Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Internet Explorer öffnet von selbst und ungefragt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 23.06.2010, 13:11   #1
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Guten Tag.

Von Zeit zu Zeit öffnet sich mein Internet Explorer selbst. Manchmal mit einer Werbungsseite, manchmal scheint es die zu öffnende Seite nicht mehr zu geben. Antivir habe ich auf die Jagd geschickt, aber es gab keine Beute.
Ich habe schon viel im Internet gesucht aber keine Lösung gefunden.

Gelernt habe ich aus der Internetsucherei nur, das man aus diesem HijackThis-Log das Problem herauslesen kann. Darum ist hier mal mein Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:01:56, on 23.06.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Users\Paul\AppData\Local\Temp\Pdj.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Steam\steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\MI1933~1\Office12\OUTLOOK.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Paul\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing)
R3 - URLSearchHook: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\system32\msxml71.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Eazel-DE Toolbar - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (file missing)
O3 - Toolbar: PHPNukeDE Toolbar - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe GE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe -w
O4 - HKCU\..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe -mini
O4 - Global Startup: SetPointII.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O16 - DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

--
End of file - 9245 bytes


Ich hoffe das Problem lässt sich nun schnell und einfach klähren.

Thx im Vorraus.

Alt 23.06.2010, 13:58   #2
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "run Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
__________________


Alt 23.06.2010, 18:36   #3
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Vielen Dank für die Antwort.
Hier die 2 Reporte:


Report 1(OTL)
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 23.06.2010 19:20:22 - Run 1
OTL by OldTimer - Version 3.2.6.1     Folder = C:\Users\Paul\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,96 Gb Total Space | 557,28 Gb Free Space | 61,11% Space Free | Partition Type: NTFS
Drive D: | 19,54 Gb Total Space | 14,18 Gb Free Space | 72,54% Space Free | Partition Type: FAT32
Drive E: | 931,51 Gb Total Space | 931,39 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PAUL-PC
Current User Name: Paul
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Paul\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Users\Paul\AppData\Local\Temp\Pdj.exe ()
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Steam\steam.exe (Valve Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\Logitech\SetPoint II\SetPointII.exe (Logitech Inc.)
PRC - C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Paul\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (libusb0) -- C:\Windows\System32\drivers\libusb0.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKLM\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.03 17:10:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.12 18:39:49 | 000,000,000 | ---D | M]
 
