Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 14.05.2013, 18:58   #1
asdfgh12345
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Hallo! Ich habe einen Trojaner auf dem Rechner. Ich habe es nur bemerkt weil heute nach dem anmachen des Rechners folgende Fehlermeldung kam:


Seitdem erstellt der Rechner alle 2 Minuten eine neue Datei in dem Ordner mit identischer MD5 aber mit anderem Namen. Wenn ich den Recher vom Internet trenne hört das auf, fängt aber wieder an wenn ich das Internetkabel wieder reinstecke.
Die exe Datei ist nur 65byte groß. Wenn ich sie mit notepad öffne, steht da: "This site has been temporarily disabled, please try again later."

Vor einer Woche habe ich versehentlich die mixi dj toolbar installiert und bin diese ohne tools durch deinstallieren der software und überprüfen der browsereinstellungen "losgeworden". Vielleicht hängt das ja damit zusammen??

Bevor ich nun die logfiles poste noch eine Frage: Kann ich 'einfach' feststellen welches Programm da nach außen kommuniziert und mit welchem Host?

LOGFILES

OTL:
Code:
ATTFilter
OTL logfile created on: 5/14/2013 6:49:22 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\user\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 2.77 Gb Available Physical Memory | 69.30% Memory free
7.99 Gb Paging File | 6.61 Gb Available in Paging File | 82.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 352.03 Gb Total Space | 182.48 Gb Free Space | 51.84% Space Free | Partition Type: NTFS
Drive F: | 971.63 Mb Total Space | 326.36 Mb Free Space | 33.59% Space Free | Partition Type: FAT
 
Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/05/14 18:20:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2013/03/15 07:53:06 | 001,266,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2013/03/14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012/12/18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/10/19 14:51:08 | 000,395,200 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
PRC - [2012/10/15 11:58:24 | 002,844,608 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
PRC - [2012/10/15 11:58:22 | 000,779,200 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011/10/13 15:44:36 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013/05/03 11:27:53 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/03/15 07:53:06 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013/03/14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/12/18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/10/19 14:51:08 | 000,395,200 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe -- (Kodak AiO Network Discovery Service)
SRV - [2012/10/15 11:58:22 | 000,779,200 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe -- (Kodak AiO Status Monitor Service)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/04/14 21:23:47 | 000,303,616 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2013/04/14 21:23:46 | 000,035,328 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2013/01/22 14:25:52 | 000,076,648 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS)
DRV:64bit: - [2013/01/22 14:25:42 | 000,085,864 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K)
DRV:64bit: - [2012/12/19 07:41:52 | 000,194,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/08/08 20:13:12 | 000,198,480 | ---- | M] (SysProgs.org) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BazisVirtualCDBus.sys -- (BazisVirtualCDBus)
DRV:64bit: - [2011/06/24 05:31:02 | 000,055,424 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009/07/14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 22:35:36 | 000,867,328 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008/10/03 18:08:28 | 000,225,296 | ---- | M] (Advanced Micro Devices, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ahcix64s.sys -- (ahcix64s)
DRV:64bit: - [2008/04/28 15:25:06 | 000,016,400 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2007/10/12 03:40:14 | 000,010,632 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdide64.sys -- (amdide64)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?rd=1&ucc=DE&dcc=DE&opt=0&ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 4D DA AD 0B 2F CE 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://mixidj.delta-search.com/?q={searchTerms}&affID=121136&tt=gc_&babsrc=SP_ss&mntrId=54DA0025D3258F8D
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Plus Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/04/15 19:10:32 | 000,000,000 | ---D | M]
 
