{C679A503-B20D-4F1C-9095-C39C4313C2D7}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{DDA6E8D6-F5B4-400F-9072-516263652D10}D:\steam\assassin's creed revelations\acrsp.exe" = protocol=6 | dir=in | app=d:\steam\assassin's creed revelations\acrsp.exe |
"TCP Query User{E4EAA5A8-B815-4675-BCAC-CC653FB5AF19}D:\rockstar\maxpayne3.exe" = protocol=6 | dir=in | app=d:\rockstar\maxpayne3.exe |
"TCP Query User{FBF40A4B-2D79-4A32-AC57-2F20661F1A7E}D:\steam\assassins creed brotherhood\acbmp.exe" = protocol=6 | dir=in | app=d:\steam\assassins creed brotherhood\acbmp.exe |
"UDP Query User{2C90A239-266A-4512-9C1B-8603E1ADDAFE}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe |
"UDP Query User{38D21656-E04D-4EE5-A356-52910663D494}D:\steam\assassins creed brotherhood\acbsp.exe" = protocol=17 | dir=in | app=d:\steam\assassins creed brotherhood\acbsp.exe |
"UDP Query User{528456F9-D2EC-4F6F-99CA-046645F8100C}D:\steam\assassin's creed revelations\acrmp.exe" = protocol=17 | dir=in | app=d:\steam\assassin's creed revelations\acrmp.exe |
"UDP Query User{5A5C5AB0-56D9-44F7-8639-A7946E228940}C:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassin's creed revelations\acrmp.exe |
"UDP Query User{9D4CAFEF-5F48-435D-982E-E6CA19F3678F}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{B4C6EFD6-458D-41D9-AD23-D3691F7FF7E0}D:\rockstar\maxpayne3.exe" = protocol=17 | dir=in | app=d:\rockstar\maxpayne3.exe |
"UDP Query User{C953A7E2-50F4-43C4-815C-181884359F7C}D:\steam\assassin's creed revelations\acrsp.exe" = protocol=17 | dir=in | app=d:\steam\assassin's creed revelations\acrsp.exe |
"UDP Query User{CDA24CED-BCBD-4BE9-A20A-5727844CE700}D:\steam\assassins creed brotherhood\acbmp.exe" = protocol=17 | dir=in | app=d:\steam\assassins creed brotherhood\acbmp.exe |
"UDP Query User{EA063274-4987-409F-879A-098E4D0309F7}C:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\assassins creed brotherhood\acbmp.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{06DB2C4C-DC29-DA42-3B00-5581CBF545BB}" = AMD Drag and Drop Transcoding
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1444D2EE-C7AD-44A8-844F-2634B49353D1}" = Logitech Gaming Software 5.10
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86417001FF}" = Java(TM) 7 Update 1 (64-bit)
"{338CE2A1-7BD6-AC18-0069-4A90F7C3D836}" = AMD Steady Video Plug-In
"{3987279A-3504-2916-D063-741B910F0747}" = AMD Accelerated Video Transcoding
"{44B4F244-5B4D-856E-B3A6-E8DDBDC7F127}" = AMD Fuel
"{47F9B7C3-F172-940F-D0C4-203C7914E5D2}" = AMD Catalyst Install Manager
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{59B69525-1383-C84A-38EF-F442B63E69BC}" = AMD Media Foundation Decoders
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{C25200DF-8F00-4395-A191-637AE5901D4C}" = Smart Technology Programming Software 7.0.1.12
"{C8388DCB-6F85-C11F-C9F4-D636960E60F5}" = ccc-utility64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"Sandboxie" = Sandboxie 3.68 (64-bit)
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003BFBBD-6C67-419E-A24D-0DCAFC3A5249}" = tools-freebsd
"{007C5268-FB1C-49B9-A5E7-37D66DE46B9C}" = Online Plug-in
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{079A4EB2-9A74-7B86-12C2-00B52E395801}" = CCC Help Danish
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{112DDD07-E419-2498-1E9E-2157F82AF5AA}" = CCC Help Turkish
"{12A00DC2-1226-D9F2-13DA-F974111D439E}" = AMD VISION Engine Control Center
"{197597A7-AD33-4898-9D8E-73066818B464}" = tools-netware
"{1AA94747-3BF6-4237-9E1A-7B3067738FE1}" = Max Payne 3
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{224828D6-DCA7-FDF3-3B85-085298AEC919}" = Catalyst Control Center InstallProxy