[2009.04.23 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla\Extensions
[2010.06.23 13:11:14 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions
[2010.04.30 14:19:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.15 18:34:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.04.30 14:19:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.06.13 20:11:57 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.12 18:39:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.15 19:11:03 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.15 19:11:03 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.15 19:11:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.15 19:11:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.15 19:11:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (XML Class) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\System32\msxml71.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKLM\..\Toolbar: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\..\Toolbar\WebBrowser: (Eazel-DE Toolbar) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe (Google)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe (Take-Two Interactive Software, Inc.)
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Steam] c:\program files\steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: CabBuilder hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.185.33 83.169.185.97
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005.09.12 02:00:34 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>) - G:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005.09.12 02:00:34 | 000,000,043 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2005.09.12 02:00:34 | 000,001,042 | R--- | M] () - G:\autorun.ini -- [ CDFS ]
O33 - MountPoints2\{03277723-2f72-11de-a973-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{03277723-2f72-11de-a973-806e6f6e6963}\Shell\AutoRun\command - "" = G:\autorun.exe -- [2005.09.12 02:00:34 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008.01.21 04:34:27 | 000,000,000 | ---D | M]
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.15 04:16:24 | 000,086,016 | ---- | C] (Beepa P/L) -- C:\Windows\System32\frapsvid.dll
[2010.06.12 08:28:21 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.06.12 08:28:19 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.06.12 08:28:19 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.06.12 08:28:14 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.06.12 08:28:14 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.06.12 08:28:13 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010.06.12 08:28:13 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010.06.12 08:28:06 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.06.04 22:55:37 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\Bioshock
[2010.06.04 22:55:37 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Bioshock
[2010.06.04 19:02:19 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\Futuremark
[2010.06.04 19:01:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2010.06.04 19:01:02 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll
[2010.06.04 19:01:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2010.06.04 19:01:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll
[2010.06.04 19:01:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2010.06.04 19:01:02 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll
[2010.06.04 19:01:02 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll
[2010.06.04 19:01:01 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2010.06.04 19:01:01 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll
[2010.06.04 19:01:01 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2010.06.04 19:01:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll
[2010.06.04 19:01:01 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2010.06.04 19:01:01 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2010.06.04 19:01:01 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2010.06.04 19:01:00 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2010.06.04 19:01:00 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2010.06.04 19:01:00 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2010.06.04 19:01:00 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll
[2010.06.04 19:01:00 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2010.06.04 19:01:00 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2010.06.04 19:01:00 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2010.06.04 19:01:00 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2010.06.04 19:01:00 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2010.06.04 19:01:00 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll
[2010.06.04 19:00:59 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2010.06.04 19:00:59 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2010.06.01 21:20:35 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\RPGVX
[2010.06.01 21:03:38 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Enterbrain
[2010.06.01 21:03:24 | 000,000,000 | ---D | C] -- C:\Programme\Enterbrain
[2010.05.27 18:25:50 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\TechSmith
[2010.05.26 21:36:41 | 000,000,000 | ---D | C] -- C:\Users\Paul\Documents\Camtasia Studio
[2010.05.26 21:36:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\QuickTime
[2010.05.26 21:36:01 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\TechSmith Shared
[2010.05.26 21:35:56 | 000,000,000 | ---D | C] -- C:\Programme\TechSmith
[2010.05.26 21:35:56 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith
[2010.05.26 19:48:30 | 000,000,000 | ---D | C] -- C:\Programme\No23 Recorder
[2010.05.26 13:57:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.23 19:24:11 | 009,961,472 | -HS- | M] () -- C:\Users\Paul\ntuser.dat
[2010.06.23 19:21:52 | 001,427,406 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.06.23 19:21:52 | 000,621,714 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.06.23 19:21:52 | 000,589,884 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.06.23 19:21:52 | 000,123,646 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.06.23 19:21:52 | 000,101,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
[2010.06.23 19:15:21 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.06.23 19:15:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.23 19:15:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.23 19:15:08 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.23 19:15:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.23 19:14:50 | 3220,389,888 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.23 14:38:33 | 000,524,288 | -HS- | M] () -- C:\Users\Paul\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.06.23 14:38:33 | 000,065,536 | -HS- | M] () -- C:\Users\Paul\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.06.23 14:37:56 | 003,987,483 | -H-- | M] () -- C:\Users\Paul\AppData\Local\IconCache.db
[2010.06.23 12:50:21 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job
[2010.06.22 23:06:55 | 000,359,927 | ---- | M] () -- C:\Users\Paul\Desktop\ZeitungHeadHunter.jpg
[2010.06.19 21:06:24 | 870,197,427 | ---- | M] () -- C:\Users\Paul\Desktop\Sex and the City 2.mp4
[2010.06.19 18:57:37 | 448,484,770 | ---- | M] () -- C:\Users\Paul\Desktop\AE4616DF3983569A.mp4
[2010.06.19 13:05:03 | 000,344,759 | ---- | M] () -- C:\Users\Paul\Desktop\Immobilienträume.jpg
[2010.06.18 17:25:40 | 000,205,226 | ---- | M] () -- C:\Users\Paul\Desktop\Immobilienträume2.jpg
[2010.06.16 22:42:55 | 003,903,167 | ---- | M] () -- C:\Users\Paul\Desktop\Senseless Killing - Intro.mp4
[2010.06.16 21:29:46 | 000,588,513 | ---- | M] () -- C:\Users\Paul\Desktop\Senseless Killing.jpg
[2010.06.16 19:40:49 | 000,000,959 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 5.lnk
[2010.06.16 15:39:49 | 000,039,424 | ---- | M] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.15 21:42:14 | 010,072,734 | ---- | M] () -- C:\Users\Paul\Desktop\gtaiv-20100615-2142043.avi
[2010.06.15 20:16:16 | 002,171,535 | ---- | M] () -- C:\Users\Paul\Desktop\Killing Geonosian - Star Wars Republic Commando.mp4
[2010.06.15 18:57:38 | 002,081,066 | ---- | M] () -- C:\Users\Paul\Desktop\Killing Normal Infected - Left 4 Dead 2.mp4
[2010.06.15 17:34:09 | 000,183,296 | ---- | M] () -- C:\Users\Paul\Desktop\Stopikus.exe
[2010.06.15 04:16:24 | 000,086,016 | ---- | M] (Beepa P/L) -- C:\Windows\System32\frapsvid.dll
[2010.06.14 19:18:09 | 001,348,278 | ---- | M] () -- C:\Users\Paul\Desktop\Runes of Magic - Killing Golo.mp4
[2010.06.14 19:16:16 | 000,002,515 | ---- | M] () -- C:\Users\Paul\Desktop\TubeBox! starten.lnk
[2010.06.14 16:17:35 | 000,000,780 | ---- | M] () -- C:\Users\Paul\Desktop\wegame.lnk
[2010.06.13 18:30:49 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat
[2010.06.13 12:43:49 | 000,264,328 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.06.03 10:54:31 | 000,001,890 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2010.06.01 21:41:11 | 000,000,905 | ---- | M] () -- C:\Users\Paul\Desktop\RPGVX.lnk
[2010.06.01 21:07:12 | 000,000,088 | RHS- | M] () -- C:\ProgramData\9B84762691.sys
[2010.05.26 21:36:17 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
[2010.05.26 19:48:31 | 000,000,934 | ---- | M] () -- C:\Users\Public\Desktop\No23 Recorder.lnk
[2010.05.26 19:06:41 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.05.26 16:47:41 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
 