[2013/04/14 11:24:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - Extension: Google Docs = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Google-Suche = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\.orig
CHR - Extension: JDownloader Integration for Google Chrome = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\laeghehalempfenbefbjbhccjcoakpmm\1.2.3_0\
CHR - Extension: Ghostery = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\4.1.1_0\
CHR - Extension: TubeDisco = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfiefjmhoaciboiilfpdnkneoodkbdlj\1.0.1_0\
CHR - Extension: Google Mail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\RunOnce: [*-169427056] "C:\Users\user\AppData\Roaming\-169427056\acrotray.exe" File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.234.128.7 195.234.128.16
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{281DB2B1-4132-4581-91B2-B0D165DCD073}: DhcpNameServer = 195.234.128.7 195.234.128.16
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{383faf1d-a4ea-11e2-ba67-002421b97e37}\Shell - "" = AutoRun
O33 - MountPoints2\{383faf1d-a4ea-11e2-ba67-002421b97e37}\Shell\AutoRun\command - "" = V:\Autorun.exe
O33 - MountPoints2\{596ddf24-9b0e-11e2-afdc-002421b97e37}\Shell - "" = AutoRun
O33 - MountPoints2\{596ddf24-9b0e-11e2-afdc-002421b97e37}\Shell\AutoRun\command - "" = V:\setup.exe
O33 - MountPoints2\{7632f37f-b63b-11e2-8630-002421b97e37}\Shell - "" = AutoRun
O33 - MountPoints2\{7632f37f-b63b-11e2-8630-002421b97e37}\Shell\AutoRun\command - "" = V:\cdstart.exe
O33 - MountPoints2\{7632f38e-b63b-11e2-8630-002421b97e37}\Shell - "" = AutoRun
O33 - MountPoints2\{7632f38e-b63b-11e2-8630-002421b97e37}\Shell\AutoRun\command - "" = W:\dxhr.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/14 18:20:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013/05/14 15:03:36 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013/05/14 15:03:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\MFAData
[2013/05/14 15:03:36 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2013/05/14 15:03:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Avg2013
[2013/05/06 23:11:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TUGZip
[2013/05/06 23:11:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TUGZip
[2013/05/06 22:59:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinAce
[2013/05/06 22:59:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinAce
[2013/05/06 22:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013/05/06 21:58:49 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\dxhr
[2013/05/06 21:58:08 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\ALI213
[2013/05/06 21:58:08 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\28050
[2013/05/06 21:44:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eidos
[2013/05/06 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Eidos
[2013/05/06 19:19:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2013
[2013/05/06 19:17:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Landwirtschafts Simulator 2013
[2013/05/03 12:10:01 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Audacity
[2013/05/03 12:09:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity
[2013/05/03 11:50:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013/05/03 11:47:40 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Ashampoo
[2013/05/03 11:47:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ashampoo
[2013/05/03 11:47:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2013/05/03 11:47:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Ashampoo
[2013/05/03 11:47:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ashampoo
[2013/05/03 11:35:18 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Ripped karaoke
[2013/05/03 11:35:18 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Doblon
[2013/05/03 11:35:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Power CD+G Burner 2
[2013/05/03 11:35:14 | 000,031,744 | ---- | C] (Rocket Division Software, StarBurn Software) -- C:\Windows\SysWow64\WnASPI32.dll
[2013/05/03 11:35:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Doblon
[2013/05/03 11:35:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\cdrdao
[2013/05/03 11:35:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Doblon
[2013/05/03 11:28:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Iminent
[2013/05/03 11:27:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2013/05/03 11:27:48 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2013/05/03 11:10:55 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Diagnostics
[2013/05/03 11:06:53 | 000,000,000 | RHSD | C] -- C:\Users\user\AppData\Roaming\-169427056
[2013/05/03 10:37:30 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2013/04/27 23:26:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
[2013/04/27 23:25:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GOGcom
[2013/04/27 03:53:17 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pontifex II
[2013/04/27 03:53:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pontifex II
[2013/04/27 03:53:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pontifex II
[2013/04/23 02:22:07 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2013/04/23 02:21:54 | 000,257,384 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\ftd2xx.dll
[2013/04/23 02:21:54 | 000,219,496 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysWow64\ftd2xx.dll
[2013/04/23 02:21:54 | 000,215,400 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\FTLang.dll
[2013/04/23 02:21:54 | 000,109,416 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\ftbusui.dll
[2013/04/23 02:21:54 | 000,085,864 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\drivers\ftser2k.sys
[2013/04/23 02:21:54 | 000,076,648 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\drivers\ftdibus.sys
[2013/04/23 02:21:54 | 000,065,896 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\ftcserco.dll
[2013/04/23 02:21:54 | 000,055,656 | ---- | C] (FTDI Ltd.) -- C:\Windows\SysNative\ftserui2.dll
[2013/04/23 01:56:51 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Arduino
[2013/04/23 01:56:50 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Arduino
[2013/04/23 01:56:16 | 000,000,000 | ---D | C] -- C:\arduino
[2013/04/21 17:55:29 | 000,000,000 | ---D | C] -- C:\Program Files\Revision3
[2013/04/21 17:50:21 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Downloaded Installations
[2013/04/15 19:12:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\DivX
[2013/04/15 19:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2013/04/15 19:10:08 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2013/04/15 19:10:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared
[2013/04/15 19:08:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX
[2013/04/15 19:05:58 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2013/04/15 19:03:18 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Nero
[2013/04/15 18:53:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero
[2013/04/15 18:53:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2013/04/15 18:03:55 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\WinFF
[2013/04/15 18:03:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinFF
[2013/04/15 18:03:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinFF
[2013/04/15 18:03:29 | 000,000,000 | ---D | C] -- C:\ffmpeg
[2013/04/14 21:23:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anno 1701
[2013/04/14 21:20:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Anno 1701
[2013/04/14 21:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2013/04/14 21:05:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/14 18:46:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/14 18:24:58 | 000,000,000 | ---- | M] () -- C:\Users\user\defogger_reenable
[2013/05/14 18:20:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013/05/14 17:54:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/14 13:52:25 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/14 13:52:25 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/14 13:49:22 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/14 13:49:22 | 000,623,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/14 13:49:22 | 000,106,316 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/05/14 13:47:35 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/14 13:45:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/14 13:44:56 | 3219,890,176 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/09 21:04:45 | 000,000,866 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2013/05/06 19:19:08 | 000,001,283 | ---- | M] () -- C:\Users\user\Desktop\Landwirtschafts Simulator 2013 .lnk
[2013/05/03 12:09:53 | 000,001,007 | ---- | M] () -- C:\Users\user\Desktop\Audacity.lnk
[2013/05/03 11:47:27 | 000,001,323 | ---- | M] () -- C:\Users\Public\Desktop\Ashampoo Burning Studio 2013.lnk
[2013/05/03 11:47:27 | 000,000,214 | ---- | M] () -- C:\Users\Public\Desktop\Your Software Deals.url
[2013/05/03 11:35:15 | 000,001,234 | ---- | M] () -- C:\Users\user\Desktop\Power CD+G Burner 2.lnk
[2013/04/27 23:26:26 | 000,002,064 | ---- | M] () -- C:\Users\Public\Desktop\Dungeon Keeper 2.lnk
[2013/04/16 09:51:23 | 000,281,896 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/15 19:10:33 | 000,001,570 | ---- | M] () -- C:\Users\user\Desktop\DivX Movies.lnk
[2013/04/15 19:10:26 | 000,001,112 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2013/04/15 19:10:18 | 000,001,152 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2013/04/15 18:25:15 | 008,052,940 | ---- | M] () -- C:\Users\user\Documents\Es_war_einmal_das_Leben_-_02_-_Die_Geburt.avi
[2013/04/14 21:23:54 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\Anno 1701.lnk
[2013/04/14 21:23:47 | 000,303,616 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2013/04/14 21:23:46 | 000,035,328 | ---- | M] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/14 18:24:58 | 000,000,000 | ---- | C] () -- C:\Users\user\defogger_reenable
[2013/05/06 23:11:03 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\ztvunrar36.dll
[2013/05/06 23:11:03 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\ztvunace26.dll
[2013/05/06 19:19:08 | 000,001,283 | ---- | C] () -- C:\Users\user\Desktop\Landwirtschafts Simulator 2013 .lnk
[2013/05/03 12:09:53 | 000,001,007 | ---- | C] () -- C:\Users\user\Desktop\Audacity.lnk
[2013/05/03 12:09:52 | 000,001,019 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[2013/05/03 12:09:20 | 000,000,866 | ---- | C] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2013/05/03 11:47:27 | 000,001,323 | ---- | C] () -- C:\Users\Public\Desktop\Ashampoo Burning Studio 2013.lnk
[2013/05/03 11:47:27 | 000,000,214 | ---- | C] () -- C:\Users\Public\Desktop\Your Software Deals.url
[2013/05/03 11:35:15 | 000,001,234 | ---- | C] () -- C:\Users\user\Desktop\Power CD+G Burner 2.lnk
[2013/05/03 11:27:55 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/04/27 23:26:26 | 000,002,064 | ---- | C] () -- C:\Users\Public\Desktop\Dungeon Keeper 2.lnk
[2013/04/15 19:10:33 | 000,001,570 | ---- | C] () -- C:\Users\user\Desktop\DivX Movies.lnk
[2013/04/15 19:10:26 | 000,001,112 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2013/04/15 19:10:18 | 000,001,152 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2013/04/15 18:14:18 | 008,052,940 | ---- | C] () -- C:\Users\user\Documents\Es_war_einmal_das_Leben_-_02_-_Die_Geburt.avi
[2013/04/14 21:23:54 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\Anno 1701.lnk
[2013/04/14 21:23:47 | 000,303,616 | ---- | C] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2013/04/14 21:23:46 | 000,035,328 | ---- | C] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[2013/04/11 21:44:09 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\pxhpinst.exe
[2011/10/13 15:53:18 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011/10/13 15:53:02 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
 