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2993B157-97AE-7981-F29A-E6575F991CDB}" = CCC Help Swedish
"{2DE9C112-2482-4D27-AA90-1504DFD9F117}" = Citrix Authentication Manager
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{347966F8-E71A-E1A5-95E4-3A1C215383F6}" = CCC Help Chinese Traditional
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B3D81AB-51E2-695F-7E57-1CC30049F2A3}" = CCC Help French
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{462C2036-3055-4369-D30B-8DA032331EAB}" = CCC Help Greek
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51054867-140B-8FBF-73A8-75386276BD98}" = CCC Help Spanish
"{586A5957-F21B-C8AD-F5C2-11D4D7DA5340}" = CCC Help German
"{633414E3-AA2A-CD04-5976-E91F5F871396}" = CCC Help Japanese
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{812FF572-F216-EBA0-123E-636C1B6EBC5B}" = CCC Help Korean
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{85BB7CA7-6B0D-0B27-F4FF-B3D04282B3D1}" = CCC Help Russian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{883CCFC7-CA6B-5531-704B-F9A64546B309}" = CCC Help Thai
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8BDD3EC9-27E9-E490-7607-AF97FA678046}" = CCC Help Italian
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EC50898-E24A-4C0C-A1F2-A71A8DBF291F}" = Citrix Receiver Inside
"{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}" = Microsoft Games for Windows - LIVE Redistributable
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DA5221E-15DE-5B0F-D7BE-CCC7305575DD}" = CCC Help Dutch
"{A0791198-3F0C-4FB4-870C-5734C4CB5F16}" = Citrix Receiver (USB)
"{A1400F57-65CC-0C22-6461-948EA2837670}" = CCC Help Hungarian
"{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}" = VMware Workstation
"{A561BB5F-5A85-5D88-E520-0A4512D5E6C0}" = CCC Help Norwegian
"{A8B72907-B3F5-4C18-2D2B-F5E786A520DF}" = CCC Help Polish
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB1C87CB-1807-4CF0-B4C2-CEE14C18CDB4}" = tools-solaris
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AD219F94-16F2-937F-076A-F22DAA8D0A0B}" = CCC Help Finnish
"{AE0F62A7-A1A2-407F-9F4C-48939BD9AD8D}" = tools-winPre2k
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B26438B4-BF51-49C3-9567-7F14A5E40CB9}" = Dolby Home Theater v4
"{B2B5B39B-4E8C-AC78-7FF1-7055C338D243}" = Catalyst Control Center Graphics Previews Common
"{B442D7D6-5153-4DBC-954D-BFFAACACDFDC}_is1" = SteamTool 1.1
"{B48A3CE4-2F1E-45EF-841A-C0A3C407EB0F}" = Self-Service Plug-in
"{B4D8A5FE-83C9-44AB-88C7-9AB30EFE482A}" = Citrix Receiver(Aero)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C7C7FA4B-40FF-4B4E-A566-1ABF8FAC38BB}" = Citrix Receiver (HDX Flash-Umleitung)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D102611A-6466-4101-A51D-51069303AC65}" = tools-linux
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D777101F-1708-46ED-916E-3BE885F78F55}" = Citrix Receiver (DV)
"{DD8ACFF8-098E-130C-2799-BCA4D41EBAB2}" = CCC Help Chinese Standard
"{DE123FE9-B7F6-A75A-920D-3937FB9F06E4}" = CCC Help Portuguese
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EE253E80-C298-4A31-BB22-7280DC8C7177}" = CCC Help Czech
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F648F088-B270-CF18-6486-AF8B1FE6BC09}" = CCC Help English
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD85D9C0-783A-77B7-8EF8-326EC6C154D1}" = Catalyst Control Center Localization All
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFD9383C-01D5-4897-A954-43AF599AED30}" = tools-windows
"5513-1208-7298-9440" = JDownloader 0.9
"Avidemux 2.5 (64-bit)" = Avidemux 2.5
"Battlelog Web Plugins" = Battlelog Web Plugins
"CitrixOnlinePluginPackWeb" = Citrix Receiver
"Cross Fire_is1" = Cross Fire En
"ESN Sonar-0.70.4" = ESN Sonar