========== Files Created - No Company Name ==========
 
[2010.06.22 23:06:32 | 000,359,927 | ---- | C] () -- C:\Users\Paul\Desktop\ZeitungHeadHunter.jpg
[2010.06.19 19:02:43 | 870,197,427 | ---- | C] () -- C:\Users\Paul\Desktop\Sex and the City 2.mp4
[2010.06.19 18:07:14 | 448,484,770 | ---- | C] () -- C:\Users\Paul\Desktop\AE4616DF3983569A.mp4
[2010.06.19 13:04:44 | 000,344,759 | ---- | C] () -- C:\Users\Paul\Desktop\Immobilienträume.jpg
[2010.06.18 17:25:24 | 000,205,226 | ---- | C] () -- C:\Users\Paul\Desktop\Immobilienträume2.jpg
[2010.06.16 22:42:34 | 003,903,167 | ---- | C] () -- C:\Users\Paul\Desktop\Senseless Killing - Intro.mp4
[2010.06.16 21:29:18 | 000,588,513 | ---- | C] () -- C:\Users\Paul\Desktop\Senseless Killing.jpg
[2010.06.16 19:40:49 | 000,000,959 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 5.lnk
[2010.06.15 21:42:04 | 010,072,734 | ---- | C] () -- C:\Users\Paul\Desktop\gtaiv-20100615-2142043.avi
[2010.06.15 20:16:03 | 002,171,535 | ---- | C] () -- C:\Users\Paul\Desktop\Killing Geonosian - Star Wars Republic Commando.mp4
[2010.06.15 18:57:28 | 002,081,066 | ---- | C] () -- C:\Users\Paul\Desktop\Killing Normal Infected - Left 4 Dead 2.mp4
[2010.06.15 17:38:20 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.06.15 17:38:19 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.06.15 17:34:09 | 000,183,296 | ---- | C] () -- C:\Users\Paul\Desktop\Stopikus.exe
[2010.06.14 19:17:56 | 001,348,278 | ---- | C] () -- C:\Users\Paul\Desktop\Runes of Magic - Killing Golo.mp4
[2010.06.14 16:17:35 | 000,000,780 | ---- | C] () -- C:\Users\Paul\Desktop\wegame.lnk
[2010.06.13 18:30:49 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.06.13 18:02:48 | 3220,389,888 | -HS- | C] () -- C:\hiberfil.sys
[2010.06.01 21:41:11 | 000,000,905 | ---- | C] () -- C:\Users\Paul\Desktop\RPGVX.lnk
[2010.06.01 21:07:08 | 000,001,890 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010.06.01 21:07:08 | 000,000,088 | RHS- | C] () -- C:\ProgramData\9B84762691.sys
[2010.05.26 21:36:17 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
[2010.05.26 19:48:31 | 000,000,934 | ---- | C] () -- C:\Users\Public\Desktop\No23 Recorder.lnk
[2010.05.16 15:27:38 | 000,033,792 | ---- | C] () -- C:\Windows\System32\drivers\libusb0.sys
[2010.04.02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.02.28 19:46:44 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2009.12.28 00:31:08 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.10.20 22:42:59 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.21 18:17:58 | 000,000,162 | ---- | C] () -- C:\Windows\System32\swctl.dll
[2009.09.21 18:17:58 | 000,000,144 | -H-- | C] () -- C:\Windows\System32\CTLSW.INI
[2009.08.30 19:27:39 | 000,034,308 | ---- | C] () -- C:\Windows\System32\Chip.dll
[2009.06.14 14:36:54 | 000,339,968 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2009.06.14 14:36:54 | 000,114,688 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2009.04.23 19:11:45 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2009.04.23 19:11:45 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2009.04.23 19:11:45 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2009.04.23 14:22:51 | 000,000,228 | ---- | C] () -- C:\Windows\SIERRA.INI
[2009.04.23 13:49:14 | 000,532,480 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Sony.dll
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.08.01 06:47:26 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.09.04 12:56:10 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2010.06.14 18:26:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Bioshock
[2010.03.18 21:32:06 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mumble
[2009.11.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Petroglyph
[2009.07.12 11:04:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony
[2009.07.12 11:02:33 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Setup
[2009.06.10 19:51:43 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TeamViewer
[2009.04.26 18:43:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Teeworlds
[2010.05.23 17:28:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TS3Client
[2009.09.16 22:11:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TubeBox
[2009.06.24 23:59:59 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Uniblue
[2009.09.28 18:27:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vso
[2010.03.01 22:38:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\xVideoServiceThief
[2010.06.23 14:38:22 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.06.23 12:50:21 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job
[2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
[2010.06.23 19:15:21 | 000,000,282 | -H-- | M] () -- C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.05.16 18:25:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Adobe
[2010.04.01 20:04:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Avira
[2010.06.14 18:26:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Bioshock
[2010.05.18 15:28:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\DivX
[2009.04.23 15:18:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Google
[2009.04.22 21:31:18 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Macromedia
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Media Center Programs
[2010.04.15 20:26:36 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Media Player Classic
[2010.03.15 18:37:25 | 000,000,000 | --SD | M] -- C:\Users\Paul\AppData\Roaming\Microsoft
[2009.04.23 13:40:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mozilla
[2010.03.18 21:32:06 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Mumble
[2009.09.26 18:33:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nero
[2009.11.05 14:39:38 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Petroglyph
[2009.07.06 21:22:17 | 000,000,000 | RH-D | M] -- C:\Users\Paul\AppData\Roaming\SecuROM
[2010.06.23 19:20:31 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Skype
[2010.06.23 19:16:57 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\skypePM
[2009.07.12 11:04:49 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony
[2009.12.28 00:08:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Corporation
[2009.07.12 11:02:33 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony Setup
[2010.03.29 20:46:07 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\teamspeak2
[2009.06.10 19:51:43 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TeamViewer
[2009.04.26 18:43:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Teeworlds
[2010.05.23 17:28:10 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TS3Client
[2009.09.16 22:11:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TubeBox
[2009.06.24 23:59:59 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Uniblue
[2009.09.28 18:27:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vso
[2009.04.26 18:10:13 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\WinRAR
[2010.03.01 22:38:47 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\xVideoServiceThief
 