========== ZeroAccess Check ==========
 
[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010/11/11 19:00:47 | 014,162,944 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010/11/11 19:00:47 | 012,867,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013/05/03 11:06:53 | 000,000,000 | RHSD | M] -- C:\Users\user\AppData\Roaming\-169427056
[2013/04/23 01:56:50 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Arduino
[2013/05/03 11:47:40 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Ashampoo
[2013/05/03 12:17:42 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Audacity
[2013/04/14 12:47:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Azureus
[2013/04/14 11:23:56 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Babylon
[2013/05/03 11:35:18 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Doblon
[2013/04/10 15:32:46 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Temp
[2013/04/15 18:25:18 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\WinFF
 
========== Purity Check ==========
 
 

< End of report >
         


OTL Extras:
Code:
ATTFilter
OTL Extras logfile created on: 5/14/2013 6:49:22 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\user\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 2.77 Gb Available Physical Memory | 69.30% Memory free
7.99 Gb Paging File | 6.61 Gb Available in Paging File | 82.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 352.03 Gb Total Space | 182.48 Gb Free Space | 51.84% Space Free | Partition Type: NTFS
Drive F: | 971.63 Mb Total Space | 326.36 Mb Free Space | 33.59% Space Free | Partition Type: FAT
 
Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{067EE3C0-8D76-4FA9-A9AD-E8B8D322640F}" = lport=27022 | protocol=6 | dir=in | name=war thunder | 
"{16FB8817-A58C-4368-A620-F7A3EFC145AC}" = lport=8090 | protocol=6 | dir=in | name=war thunder | 
"{1F5AD714-6F63-448D-8E11-252F55F11B4B}" = lport=20010 | protocol=17 | dir=in | name=war thunder | 
"{28CEA468-3B5E-4ABB-B324-4F6CD922D954}" = lport=80 | protocol=6 | dir=in | name=war thunder | 
"{32F6C84D-57B0-4D01-8548-819B94FFF74A}" = lport=3478 | protocol=17 | dir=in | name=war thunder | 
"{3A1C5C7F-D584-4C51-AB7B-73A24342FE83}" = lport=6881 | protocol=6 | dir=in | name=war thunder | 
"{555FCAB3-536C-4F8D-8701-E1C16809A118}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 | 
"{713BDBD2-8078-4A3F-B71B-7E321996DFF3}" = lport=20443 | protocol=6 | dir=in | name=war thunder | 
"{98C0EB88-BDF1-4555-BE40-A61031C1396A}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery | 
"{9F89A0BF-BC1B-4B2A-8989-B954EC218A99}" = lport=7850 | protocol=6 | dir=in | name=war thunder | 
"{A4F0CACC-E199-49ED-AE25-B01BC5A670A7}" = lport=443 | protocol=6 | dir=in | name=war thunder | 
"{DF01B03F-206A-4926-B12E-A0A996F4617B}" = lport=33333 | protocol=6 | dir=in | name=war thunder | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0ACF6CCF-1FD5-4AD7-84C3-D9D40689A5EB}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | 
"{0FA27D44-8C7C-4252-966D-063DA57C403C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{1E79F506-9AD3-4E0E-8212-7FF1DAF04CB5}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe | 
"{2B5BF321-26A8-4BE8-B571-1BF0712FBE1B}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe | 
"{2C70F4AB-9540-4E08-B925-CB41BD182B54}" = protocol=17 | dir=in | app=c:\program files (x86)\war thunder\launcher.exe | 
"{471AD530-FCB7-4939-9AD8-1020D1979A94}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe | 
"{475F9A79-98D2-4CF4-877D-A0EF937D8B68}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe | 
"{486327B3-0163-4270-9A5E-CAED7622AB82}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe | 
"{4BC76162-8376-40C5-AF37-EBA7000260E1}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe | 
"{52C96253-F232-49A0-8A82-2187C9F4F10A}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe | 
"{59A86C66-B536-4BE3-9DBA-9E11443F6615}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe | 
"{7586352F-D8C5-4A10-87F6-C8C3AA949A67}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe | 
"{89318F99-FB4B-49A2-9A23-AA5714BD0113}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe | 
"{9F7413D2-14D0-4C54-88FA-EA49ABAA6A8E}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe | 
"{C33DAA04-14F6-4AB1-B2C5-C5E3A7543296}" = dir=out | app=%programfiles% (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe | 
"{C533DB0F-FA0E-4FDA-9A88-C2706FB45732}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe | 
"{CE315076-98C9-4A9C-AE09-C228D392B730}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe | 
"{D0B30E10-E95B-4776-BD3E-9113604971FB}" = dir=out | app=%programfiles% (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe | 
"{E5B3FA7B-7B00-43A9-A5BC-0938AF306592}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe | 
"{E962A360-C532-4AF4-9CA3-05011FB1DFB0}" = protocol=6 | dir=in | app=c:\program files (x86)\war thunder\launcher.exe | 
"{EBB83060-CF48-471E-88C6-A32694A5F264}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | 
"TCP Query User{179297F5-C9FC-4F18-B19F-B8ED983AFDED}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{3BB50134-6808-4ADA-8F78-FCE9DD1EE152}C:\program files (x86)\air conflicts - pacific carriers\acpc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\air conflicts - pacific carriers\acpc.exe | 
"TCP Query User{DBA50C1A-F768-48C8-ADAB-4C1648B29787}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe | 
"TCP Query User{FD4372A0-D833-4F74-8325-A38EB3C47217}C:\program files (x86)\war thunder\aces.exe" = protocol=6 | dir=in | app=c:\program files (x86)\war thunder\aces.exe | 
"UDP Query User{3CCEBC69-4997-448E-A728-9A2E73059AB5}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe | 
"UDP Query User{C3D576EC-F8E2-45EA-A55A-DB238BF7D57F}C:\program files (x86)\air conflicts - pacific carriers\acpc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\air conflicts - pacific carriers\acpc.exe | 
"UDP Query User{D110B222-62C8-4453-A256-4FF3EB81401B}C:\program files (x86)\war thunder\aces.exe" = protocol=17 | dir=in | app=c:\program files (x86)\war thunder\aces.exe | 
"UDP Query User{D5DED85E-14B7-48AC-9624-C4731DFC0EFD}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417017FF}" = Java 7 Update 17 (64-bit)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{2F949F9F-EBD4-8597-5CF0-6370C0161CC9}" = AMD Catalyst Install Manager