"FlatOut Ultimate Carnage" = FlatOut Ultimate Carnage
"Fraps" = Fraps (remove only)
"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"Rockstar Games Social Club" = Rockstar Games Social Club
"Steam App 17410" = Mirror's Edge
"Steam App 19680" = Alice: Madness Returns
"Steam App 201870" = Assassin's Creed Revelations
"Steam App 202750" = Alan Wake's American Nightmare
"Steam App 21100" = F.E.A.R. 3
"Steam App 39800" = Nation Red
"Steam App 41070" = Serious Sam 3: BFE
"Steam App 48190" = Assassin's Creed Brotherhood
"Steam App 50130" = Mafia II
"Steam App 55230" = Saints Row: The Third
"Steam App 8190" = Just Cause 2
"TrueCrypt" = TrueCrypt
"VLC media player" = VLC media player 2.0.1
"VMware_Workstation" = VMware Workstation
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-4164087047-2249941583-4205170742-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 27.07.2012 09:32:19 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
Error - 27.07.2012 10:18:24 | Computer Name = Marco-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x4fd626ed Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6d8 Startzeit der fehlerhaften Anwendung: 0x01cd6bfbfe492142
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
ece15291-d7f5-11e1-8994-005056c00008
Error - 27.07.2012 12:10:12 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
Error - 27.07.2012 15:49:03 | Computer Name = Marco-PC | Source = Application Hang | ID = 1002
Description = Programm ACRSP.exe, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: c94 Startzeit:
01cd6c30bb268397 Endzeit: 23 Anwendungspfad: c:\program files (x86)\steam\steamapps\common\assassin's
creed revelations\ACRSP.exe Berichts-ID:
Error - 27.07.2012 16:00:08 | Computer Name = Marco-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ACRMP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3b8231 Name des fehlerhaften Moduls: ACRMP.exe, Version: 0.0.0.0, Zeitstempel:
0x4f3b8231 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0161a03a ID des fehlerhaften Prozesses:
0x13f0 Startzeit der fehlerhaften Anwendung: 0x01cd6c323a7a8edf Pfad der fehlerhaften
Anwendung: c:\program files (x86)\steam\steamapps\common\assassin's creed revelations\ACRMP.exe
Pfad
des fehlerhaften Moduls: c:\program files (x86)\steam\steamapps\common\assassin's
creed revelations\ACRMP.exe Berichtskennung: aa3e4c75-d825-11e1-b033-005056c00008
Error - 28.07.2012 02:57:44 | Computer Name = Marco-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x4fd626ed Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x790 Startzeit der fehlerhaften Anwendung: 0x01cd6c120c7e9aa1
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
87d5ca31-d881-11e1-b033-005056c00008
Error - 28.07.2012 05:02:40 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 02:55:08 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 04:18:15 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 11:51:03 | Computer Name = Marco-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 01.08.2012 13:15:08 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" wurde aufgrund
folgenden Fehlers nicht gestartet: %%1069
Error - 01.08.2012 17:28:05 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "VMware USB Arbitration Service" wurde mit folgendem Fehler
beendet: %%31
Error - 01.08.2012 17:39:30 | Computer Name = Marco-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.131.1082.0 Aktualisierungsquelle:
%%859 Aktualisierungsphase: %%852 Quellpfad: hxxp://www.microsoft.com Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: NT-AUTORITÄT\SYSTEM Aktuelle Modulversion:
Vorherige Modulversion: 1.1.8601.0 Fehlercode: 0x80072ee2 Fehlerbeschreibung: Das
Zeitlimit für den Vorgang wurde erreicht.