< %APPDATA%\*.exe /s >
[2009.09.28 18:27:41 | 000,087,608 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\inst.exe
[2009.09.16 22:11:23 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{0D4F1C87-FECE-4DAC-AF46-4BC51DD4BAE0}\_6FEFF9B68218417F98F549.exe
[2009.10.05 16:27:13 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
[2009.08.19 14:07:52 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{15262616-05AF-48F3-B03B-FEA7EB76BE38}\_6FEFF9B68218417F98F549.exe
[2010.06.14 19:16:08 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_31A93269CEE5A678B80674.exe
[2010.06.14 19:16:08 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_6FEFF9B68218417F98F549.exe
[2010.06.14 19:16:08 | 000,025,214 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_CF21A7E464043C42ED6C28.exe
[2010.06.14 19:16:08 | 000,355,574 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_D0CACB2DEDB677B81D19FE.exe
[2010.06.14 19:16:08 | 000,355,574 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_FD16FB707C97B681CE3586.exe
[2009.11.10 15:55:40 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{2E2F9C65-38BC-4400-A27C-D65A507587D0}\_6FEFF9B68218417F98F549.exe
[2009.08.24 22:10:56 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{3680AE1C-8DC4-42CE-9286-32FE5337C3F3}\_6FEFF9B68218417F98F549.exe
[2010.06.04 20:08:03 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe
[2009.10.12 21:53:21 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{489BBD5A-7B60-4166-A3A7-6494A78E8509}\_6FEFF9B68218417F98F549.exe
[2009.10.28 23:20:20 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{9DAC9A37-1280-4A87-BFA4-9AFF27C84955}\_6FEFF9B68218417F98F549.exe
[2009.11.05 22:34:12 | 000,010,134 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\ARPPRODUCTICON.exe
[2009.11.05 22:34:12 | 000,004,286 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\Fahrenheit.exe_B11493A1D18C4B5FAD8D53D777C9C16A.exe
[2009.11.05 22:34:12 | 000,008,854 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{BA10AC78-E687-4523-8B93-540428FC256F}\Uninstall_Fahrenheit_8C2B6FBDC8D14FA595F7B3231B7D8CBC.exe
[2009.11.28 00:30:30 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{D761C5D2-E727-415A-BC4E-52642CEA1A1C}\_6FEFF9B68218417F98F549.exe
[2009.05.10 19:01:28 | 000,009,662 | R--- | M] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Installer\{EA61BCD3-FA73-4F6B-A525-8BD816E7C840}\_6FEFF9B68218417F98F549.exe
[2009.07.12 11:02:39 | 021,935,408 | ---- | M] (Apple Inc.) -- C:\Users\Paul\AppData\Roaming\Sony Setup\A189E68E-2253-4c3b-86B7-D77E36F13C55\QuickTimeInstaller.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.03.12 08:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.12.08 09:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\drivers\nvstor32.sys
[2007.12.08 09:28:08 | 000,140,320 | ---- | M] (NVIDIA Corporation) MD5=1A649B87A7B7C1220A2B16B121F2198E -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_933da2ea\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
< End of report >
         