"{4f94b43a-8a00-4ac4-bb94-269cf24aef97}.sdb" = Dungeon Keeper 2
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5F19175D-069C-BDC5-B8E4-F2EB8912C5C0}" = AMD Fuel
"{64A3A4F4-B792-11D6-A78A-00B0D0170170}" = Java SE Development Kit 7 Update 17 (64-bit)
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{84207979-F025-35F3-7967-6EA42F4EADC0}" = ccc-utility64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BBBE5EE1-3C55-49AE-A902-D5A3B4D561F8}" = Revision3
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"8461-7759-5462-8226" = Vuze
"9E24492CE9279512BD465F61DB8523641BB7BBFC" = Windows Driver Package - FTDI CDM Driver Package - Bus/D2XX Driver (01/18/2013 2.08.28)
"E61B77ECE57113AE1CA028BC7A8AD6C137BD13DD" = Windows Driver Package - FTDI CDM Driver Package - VCP Driver (01/18/2013 2.08.28)
"GIMP-2_is1" = GIMP 2.8.4
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"VLC media player" = VLC media player 2.0.5
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000A90E0-6736-6DCE-141F-01CCE8F54F8B}" = CCC Help Spanish
"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2
"{050E08AE-5A97-99BC-7929-EBF7B0839BFE}" = CCC Help English
"{1C3DA126-D523-4089-BCCA-FA46FE34D6F8}" = Google Drive
"{1FBA1F27-DED3-EDF3-6326-834902369DA3}" = CCC Help Japanese
"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{44E6F2E0-E52F-A6C4-E314-5978AB46DC81}" = CCC Help Norwegian
"{45D77EDE-0D5B-30EA-E2D7-85DD18E2088A}" = Catalyst Control Center InstallProxy
"{474218AC-4EE2-E8C5-DA15-AB74EA54B926}" = CCC Help French
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{62622BDC-D42B-4ABE-869A-C197694E8BD0}_is1" = Power CD+G Burner 2
"{6597BADF-5C25-00F9-5ED6-809218CCF3A2}" = CCC Help Finnish
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6CB2BF2B-EE3E-0E1C-A357-1C628D7E947D}" = CCC Help Dutch
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{786C5747-1437-443D-B06E-79A00FE45110}" = Adobe Stock Photos 1.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{87622654-DDEB-5AA1-581A-48447C740C35}" = CCC Help Swedish
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{91A0DC22-AAEC-6615-5F6C-2AB3879142C8}" = Catalyst Control Center Localization All
"{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1" = Ashampoo Burning Studio 2013 v.11.0.6
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9D96C938-D119-4324-9E4A-39A059364FAE}_is1" = Deus Ex Human Revolution
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.02)
"{AE3D38A6-13B1-40B3-9423-D1FA9982FB6A}" = Adobe Bridge 1.0
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B74D4E10-0000-0000-0000-EDED00000102}" = Adobe ExtendScript Toolkit 1.0
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific
"{D2E41E17-AE7E-7128-1035-D8AF4211A980}" = CCC Help German
"{D4DB5A3E-6474-1EEA-CE26-5384D9261490}" = CCC Help Danish
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DD362256-A7A2-4524-9457-213DDC2AFC2A}" = Adobe After Effects 7.0
"{DE801D58-6BD6-4C8A-EFEF-FCAFA69865D6}" = CCC Help Italian
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Software
"{E40CE517-0D42-4198-96B4-C8232B257EB5}" = Data Lifeguard Diagnostic for Windows
"{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1" = War Thunder Launcher 1.0.1.189
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3229854-F6D4-55AB-C920-20B5A771DDB8}" = Catalyst Control Center
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{FA17A726-B229-4116-B793-A2AB1A4EAE2E}" = Adobe Premiere Pro 2.0
"5513-1208-7298-9440" = JDownloader 0.9
"7-Zip" = 7-Zip 9.20
"Adobe After Effects 7.0" = Adobe After Effects 7.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Premiere Pro 2.0" = Adobe Premiere Pro 2.0
"Air Conflicts: Pacific Carriers_is1" = Air Conflicts: Pacific Carriers
"Audacity_is1" = Audacity 2.0.3
"Battle for Wesnoth 1.10.6" = Battle for Wesnoth 1.10.6
"DivX Setup" = DivX Setup
"Dungeon Keeper 2_is1" = Dungeon Keeper 2
"FarmingSimulator2013DE_is1" = Landwirtschafts Simulator 2013
"Google Chrome" = Google Chrome
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Pontifex II" = Pontifex II
"PrintProjects" = PrintProjects
"TUGZip_is1" = TUGZip 3.5
"WinCDEmu" = WinCDEmu
"WinFF_is1" = WinFF 1.5 (Codename EMMA)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 4/15/2013 6:25:12 PM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: vlc.exe, version: 2.0.5.0, time stamp: 
0x50cda22f  Faulting module name: libpostproc_plugin.dll, version: 0.0.0.0, time stamp:
 0x50cda24a  Exception code: 0xc0000005  Fault offset: 0x000000000000321a  Faulting process
 id: 0xbc4  Faulting application start time: 0x01ce3a271f3f4ac3  Faulting application
 path: C:\Program Files\VideoLAN\VLC\vlc.exe  Faulting module path: C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll
Report
 Id: 56660183-a61b-11e2-9c7c-002421b97e37
 
Error - 4/21/2013 11:54:02 AM | Computer Name = user-PC | Source = MsiInstaller | ID = 11500
Description = Product: Revision3 -- Error 1500. Another installation is in progress.
 You must complete that installation before continuing this one.
 
Error - 12/31/2007 10:56:50 PM | Computer Name = user-PC | Source = Tvd.Service | ID = 0
Description = Service cannot be started. System.ServiceModel.Diagnostics.CallbackException:
 A user callback threw an exception.  Check the exception stack and inner exception
 to determine the callback that failed. ---> System.ArgumentOutOfRangeException:
 Number must be either non-negative and less than or equal to Int32.MaxValue or 
-1.  Parameter name: dueTime     at System.Threading.Timer..ctor(TimerCallback callback,
 Object state, Int32 dueTime, Int32 period)     at System.Timers.Timer.set_Enabled(Boolean
 value)     at Tvd.Service.TvdService.PTVFolderCreated()     at Tvd.Service.TvdService.OnStartedAction(Object
 sender, EventArgs e)     at System.ServiceModel.Channels.CommunicationObject.OnOpened()

   --- End of inner exception stack trace ---     at System.ServiceModel.Channels.CommunicationObject.OnOpened()

   at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)     
at Tvd.Service.TvdService.OpenService()     at Tvd.Service.TvdService.OnStart(String[]
 args)     at System.ServiceProcess.ServiceBase.ServiceQueuedMainCall...
 