Error - 01.08.2012 22:33:11 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 02.08.2012 00:03:26 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "VMware USB Arbitration Service" wurde mit folgendem Fehler
beendet: %%31
Error - 02.08.2012 04:32:46 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 02.08.2012 06:06:05 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "VMware USB Arbitration Service" wurde mit folgendem Fehler
beendet: %%31
Error - 02.08.2012 08:22:46 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 02.08.2012 12:48:21 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "VMware USB Arbitration Service" wurde mit folgendem Fehler
beendet: %%31
Error - 02.08.2012 13:44:31 | Computer Name = Marco-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
< End of report >
Code:
ATTFilter OTL logfile created on: 11.08.2012 14:32:53 - Run 1 OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Marco\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 7,98 Gb Total Physical Memory | 4,78 Gb Available Physical Memory | 59,85% Memory free 9,93 Gb Paging File | 6,83 Gb Available in Paging File | 68,78% Paging File free Paging file location(s): c:\pagefile.sys 2000 4000 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 119,14 Gb Total Space | 10,66 Gb Free Space | 8,95% Space Free | Partition Type: NTFS Drive D: | 929,56 Gb Total Space | 133,37 Gb Free Space | 14,35% Space Free | Partition Type: NTFS Drive E: | 1,95 Gb Total Space | 1,19 Gb Free Space | 61,12% Space Free | Partition Type: NTFS Drive F: | 106,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 100,00 Mb Total Space | 86,24 Mb Free Space | 86,25% Space Free | Partition Type: NTFS Drive H: | 1397,17 Gb Total Space | 1261,83 Gb Free Space | 90,31% Space Free | Partition Type: NTFS Computer Name: MARCO-PC | User Name: Marco | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Marco\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (SbieSvc) -- C:\Programme\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (VMnetDHCP) -- C:\Windows\SysWOW64\vmnetdhcp.exe (VMware, Inc.) SRV - (VMAuthdService) -- D:\vmware-authd.exe (VMware, Inc.) SRV - (VMware NAT Service) -- C:\Windows\SysWOW64\vmnat.exe (VMware, Inc.) SRV - (VMUSBArbService) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.) SRV - (ufad-ws60) -- D:\vmware-ufad.exe (VMware, Inc.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation) DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (ctxusbm) -- C:\Windows\SysNative\drivers\ctxusbm.sys (Citrix Systems, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc) DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (SaiNtBus) -- C:\Windows\SysNative\drivers\SaiBus.sys (Saitek) DRV:64bit: - (SaiMini) -- C:\Windows\SysNative\drivers\SaiMini.sys (Saitek) DRV:64bit: - (SaiK0836) -- C:\Windows\SysNative\drivers\SaiK0836.sys (Saitek) DRV:64bit: - (vmci) -- C:\Windows\SysNative\drivers\vmci.sys (VMware, Inc.) DRV:64bit: - (vmx86) -- C:\Windows\SysNative\drivers\vmx86.sys (VMware, Inc.) DRV:64bit: - (vmkbd) -- C:\Windows\SysNative\drivers\VMkbd.sys (VMware, Inc.) DRV:64bit: - (VMnetuserif) -- C:\Windows\SysNative\drivers\vmnetuserif.sys (VMware, Inc.) DRV:64bit: - (hcmon) -- C:\Windows\SysNative\drivers\hcmon.sys (VMware, Inc.) DRV:64bit: - (VMnetAdapter) -- C:\Windows\SysNative\drivers\vmnetadapter.sys (VMware, Inc.) DRV:64bit: - (WmVirHid) -- C:\Windows\SysNative\drivers\WmVirHid.sys (Logitech Inc.) DRV:64bit: - (WmBEnum) -- C:\Windows\SysNative\drivers\WmBEnum.sys (Logitech Inc.) DRV:64bit: - (WmXlCore) -- C:\Windows\SysNative\drivers\WmXlCore.sys (Logitech Inc.) DRV:64bit: - (WmFilter) -- C:\Windows\SysNative\drivers\WmFilter.sys (Logitech Inc.) DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices) DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.) DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (SbieDrv) -- C:\Programme\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D) DRV - (AODDriver4.1) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices) DRV - (vstor2-ws60) -- D:\vstor2-ws60.sys (VMware, Inc.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} IE - HKU\S-1-5-18\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} IE - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hi-tech.at/ IE - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} IE - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} IE - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll () FF - HKLM\Software\MozillaPlugins\@Citrix.com/npican: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Marco\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 01:50:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.13 13:59:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Extensions [2012.05.02 07:35:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\iwytr5rz.default\extensions [2012.05.17 19:18:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.07.20 01:50:03 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.03.13 07:23:34 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.13 07:06:36 