--- --- ---


Report 2(Extras):
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 23.06.2010 19:20:22 - Run 1
OTL by OldTimer - Version 3.2.6.1     Folder = C:\Users\Paul\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 911,96 Gb Total Space | 557,28 Gb Free Space | 61,11% Space Free | Partition Type: NTFS
Drive D: | 19,54 Gb Total Space | 14,18 Gb Free Space | 72,54% Space Free | Partition Type: FAT32
Drive E: | 931,51 Gb Total Space | 931,39 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 2,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PAUL-PC
Current User Name: Paul
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04E8D9AC-FACF-410B-9E0E-F103C55D0F7D}" = lport=137 | protocol=17 | dir=in | app=system | 
"{07A77BFB-ABA6-40AD-B19E-FEA034BC20FC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{214AE818-1EFD-4DD5-A04B-282EA4B6AD58}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3549BD0B-FB85-49D1-B164-3D3FA0D1F710}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4B544538-CBA2-4089-94DC-B25A47BF4C01}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{4D67DF8F-E83D-4A4B-BC8B-00406114A977}" = lport=139 | protocol=6 | dir=in | app=system | 
"{64BB0AFB-95FB-442C-8BA0-0FC2229EE88E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{7926E926-EFF9-4F82-B376-678CA4A3C632}" = rport=138 | protocol=17 | dir=out | app=system | 
"{87073FEC-8F27-4DD0-A72B-C557191426AF}" = lport=138 | protocol=17 | dir=in | app=system | 
"{8841FA86-0EBA-4FB7-BDA2-F3349429FD35}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AA5EED59-EB24-4F55-914F-87BCD0B11AB7}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B4F85158-9AA2-42FF-9BC3-E326394D0DC3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{C014C6AB-4E10-4E17-888F-35F7BE873802}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{C1A1CB4F-76F9-438D-A883-12BFA5102AEF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{C69D54C4-7D4A-4132-8438-95B5439C2094}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CAF90A7C-A4FB-4D0F-904D-CC9282CDF96A}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{CD8B8062-3535-41FD-BDA6-610FC1CFD5A1}" = rport=137 | protocol=17 | dir=out | app=system | 
"{D56F5971-4B5E-4A79-92FC-707D82215817}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{E645BDCE-CCEF-4E0D-8571-AD822DC39551}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{F485E387-7D75-4D5C-896F-4B4426F6DBB0}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F6C118F4-0246-48AC-99AE-94455A131758}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008240A0-C6E8-45E4-9542-6A71C4C43F7B}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-dede-downloader.exe | 
"{00FDB1DD-1DB6-49BD-952C-62EC93E8C36A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bioshock demo\builds\release\bioshock.exe | 
"{016DE37F-3954-4B86-BEFA-F1B9B05CC5F9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{02E31C6A-A6D6-4ADB-B0D4-B304C77C2ACD}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe | 
"{0313E36E-B10F-4814-A855-0C5807A2C6D4}" = protocol=6 | dir=in | app=c:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{0FC54272-D23D-4E80-8C40-1CBD58929DEE}" = protocol=6 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe | 
"{1C39F286-AE7F-4383-8196-902775C813BC}" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe | 
"{21203E0C-2929-4664-9D47-EFE5123AE2C4}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{2D0BA810-8587-44B3-8ABF-71AD769EFB4C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{388877D7-8A64-4524-9057-88BF7680EA43}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3F9BF258-CEDB-4D3A-84C8-4C0AE5FBF3D5}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-dede-downloader.exe | 
"{406D2904-3CF0-45E7-94F2-F441FD32532F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{430BF7F7-F145-48F0-BE66-326B5D1FDC6F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{5C2FB9D0-57D2-441A-A09C-8911DEE55846}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{5D5424DB-9884-42D4-9E15-C51943AE30EB}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe | 
"{629EC649-CCC4-4A46-9E0D-0ED6F3571DCB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{6797286D-19BE-4D2A-A81B-CE100ACBA341}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{6D42A1A7-E810-49F0-A0E6-C68DF4B7706B}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{766727A6-4477-4F4B-83B2-43C1452D9DC6}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe | 
"{77BF7183-EAED-45FF-833A-919A40A20F1D}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{7903F55E-76F9-41F4-BFBB-D5B5FB2FBADA}" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe | 
"{79078C29-470F-4A48-8AF2-88C01C1E00A4}" = protocol=17 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe | 
"{864E5F35-437A-4FDA-AC24-BBC776C9675D}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{8912FCA4-A408-41A6-AC58-6E0DE0935BC5}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-dede-downloader.exe | 
"{8C32D54D-D832-43FE-A01A-EAA6C58CFBDF}" = protocol=17 | dir=in | app=c:\program files\runes of magic\runes of magic.exe | 
"{90C12740-67CF-4582-AB97-1BBF87152956}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe | 
"{9E6AB3B1-E9DD-462D-8EE8-D084584513FF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bioshock demo\builds\release\bioshock.exe | 
"{A929134D-6743-4A55-B23E-61275BA60098}" = protocol=17 | dir=in | app=c:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{AAFF830D-CEB5-429D-BEF5-3C6A43952E95}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe | 
"{AEB701CD-434B-4452-B07E-20805E82F11A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B37D0CDA-B604-4CCA-B3E7-0457C50B22E9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{BE6D62E6-6A49-4F2F-8611-2B838C25F54B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{BF3BF091-37D2-4C17-9A10-694584BF5484}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{C239AF71-B89B-4395-B6F3-5DBF56F93A81}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C287B6FE-CA03-430E-94E1-3B4B061CF308}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{CA149566-AC28-4324-BE55-F11BEB39E5CE}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{CBFCE86B-3BEF-4A71-99E8-E970FA50389F}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{CFD4112B-8BAA-473A-A9F2-C761FCF41511}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront\gamedata\battlefront.exe | 
"{D29D646E-967E-4E2E-9702-392D5EAC5637}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe | 
"{D8BDDB75-3299-4BB9-AEE9-AB6F459B983D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{E1E843D3-5071-45F1-947B-611D0F52727E}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe | 
"{E5AB5E04-1C1D-400C-888A-74D91A1DFA62}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe | 
"{E6FBBBB6-F889-4054-ACE2-2F822F7B6738}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\shattered_horizon\client_exe\shattered_horizon.exe | 