Error - 4/26/2013 9:55:49 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program pf2_v1.x_keygen.exe version 0.0.0.0 stopped interacting
 with Windows and was closed. To see if more information about the problem is available,
 check the problem history in the Action Center control panel.    Process ID: 1b90    Start
 Time: 01ce42ea04ab7bef    Termination Time: 16    Application Path: C:\Users\user\AppData\Local\Temp\7zO6752.tmp\pf2_v1.x_keygen.exe

Report
 Id: 932ca0ed-aedd-11e2-a054-002421b97e37  
 
Error - 5/3/2013 5:35:17 AM | Computer Name = user-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "C:\Program Files (x86)\Doblon\Power
 CD+G Burner 2\MFC80.DLL".Error in manifest or policy file "C:\Program Files (x86)\Doblon\Power
 CD+G Burner 2\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.  Component identity found
 in manifest does not match the identity of the component requested.  Reference is
 Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition
 is Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Please
 use sxstrace.exe for detailed diagnosis.
 
Error - 5/3/2013 5:35:18 AM | Computer Name = user-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "C:\Program Files (x86)\Doblon\Power
 CD+G Burner 2\MFC80.DLL".Error in manifest or policy file "C:\Program Files (x86)\Doblon\Power
 CD+G Burner 2\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.  Component identity found
 in manifest does not match the identity of the component requested.  Reference is
 Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition
 is Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Please
 use sxstrace.exe for detailed diagnosis.
 
Error - 5/3/2013 6:06:42 AM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: burningstudio2013.exe, version: 11.0.6.40,
 time stamp: 0x50f4158c  Faulting module name: wxmsw28u_vc_ash.dll, version: 2.8.12.0,
 time stamp: 0x50f4083f  Exception code: 0xc0000005  Fault offset: 0x000077a0  Faulting
 process id: 0x10b0  Faulting application start time: 0x01ce47e33daa5706  Faulting application
 path: C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 2013\burningstudio2013.exe
Faulting
 module path: C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 2013\wxmsw28u_vc_ash.dll
Report
 Id: 26ca1b3f-b3d9-11e2-85b4-002421b97e37
 
Error - 5/4/2013 1:02:42 PM | Computer Name = user-PC | Source = Iminent | ID = 0
Description = 
 
Error - 5/9/2013 2:51:13 PM | Computer Name = user-PC | Source = Iminent | ID = 0
Description = 
 
Error - 5/9/2013 3:03:43 PM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: uninstall.exe_unknown, version: 2.6.1249.132,
 time stamp: 0x514c661b  Faulting module name: uninstall.exe, version: 2.6.1249.132,
 time stamp: 0x514c661b  Exception code: 0x40000015  Fault offset: 0x00102a30  Faulting
 process id: 0x650  Faulting application start time: 0x01ce4ce7ece05e15  Faulting application
 path: C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
Faulting
 module path: C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
Report
 Id: 2ac1473b-b8db-11e2-879f-002421b97e37
 
[ Media Center Events ]
Error - 5/11/2013 3:14:58 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 9:14:58 PM - Error connecting to the internet.  9:14:58 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 3:15:04 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 9:15:03 PM - Error connecting to the internet.  9:15:03 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 4:15:08 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 10:15:08 PM - Error connecting to the internet.  10:15:08 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 4:15:14 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 10:15:13 PM - Error connecting to the internet.  10:15:13 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 5:15:19 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 11:15:19 PM - Error connecting to the internet.  11:15:19 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 5:15:25 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 11:15:24 PM - Error connecting to the internet.  11:15:24 PM -     Unable
 to contact server..  
 
Error - 5/11/2013 6:51:42 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 12:51:42 AM - Error connecting to the internet.  12:51:42 AM -     Unable
 to contact server..  
 
Error - 5/11/2013 6:51:48 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 12:51:47 AM - Error connecting to the internet.  12:51:47 AM -     Unable
 to contact server..  
 
Error - 5/13/2013 1:22:30 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 7:22:25 PM - Error connecting to the internet.  7:22:25 PM -     Unable
 to contact server..  
 
Error - 5/13/2013 2:22:35 PM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 8:22:34 PM - Error connecting to the internet.  8:22:34 PM -     Unable
 to contact server..  
 
[ System Events ]
Error - 5/9/2013 2:25:32 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The atksgt service failed to start due to the following error:   %%577
 
Error - 5/9/2013 2:25:35 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The lirsgt service failed to start due to the following error:   %%577
 
Error - 5/11/2013 2:09:53 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The atksgt service failed to start due to the following error:   %%577
 
Error - 5/11/2013 2:09:53 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The lirsgt service failed to start due to the following error:   %%577
 
Error - 5/12/2013 3:52:16 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The atksgt service failed to start due to the following error:   %%577
 
Error - 5/12/2013 3:52:17 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The lirsgt service failed to start due to the following error:   %%577
 
Error - 5/13/2013 1:18:14 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The atksgt service failed to start due to the following error:   %%577
 
Error - 5/13/2013 1:18:14 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The lirsgt service failed to start due to the following error:   %%577
 
Error - 5/14/2013 7:45:09 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The atksgt service failed to start due to the following error:   %%577
 
Error - 5/14/2013 7:45:09 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The lirsgt service failed to start due to the following error:   %%577
 
 
< End of report >
         
Gmer log:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-14 19:19:16
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\00000066 WDC_WD64 rev.05.0 596.17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\user\AppData\Local\Temp\kxldapob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                            suspicious modification