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.03.13 07:23:34 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.03.13 07:23:34 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.13 07:23:34 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.13 07:23:34 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (CtxIEInterceptorBHO Class) - {2C4631FF-5CC8-4EBC-A0DF-34C92291759E} - C:\Program Files (x86)\Citrix\ICA Client\IEInterceptor.dll (Citrix Systems, Inc.) O2 - BHO: (no name) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4:64bit: - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [UIAnimation] C:\Users\Marco\AppData\Local\Microsoft\Windows\148\UIAnimation.exe () O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (Dolby Laboratories Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [vmware-tray] D:\vmware-tray.exe (VMware, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D) O4 - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0 O7 - HKU\S-1-5-21-4164087047-2249941583-4205170742-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - D:\x64\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - D:\x64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - D:\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - D:\vsocklib.dll (VMware, Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0) O16:64bit: - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} https://portal3.interwetten.com/+CSCO+09756767633A2F2F71797A2E67626279662E6E786E7A6E762E70627A++/dlmanager/versions/activex/dlm-activex-2.2.6.0.cab (DLM Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2F81B99D-DE55-4D21-A4A6-200693A53016}: DhcpNameServer = 212.186.211.21 195.34.133.21 O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found O18:64bit: - Protocol\Filter\ica - No CLSID value found O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20 - AppInit_DLLs: (C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll) - C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll (Citrix Systems, Inc.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.03.17 23:27:26 | 000,000,039 | R--- | M] () - F:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{6a227555-7f06-11e1-84fc-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{6a227555-7f06-11e1-84fc-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2009.05.12 20:43:59 | 000,124,168 | R--- | M] (Logitech, Inc.) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.11 14:00:33 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\Malwarebytes [2012.08.11 14:00:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.11 14:00:23 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.08.11 14:00:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.11 14:00:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.11 12:46:45 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\hellomoto [2012.08.02 12:37:17 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\Day 1 Studios [2012.08.01 18:21:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech [2012.08.01 18:21:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logitech [2012.08.01 18:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech [2012.07.30 13:32:08 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.07.30 13:32:08 | 000,102,240 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.07.26 17:03:05 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Saitek SD6 Profiles [2012.07.26 17:02:12 | 000,050,056 | ---- | C] (Saitek) -- C:\Windows\SysNative\drivers\SaiBus.sys [2012.07.26 17:02:12 | 000,022,792 | ---- | C] (Saitek) -- C:\Windows\SysNative\drivers\SaiMini.sys [2012.07.26 17:02:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Technology [2012.07.26 17:01:53 | 000,000,000 | ---D | C] -- C:\Program Files\Saitek [2012.07.26 17:01:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Saitek [2012.07.26 16:59:11 | 001,721,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01009.dll [2012.07.24 13:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.07.24 13:50:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.07.24 13:50:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2012.07.20 16:44:38 | 000,000,000 | ---D | C] -- C:\Users\Marco\Documents\EA Games [2012.07.18 11:22:47 | 000,000,000 | ---D | C] -- C:\Users\Marco\Documents\My Games [2012.07.17 23:37:10 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Local\{4048567C-7549-474F-B514-F3AE2997725B} [2012.07.17 23:36:48 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Local\{B78027F0-EB00-4270-9AA0-39876F1373D0} [2012.07.17 18:58:13 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Local\Stefan_Jones [2012.07.17 18:50:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SteamTool [2012.07.17 18:50:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SteamTool [2012.07.13 22:38:39 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\avidemux [2012.07.13 22:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\Avidemux 2.5 [2012.04.27 20:21:40 | 031,468,688 | ---- | C] (Citrix Systems, Inc.) -- C:\Users\Marco\CitrixReceiver.exe ========== Files - Modified Within 30 Days ========== [2012.08.11 14:20:55 | 001,627,410 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.08.11 14:20:55 | 000,701,430 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.08.11 14:20:55 | 000,667,038 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.08.11 14:20:55 | 000,150,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.08.11 14:20:55 | 000,123,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.08.11 14:14:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.11 14:13:58 | 2132,705,279 | -HS- | M] () -- C:\hiberfil.sys [2012.08.11 14:00:24 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.11 12:56:53 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.11 12:56:53 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.11 12:52:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.05 22:04:56 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.08.05 22:04:56 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.08.05 22:04:48 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.07.30 13:32:08 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.07.30 13:32:08 | 000,102,240 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.07.29 18:31:01 | 000,000,221 | ---- | M] () -- C:\Users\Marco\Desktop\Assassin's Creed Brotherhood Multiplayer.url [2012.07.28 22:26:01 | 000,000,221 | ---- | M] () -- C:\Users\Marco\Desktop\F.E.A.R. 3.url [2012.07.27 23:22:55 | 000,001,742 | ---- | M] () -- C:\Windows\Sandboxie.ini [2012.07.26 19:07:59 | 000,435,979 | ---- | M] () -- C:\Users\Marco\Desktop\Xpadder_5-3.zip [2012.07.26 16:59:13 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0836_01009.Wdf [2012.07.20 02:01:19 | 000,000,221 | ---- | M] () -- C:\Users\Marco\Desktop\Mirror's Edge.url [2012.07.18 03:08:27 | 000,000,221 | ---- | M] () -- C:\Users\Marco\Desktop\Alice Madness Returns.url [2012.07.17 18:50:04 | 000,000,963 | ---- | M] () -- C:\Users\Public\Desktop\SteamTool.lnk ========== Files Created - No Company Name ========== [2012.08.11 14:00:24 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.28 22:26:01 | 000,000,221 | ---- | C] () -- C:\Users\Marco\Desktop\F.E.A.R. 3.url [2012.07.26 19:07:58 | 000,435,979 | ---- | C] () -- C:\Users\Marco\Desktop\Xpadder_5-3.zip [2012.07.26 16:59:13 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SaiK0836_01009.Wdf [2012.07.26 16:59:11 | 001,380,864 | ---- | C] () -- C:\Windows\SysNative\SaiC0836.Dll [2012.07.26 16:59:11 | 000,008,192 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_0C.dll [2012.07.26 16:59:11 | 000,007,680 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_10.dll [2012.07.26 16:59:11 | 000,007,680 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_0A.dll [2012.07.26 16:59:11 | 000,007,680 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_07.dll [2012.07.26 16:59:11 | 000,007,168 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_19.dll [2012.07.26 16:59:11 | 000,007,168 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_09.dll [2012.07.26 16:59:11 | 000,007,168 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_05.dll [2012.07.26 16:59:11 | 000,006,656 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_0402.dll [2012.07.26 16:59:11 | 000,005,120 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_11.dll [2012.07.26 16:59:11 | 000,004,608 | ---- | C] () -- C:\Windows\SysNative\SaiC0836_12.dll [2012.07.20 02:01:19 | 000,000,221 | ---- | C] () -- C:\Users\Marco\Desktop\Mirror's Edge.url [2012.07.18 03:08:27 | 000,000,221 | ---- | C] () -- C:\Users\Marco\Desktop\Alice Madness Returns.url [2012.07.17 18:50:04 | 000,000,963 | ---- | C] () -- C:\Users\Public\Desktop\SteamTool.lnk [2012.04.25 21:13:11 | 000,064,472 | ---- | C] () -- C:\Users\Marco\23999_1296677935057_1173623034_30662278_1602749_n.jpg [2012.04.16 16:52:31 | 003,123,272 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012.04.16 10:35:33 | 000,001,742 | ---- | C] () -- C:\Windows\Sandboxie.ini [2012.04.14 21:04:07 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.04.14 21:04:07 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.04.11 11:49:10 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.04.05 11:45:49 | 001,648,996 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.03.09 06:31:26 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.03.09 06:31:26 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat < End of report > |
|
15.08.2012, 17:11
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | VerschluesselungsTrojaner eingefangenCode:
ATTFilter C:\Users\Marco\Downloads\SoftonicDownloader_fuer_xpadder.exe
 Finger weg von Softonic!!  Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt? Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ |
|
| Themen zu VerschluesselungsTrojaner eingefangen |
| .com, administrator, adobe, bho, desktop, dll, error, explorer, flash player, helper, home, index, install.exe, jdownloader, mozilla, nvidia, origin, plug-in, programme, realtek, registry, rundll, security, server, software, svchost.exe, system, tcp, udp, usb |