"{E94BF8D2-8D97-44BD-B546-1AC89982B3E0}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{F1EA5398-9C4F-4D6C-8046-EC65431C39AD}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront\gamedata\battlefront.exe | 
"{F54C9CA6-B475-4573-A4FB-75E7D2062FB3}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe | 
"{F895A930-74CF-44E4-8952-3A2F71AC5BC6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{FEFA9032-1BA1-4D1F-A46A-AE157133CF8C}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-dede-downloader.exe | 
"{FFBFEF32-F06F-4C9B-BE6C-67C811333730}" = protocol=6 | dir=in | app=c:\program files\runes of magic\runes of magic.exe | 
"TCP Query User{14E482AB-76C8-4AC4-90E7-B8D75F477331}C:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe | 
"TCP Query User{39733E74-7BCE-4FE9-82C5-B75E41BE3150}C:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe | 
"TCP Query User{4DC5625A-C3E5-43DC-B3BA-3963A6694A88}C:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe | 
"TCP Query User{67B79F7B-3B75-4780-B68A-CC05B5F95D1D}C:\program files\chilirec\chilirec.exe" = protocol=6 | dir=in | app=c:\program files\chilirec\chilirec.exe | 
"TCP Query User{8CC08B55-3D15-4CF6-BB1D-2CAF52157809}C:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe" = protocol=6 | dir=in | app=c:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe | 
"TCP Query User{A9111D62-F283-4BC8-85C1-91FF4D3A3581}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe | 
"TCP Query User{C75083AB-2298-4EB2-BA4B-7F0E6EF17802}C:\program files\runes of magic\launcher.exe" = protocol=6 | dir=in | app=c:\program files\runes of magic\launcher.exe | 
"TCP Query User{D585A7D6-E570-4C29-AA1C-6C227AB5065B}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"TCP Query User{D85F7210-191F-4B46-B2F4-5618953C01D7}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
"TCP Query User{DC2AFDA4-B9DA-4077-A896-18C7ABD9C638}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe | 
"TCP Query User{DF8A9479-C190-4F7A-96EF-6AC6E117D30A}C:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe | 
"TCP Query User{F5E32804-3C5A-4F73-9102-0310B475450D}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe | 
"UDP Query User{0381275B-D6C2-425E-92C6-B479430DAB9F}C:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe" = protocol=17 | dir=in | app=c:\users\paul\downloads\teeworlds-0.5.1-win32\teeworlds-0.5.1-win32\teeworlds_srv_race.exe | 
"UDP Query User{16C18791-C81D-4599-AB57-A1F817296A5F}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"UDP Query User{22C8B15E-AFAD-4A37-A1B0-EF60F0E3485E}C:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\day of defeat source\hl2.exe | 
"UDP Query User{53C5CFA4-68FA-4935-87CA-EA89C0BF2ED0}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe | 
"UDP Query User{66352977-C358-454D-8888-C72B3AE4887B}C:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\counter-strike source\hl2.exe | 
"UDP Query User{82B53376-A58E-477B-9022-F47F9BB04523}C:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2 demo\left4dead2.exe | 
"UDP Query User{88FB27B7-B408-499C-BD33-F07879833ABA}C:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\half-life 2 deathmatch\hl2.exe | 
"UDP Query User{8EDFAB33-A826-46DD-A86C-6274684700D5}C:\program files\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe | 
"UDP Query User{B00F1C08-2124-45EB-BD5C-CE677E9E17FA}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
"UDP Query User{D6C8FC52-F2C8-4909-9DB6-0588EC229F53}C:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\ant1chr1st501\team fortress 2\hl2.exe | 
"UDP Query User{D6DB7EB8-7BC2-43D7-9585-BC188FC101CA}C:\program files\chilirec\chilirec.exe" = protocol=17 | dir=in | app=c:\program files\chilirec\chilirec.exe | 
"UDP Query User{D9F038F2-732E-4599-B5E7-39751B39A327}C:\program files\runes of magic\launcher.exe" = protocol=17 | dir=in | app=c:\program files\runes of magic\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20AB57C7-FED7-4394-8166-A409DEA20253}" = TubeBox!
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 20
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}" = Star Wars Knights of the Old Republic
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D87DC92-C328-46EC-A7B4-9C88129DC696}" = Dead Space™
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6592FDEC-2C1A-413A-9985-25FEC2F0848D}" = Star Wars Empire at War Forces of Corruption
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{8681B1E6-CD96-46EF-9065-CE0D1085ED99}" = Star Wars JK II Jedi Outcast
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_STANDARD_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_STANDARD_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_STANDARD_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A200E68-D5F4-4E70-910F-2871753A0E2B}" = Worms World Party
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{AEE307D5-9E65-4971-818E-C4D96DF55C64}" = Media Go
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{BA10AC78-E687-4523-8B93-540428FC256F}" = Fahrenheit
"{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU]
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{C1C91319-52B5-2624-8333-F741EDCE89D5}" = Catalyst Control Center InstallProxy
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C79CB9C7-10A4-4814-8402-F574672C2192}" = Star Wars Battlefront
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3120436-1358-4253-9EB2-257FFE8CE1D9}" = Logitech SetPoint 5.20
"{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}" = Star Wars Republic Commando
"{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12345_is1" = WeGame Client Public Beta 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Free Studio_is1" = Free Studio version 4.2
"Grand Theft Auto" = Grand Theft Auto
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"Labtec Media Keyboard V5.1" = Labtec Media Keyboard V5.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mumble" = Mumble and Murmur
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Picasa 3" = Picasa 3
"psp ebook creator_is1" = psp ebook creator v1.0.3
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPG Maker VX_is1" = RPG Maker VX
"STANDARD" = Microsoft Office Standard 2007
"Steam App 219" = Half-Life 2: Demo
"Steam App 240" = Counter-Strike: Source
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 564" = Left 4 Dead 2 Add-on Support
"Steam App 7710" = Bioshock Demo
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 5" = TeamViewer 5
"Uninstall_is1" = Uninstall 1.0.0.1
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"c467f97a5a092d3f" = ROM-Runecalc
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 18.06.2010 06:43:29 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.06.2010 06:45:08 | Computer Name = Paul-PC | Source = VSS | ID = 8194
Description = 
 