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                  00000000763b1401 2 bytes JMP 767aeb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                    00000000763b1419 2 bytes JMP 767bb513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                  00000000763b1431 2 bytes JMP 76838609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                  00000000763b144a 2 bytes CALL 76791dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                         * 9
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                     00000000763b14dd 2 bytes JMP 76837efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17              00000000763b14f5 2 bytes JMP 768380d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                     00000000763b150d 2 bytes JMP 76837df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17              00000000763b1525 2 bytes JMP 768381c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                    00000000763b153d 2 bytes JMP 767af088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                         00000000763b1555 2 bytes JMP 767bb885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                  00000000763b156d 2 bytes JMP 768386c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                    00000000763b1585 2 bytes JMP 76838222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                       00000000763b159d 2 bytes JMP 76837db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                    00000000763b15b5 2 bytes JMP 767af121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                  00000000763b15cd 2 bytes JMP 767bb29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20              00000000763b16b2 2 bytes JMP 76838584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31              00000000763b16bd 2 bytes JMP 76837d4d C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17               00000000763b1401 2 bytes JMP 767aeb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                 00000000763b1419 2 bytes JMP 767bb513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17               00000000763b1431 2 bytes JMP 76838609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42               00000000763b144a 2 bytes CALL 76791dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                         * 9
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                  00000000763b14dd 2 bytes JMP 76837efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17           00000000763b14f5 2 bytes JMP 768380d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                  00000000763b150d 2 bytes JMP 76837df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17           00000000763b1525 2 bytes JMP 768381c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                 00000000763b153d 2 bytes JMP 767af088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                      00000000763b1555 2 bytes JMP 767bb885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17               00000000763b156d 2 bytes JMP 768386c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                 00000000763b1585 2 bytes JMP 76838222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                    00000000763b159d 2 bytes JMP 76837db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                 00000000763b15b5 2 bytes JMP 767af121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17               00000000763b15cd 2 bytes JMP 767bb29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20           00000000763b16b2 2 bytes JMP 76838584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1836] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31           00000000763b16bd 2 bytes JMP 76837d4d C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000763b1401 2 bytes JMP 767aeb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000763b1419 2 bytes JMP 767bb513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000763b1431 2 bytes JMP 76838609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000763b144a 2 bytes CALL 76791dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                         * 9
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000763b14dd 2 bytes JMP 76837efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000763b14f5 2 bytes JMP 768380d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000763b150d 2 bytes JMP 76837df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000763b1525 2 bytes JMP 768381c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000763b153d 2 bytes JMP 767af088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000763b1555 2 bytes JMP 767bb885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000763b156d 2 bytes JMP 768386c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000763b1585 2 bytes JMP 76838222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000763b159d 2 bytes JMP 76837db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000763b15b5 2 bytes JMP 767af121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000763b15cd 2 bytes JMP 767bb29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000763b16b2 2 bytes JMP 76838584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000763b16bd 2 bytes JMP 76837d4d C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17            00000000763b1401 2 bytes JMP 767aeb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17              00000000763b1419 2 bytes JMP 767bb513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17            00000000763b1431 2 bytes JMP 76838609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42            00000000763b144a 2 bytes CALL 76791dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                         * 9
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17               00000000763b14dd 2 bytes JMP 76837efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17        00000000763b14f5 2 bytes JMP 768380d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17               00000000763b150d 2 bytes JMP 76837df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17        00000000763b1525 2 bytes JMP 768381c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17              00000000763b153d 2 bytes JMP 767af088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                   00000000763b1555 2 bytes JMP 767bb885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17            00000000763b156d 2 bytes JMP 768386c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17              00000000763b1585 2 bytes JMP 76838222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                 00000000763b159d 2 bytes JMP 76837db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17              00000000763b15b5 2 bytes JMP 767af121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17            00000000763b15cd 2 bytes JMP 767bb29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20        00000000763b16b2 2 bytes JMP 76838584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe[2964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31        00000000763b16bd 2 bytes JMP 76837d4d C:\Windows\syswow64\kernel32.dll

---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                            suspicious modification

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                       unknown MBR code

---- EOF - GMER 2.1 ----
         
Nachdem GMER durchgelaufen ist habe ich den Rechner neu gestartet. Das runterfahren hat extrem lange gedauert. Der "Windows wird heruntergefahren"-Bildschirm war für ca. 5 - 10 Minuten zu sehen. Dann kam ein blauer Bildschirm mit weißer Schrift. Ganz unten stand etwas von Crash Dump.
Dann hab ich den Rechner wieder hoch gefahren, Windows normal starten lassen. Es öffnete sich ein Fenster "windows has recovered from an unexpected Shutdown" und fragte mich ob ich die Daten an Microsoft schicken will.
Weil das vielleicht zusammenhängt, soll ich C:\Windows\Minidump\051413-32807-01.dmp und C:\Users\user\AppData\Local\Temp\WER-107703-0.sysdata.xml auch posten?
Sollte ich, weil in der Zeit vielleicht was neues passiert ist, alle tools nochmal laufen lassen?

Schon mal vielen Dank im vorraus für Eure Hilfe.

PS: Ich bin nun schon seit 5 Minuten im Internet, bisher ist keine neue .exe aufgetaucht.

Alt 14.05.2013, 19:02   #2
t'john
/// Helfer-Team
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet





Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL

O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found 
O4 - HKCU..\RunOnce: [*-169427056] "C:\Users\user\AppData\Roaming\-169427056\acrotray.exe" File not found 

:Files 
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\user\*.tmp
C:\Users\user\AppData\*.dll
C:\Users\user\AppData\*.exe
C:\Users\user\AppData\Local\Temp\*.exe
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers


danach:

3. Schritt
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).
__________________

__________________

Alt 15.05.2013, 16:13   #3
asdfgh12345
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Vielen Dank! Mit so einer schnellen Antwort hatte ich nicht gerechnet.
Das Problem (16bit exe) ist nicht mehr aufgetreten. Wobei da ja noch andere Sachen passieren könnten die ich gar nicht mitbekomme.

Hier sind die logs:

OTL:
Code:
ATTFilter
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Conime deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\*-169427056 not found.
Invalid CLSID key: *-169427056
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
File\Folder C:\ProgramData\TEMP not found.
File\Folder C:\Users\user\*.tmp not found.
File\Folder C:\Users\user\AppData\*.dll not found.
File\Folder C:\Users\user\AppData\*.exe not found.
C:\Users\user\AppData\Local\Temp\behloruy.exe moved successfully.
C:\Users\user\AppData\Local\Temp\dotNetFx40_Client_setup.exe moved successfully.
C:\Users\user\AppData\Local\Temp\eebbyzzw.exe moved successfully.
C:\Users\user\AppData\Local\Temp\eeefbccz.exe moved successfully.
C:\Users\user\AppData\Local\Temp\effcczzd.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ehknruxb.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ehkoruxb.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ffcdaaax.exe moved successfully.
C:\Users\user\AppData\Local\Temp\filosvyc.exe moved successfully.
C:\Users\user\AppData\Local\Temp\filpsvyc.exe moved successfully.
C:\Users\user\AppData\Local\Temp\fimpsvzc.exe moved successfully.
C:\Users\user\AppData\Local\Temp\fimpswzc.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ggdebbby.exe moved successfully.
C:\Users\user\AppData\Local\Temp\gjmptwzc.exe moved successfully.
C:\Users\user\AppData\Local\Temp\hknruxae.exe moved successfully.
C:\Users\user\AppData\Local\Temp\hknruxbe.exe moved successfully.
C:\Users\user\AppData\Local\Temp\hkoruybe.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ilorvybf.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ilosvybf.exe moved successfully.
C:\Users\user\AppData\Local\Temp\impsvzcf.exe moved successfully.
C:\Users\user\AppData\Local\Temp\jmqtwzdg.exe moved successfully.
C:\Users\user\AppData\Local\Temp\jnqtwadg.exe moved successfully.
C:\Users\user\AppData\Local\Temp\knqtxadg.exe moved successfully.
C:\Users\user\AppData\Local\Temp\knruxaeh.exe moved successfully.
C:\Users\user\AppData\Local\Temp\knruxbeh.exe moved successfully.
C:\Users\user\AppData\Local\Temp\loruybei.exe moved successfully.
C:\Users\user\AppData\Local\Temp\losvybfi.exe moved successfully.
C:\Users\user\AppData\Local\Temp\lpsvycfi.exe moved successfully.
C:\Users\user\AppData\Local\Temp\lpsvzcfi.exe moved successfully.
C:\Users\user\AppData\Local\Temp\MixiDJToolbar_yh.exe moved successfully.
C:\Users\user\AppData\Local\Temp\mmjjghhe.exe moved successfully.
C:\Users\user\AppData\Local\Temp\mpswzcfj.exe moved successfully.
C:\Users\user\AppData\Local\Temp\mptwzdgj.exe moved successfully.
C:\Users\user\AppData\Local\Temp\nqtxadgk.exe moved successfully.
C:\Users\user\AppData\Local\Temp\nruxaehk.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ollijjgg.exe moved successfully.
C:\Users\user\AppData\Local\Temp\oollijjg.exe moved successfully.
C:\Users\user\AppData\Local\Temp\oruxbehk.exe moved successfully.
C:\Users\user\AppData\Local\Temp\oruybeil.exe moved successfully.
C:\Users\user\AppData\Local\Temp\psvzcfim.exe moved successfully.
C:\Users\user\AppData\Local\Temp\pswzcfjm.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ptwzcgjm.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ptwzdgjm.exe moved successfully.
C:\Users\user\AppData\Local\Temp\qtwadgjn.exe moved successfully.
C:\Users\user\AppData\Local\Temp\qtxadgkn.exe moved successfully.
C:\Users\user\AppData\Local\Temp\quxadhkn.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ruybehlo.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ruybeilo.exe moved successfully.
C:\Users\user\AppData\Local\Temp\rvybeilo.exe moved successfully.
C:\Users\user\AppData\Local\Temp\twadgjnq.exe moved successfully.
C:\Users\user\AppData\Local\Temp\twadgknq.exe moved successfully.
C:\Users\user\AppData\Local\Temp\twzcgjmp.exe moved successfully.
C:\Users\user\AppData\Local\Temp\twzdgjmq.exe moved successfully.
C:\Users\user\AppData\Local\Temp\txadgknq.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uninst1.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uurroppm.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uxadhknr.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uxaehkor.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uybehlor.exe moved successfully.
C:\Users\user\AppData\Local\Temp\uybeilor.exe moved successfully.
C:\Users\user\AppData\Local\Temp\vlc-2.0.6-win64.exe moved successfully.
C:\Users\user\AppData\Local\Temp\vybeilor.exe moved successfully.
C:\Users\user\AppData\Local\Temp\vycfilps.exe moved successfully.
C:\Users\user\AppData\Local\Temp\wadgknqt.exe moved successfully.
C:\Users\user\AppData\Local\Temp\wwttquur.exe moved successfully.
C:\Users\user\AppData\Local\Temp\wzcfjmps.exe moved successfully.
C:\Users\user\AppData\Local\Temp\wzdgjmqt.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ybeilorv.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ybfilosv.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ybfilpsv.exe moved successfully.
C:\Users\user\AppData\Local\Temp\ycfilpsv.exe moved successfully.
C:\Users\user\AppData\Local\Temp\zcgjmptw.exe moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\user\Desktop\cmd.bat deleted successfully.
C:\Users\user\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: user
->Temp folder emptied: 1310942365 bytes
->Temporary Internet Files folder emptied: 56516698 bytes
->Google Chrome cache emptied: 7268259 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19524346 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84793 bytes
RecycleBin emptied: 4661796861 bytes
 
Total Files Cleaned = 5,776.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05152013_163903

Files\Folders moved on Reboot...
C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\TMP000000016A7627AA714E9BC1 not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

mbar:
Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.15.07

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
user :: USER-PC [administrator]

5/15/2013 4:55:08 PM
mbar-log-2013-05-15 (16-55-08).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 42766
Time elapsed: 6 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         

AdwCleaner:
Code:
ATTFilter
# AdwCleaner v2.300 - Logfile created 05/15/2013 at 16:59:59
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Ultimate  (64 bits)
# User : user - USER-PC
# Boot Mode : Normal
# Running from : C:\Users\user\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Iminent
Deleted on reboot : C:\ProgramData\Babylon

***** [Registry] *****

Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_nonsearch_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_nonsearch_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\5e28a88b33fe541
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16671

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://mixidj.delta-search.com/?affID=121136&tt=gc_&babsrc=NT_ss&mntrId=54DA0025D3258F8D --> hxxp://www.google.com

-\\ Google Chrome v26.0.1410.64

*************************

AdwCleaner[R1].txt - [1888 octets] - [14/04/2013 11:52:02]
AdwCleaner[R2].txt - [865 octets] - [14/04/2013 11:57:48]
AdwCleaner[S1].txt - [1878 octets] - [14/04/2013 11:52:50]
AdwCleaner[S2].txt - [934 octets] - [14/04/2013 11:58:36]
AdwCleaner[S3].txt - [10569 octets] - [15/05/2013 16:59:59]

########## EOF - C:\AdwCleaner[S3].txt - [10630 octets] ##########
         
__________________

Alt 15.05.2013, 16:35   #4
t'john
/// Helfer-Team
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



OK:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

__________________
Mfg, t'john
Das TB unterstützen

Alt 16.05.2013, 20:37   #5
asdfgh12345
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Nichts gefunden.

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.05.16.06

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
user :: USER-PC [administrator]

Protection: Enabled

5/16/2013 4:20:58 PM
mbam-log-2013-05-16 (16-20-58).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 494079
Time elapsed: 1 hour(s), 6 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         


Alt 17.05.2013, 10:10   #6
t'john
/// Helfer-Team
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



dann:

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.
__________________
--> Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet

Alt 17.05.2013, 18:16   #7
asdfgh12345
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



aswMBR
Code:
ATTFilter
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-17 18:11:42
-----------------------------
18:11:42.691    OS Version: Windows x64 6.1.7600 
18:11:42.691    Number of processors: 4 586 0x203
18:11:42.691    ComputerName: USER-PC  UserName: user
18:11:44.095    Initialize success
18:14:09.939    AVAST engine defs: 13051700
18:17:43.035    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000067
18:17:43.035    Disk 0 Vendor: WDC_WD64 05.0 Size: 610480MB BusType: 8
18:17:43.160    Disk 0 MBR read successfully
18:17:43.176    Disk 0 MBR scan
18:17:43.176    Disk 0 unknown MBR code
18:17:43.176    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       360481 MB offset 16065
18:17:43.207    Disk 0 Partition 2 00     83        Linux            241298 MB offset 738283520
18:17:43.223    Disk 0 Partition - 00     05     Extended              8691 MB offset 1232463870
18:17:43.238    Disk 0 Partition 3 00     82   Linux swap              8691 MB offset 1232463872
18:17:43.269    Disk 0 scanning C:\Windows\system32\drivers
18:17:51.678    Service scanning
18:18:09.134    Modules scanning
18:18:09.134    Disk 0 trace - called modules:
18:18:09.649    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll ahcix64s.sys 
18:18:09.665    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004e9f060]
18:18:09.665    3 CLASSPNP.SYS[fffff8800100143f] -> nt!IofCallDriver -> \Device\00000067[0xfffffa8004a5e9d0]
18:18:10.991    AVAST engine scan C:\Windows
18:18:13.315    AVAST engine scan C:\Windows\system32
18:20:55.992    AVAST engine scan C:\Windows\system32\drivers
18:21:05.773    AVAST engine scan C:\Users\user
18:22:41.152    Disk 0 MBR has been saved successfully to "C:\Users\user\Desktop\MBR.dat"
18:22:41.167    The log file has been saved successfully to "C:\Users\user\Desktop\aswMBR.txt"
         
SecurityCheck
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.63  
 Windows 7  x64 (UAC is enabled)  
 Out of date service pack!! 
 Internet Explorer 8 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Java 7 Update 17  
 Java version out of Date! 
 Adobe Reader XI  
 Google Chrome 26.0.1410.43  
 Google Chrome 26.0.1410.64  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 0% 
````````````````````End of Log``````````````````````
         

Alt 17.05.2013, 20:11   #8
t'john
/// Helfer-Team
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Alles Windows Updates einspielen, inkl. Service Pack & Internet Explorer!
http://windowsupdate.microsoft.com


Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die .exe-Datei
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 21 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 13.07.2013, 15:41   #9
t'john
/// Helfer-Team
 
Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Standard

Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet
adblock, adobe after effects, adobe reader xi, autorun, bho, bonjour, error, exe, firefox, flash player, format, frage, helper, homepage, hängt, install.exe, internet, langs, locker, minidump, msiinstaller, object, problem, programm, realtek, registry, rundll, scan, searchscopes, security, software, starten, studio, trojaner, win 7 64bit, windows



Ähnliche Themen: Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet


  1. Firefox lädt ständig - ununterbrochen neu/Werbung/neue Tabs/neue Fenster
    Log-Analyse und Auswertung - 28.10.2015 (11)
  2. Windows 7 lädt ca. 6 Minuten, Desktop dann 2 weitere Minuten, Combofix zeigte Infektion
    Log-Analyse und Auswertung - 30.08.2015 (25)
  3. Windows 7 lädt ca. 6 Minuten, Desktop dann 2 weitere Minuten, Combofix zeigte Infektion
    Alles rund um Windows - 09.08.2015 (4)
  4. Internet (Mozilla Firefox) öffnet sich alle 5-15 Minuten selber und zeigt Werbung.
    Plagegeister aller Art und deren Bekämpfung - 02.01.2014 (1)
  5. Internet geht ca alle 10 minuten aus
    Plagegeister aller Art und deren Bekämpfung - 19.11.2012 (19)
  6. alle 5 minuten erscheint der gleiche Trojaner
    Plagegeister aller Art und deren Bekämpfung - 24.10.2012 (10)
  7. Internet bricht alle paar Minuten kurz ab, Spybot S&D findet Trojaner
    Log-Analyse und Auswertung - 27.07.2012 (25)
  8. Alle 4 Minuten werden 2 Trojaner gefunden
    Plagegeister aller Art und deren Bekämpfung - 17.07.2012 (9)
  9. Internet setzt alle paar Minuten aus
    Plagegeister aller Art und deren Bekämpfung - 09.10.2011 (24)
  10. Internet bricht alle ca5 minuten ab
    Netzwerk und Hardware - 08.06.2010 (0)
  11. Internet-Explorer öffnet sich alle 3 Minuten automatisch
    Log-Analyse und Auswertung - 14.01.2010 (5)
  12. Internet Explorer Werbung alle paar Minuten auf neuer Seite
    Log-Analyse und Auswertung - 08.10.2009 (1)
  13. internet reist alle 5 Minuten ab
    Netzwerk und Hardware - 13.02.2009 (16)
  14. Internet Explorer öffnet alle paar Minuten Werbung
    Mülltonne - 16.12.2008 (0)
  15. Trojaner Meldung durch Windows Firewall alle 5 Minuten
    Plagegeister aller Art und deren Bekämpfung - 11.09.2008 (3)
  16. Internet startet alle paar minuten mit einer leeren Seite
    Log-Analyse und Auswertung - 01.08.2006 (2)
  17. PC lädt nicht alle Bilder im Internet
    Alles rund um Windows - 30.04.2005 (4)

Zum Thema Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet - Hallo! Ich habe einen Trojaner auf dem Rechner. Ich habe es nur bemerkt weil heute nach dem anmachen des Rechners folgende Fehlermeldung kam: Seitdem erstellt der Rechner alle 2 Minuten - Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet...
Archiv
Du betrachtest: Trojaner/rootkit Win 7 64bit, lädt alle 2 Minuten neue 16bit exe Datei aus dem Internet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.