Error - 18.06.2010 15:12:16 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.06.2010 12:24:31 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.06.2010 06:01:14 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.06.2010 14:53:33 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.06.2010 06:47:32 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.06.2010 07:12:16 | Computer Name = Paul-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 23.06.2010 08:27:21 | Computer Name = Paul-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hl2.exe, Version 0.0.0.0, Zeitstempel 0x4445c334,
 fehlerhaftes Modul filesystem_steam.dll_unloaded, Version 0.0.0.0, Zeitstempel 
0x47e2d72b, Ausnahmecode 0xc0000005, Fehleroffset 0x0051553e,  Prozess-ID 0x1104, 
Anwendungsstartzeit 01cb12cdccf58838.
 
Error - 23.06.2010 13:16:36 | Computer Name = Paul-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 13.06.2010 06:44:31 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.06.2010 06:44:31 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.06.2010 06:45:04 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.06.2010 06:45:06 | Computer Name = Paul-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 13.06.2010 06:45:09 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.06.2010 12:04:15 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 13.06.2010 12:04:15 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 15.06.2010 16:02:05 | Computer Name = Paul-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 17.06.2010 14:53:48 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7009
Description = 
 
Error - 17.06.2010 14:53:48 | Computer Name = Paul-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         
--- --- ---
__________________

Alt 23.06.2010, 18:54   #4
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Fixen mit OTL

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\Paul\AppData\Local\Temp\Pdj.exe ()
O2 - BHO: (XML Class) - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\Windows\System32\msxml71.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKLM\..\Toolbar: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll File not found
O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
File not found
O4 - HKU\S-1-5-21-499656830-2271843655-2083135542-1000..\Run: [Wallpaper4U] C:\Program Files\Wallpaper4U\Wallpaper4U.exe File not found
[2010.06.23 19:21:01 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.06.23 19:15:22 | 000,000,238 | -H-- | M] () -- C:\Windows\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
:Files
C:\Users\Paul\AppData\Local\Temp\Pdj.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument dieses posten

Alt 23.06.2010, 19:09   #5
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Gut...das ist dabei rausgekommen:

All processes killed
========== OTL ==========
No active process named Pdj.exe was found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9508125-4747-4733-b048-e4b82dc9716d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c9508125-4747-4733-b048-e4b82dc9716d} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\ not found.
Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DS3 Tool deleted successfully.
Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Uniblue RegistryBooster 2009 deleted successfully.
File c:\program files\uniblue\registrybooster\StartRegistryBooster.exe not found.
Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Uniblue RegistryBooster 2009 not found.
File c:\program files\uniblue\registrybooster\StartRegistryBooster.exe not found.
Registry value HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Wallpaper4U deleted successfully.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job moved successfully.
C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job moved successfully.
========== FILES ==========
C:\Users\Paul\AppData\Local\Temp\Pdj.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 83 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Paul
->Flash cache emptied: 45905 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Paul
->Temp folder emptied: 8063526841 bytes
->Temporary Internet Files folder emptied: 28042980 bytes
->Java cache emptied: 41870161 bytes
->FireFox cache emptied: 93151552 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 57478357 bytes
RecycleBin emptied: 1233056 bytes

Total Files Cleaned = 7.902,00 mb


OTL by OldTimer - Version 3.2.6.1 log created on 06232010_200353

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Alt 23.06.2010, 19:16   #6
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Alt 23.06.2010, 19:48   #7
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Das Programm klang ja schon ziemlich gefährlich, ich hoffe es ist nichts schief gegangen.
Hier is der Log:

Combofix Logfile:
Code:
ATTFilter
ComboFix 10-06-23.01 - Paul 23.06.2010  20:32:07.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.2025 [GMT 2:00]
ausgeführt von:: c:\users\Paul\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Paul\AppData\Roaming\inst.exe
c:\windows\system32\Chip.dll
E:\install.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-23 bis 2010-06-23  ))))))))))))))))))))))))))))))
.

2010-06-23 18:03 . 2010-06-23 18:03	--------	d-----w-	C:\_OTL
2010-06-15 02:16 . 2010-06-15 02:16	86016	----a-w-	c:\windows\system32\frapsvid.dll
2010-06-14 17:16 . 2010-06-14 17:16	9662	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_6FEFF9B68218417F98F549.exe
2010-06-14 17:16 . 2010-06-14 17:16	355574	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_FD16FB707C97B681CE3586.exe
2010-06-14 17:16 . 2010-06-14 17:16	355574	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_D0CACB2DEDB677B81D19FE.exe
2010-06-14 17:16 . 2010-06-14 17:16	25214	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_CF21A7E464043C42ED6C28.exe
2010-06-14 17:16 . 2010-06-14 17:16	10134	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{20AB57C7-FED7-4394-8166-A409DEA20253}\_31A93269CEE5A678B80674.exe
2010-06-13 16:30 . 2010-06-13 16:30	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2010-06-06 13:52 . 2010-06-06 13:52	56997	----a-w-	c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	56765	----a-w-	c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	53600	----a-w-	c:\programdata\DivX\Update\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	57715	----a-w-	c:\programdata\DivX\Player\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	54153	----a-w-	c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	54128	----a-w-	c:\programdata\DivX\Converter\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	54644	----a-w-	c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-06-06 13:52 . 2010-06-06 13:52	54101	----a-w-	c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-06-04 20:55 . 2010-06-14 16:26	--------	d-----w-	c:\users\Paul\AppData\Roaming\Bioshock
2010-06-04 18:08 . 2010-06-04 18:08	9662	----a-r-	c:\users\Paul\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe
2010-06-04 17:02 . 2010-06-04 17:02	--------	d-----w-	c:\users\Paul\AppData\Local\Futuremark
2010-06-04 17:00 . 2008-07-10 09:01	467984	----a-w-	c:\windows\system32\d3dx10_39.dll
2010-06-04 17:00 . 2008-07-10 09:00	1493528	----a-w-	c:\windows\system32\D3DCompiler_39.dll
2010-06-01 19:07 . 2010-06-03 08:54	1890	--sha-w-	c:\programdata\KGyGaAvL.sys
2010-06-01 19:07 . 2010-06-01 19:07	88	--sh--r-	c:\programdata\9B84762691.sys
2010-06-01 19:03 . 2010-06-01 19:03	--------	d-----w-	c:\program files\Common Files\Enterbrain
2010-06-01 19:03 . 2010-06-01 19:03	--------	d-----w-	c:\program files\Enterbrain
2010-05-27 16:25 . 2010-05-27 16:25	--------	d-----w-	c:\users\Paul\AppData\Local\TechSmith
2010-05-26 19:36 . 2010-03-04 15:27	411480	----a-w-	c:\windows\system32\tsccvid.dll
2010-05-26 19:36 . 2010-05-26 19:36	--------	d-----w-	c:\windows\system32\QuickTime
2010-05-26 19:36 . 2010-05-26 19:36	--------	d-----w-	c:\program files\Common Files\TechSmith Shared
2010-05-26 19:35 . 2010-05-26 19:36	--------	d-----w-	c:\programdata\TechSmith
2010-05-26 19:35 . 2010-05-26 19:35	--------	d-----w-	c:\program files\TechSmith
2010-05-26 17:48 . 2010-06-14 20:20	--------	d-----w-	c:\program files\No23 Recorder
2010-05-26 11:57 . 2010-04-23 14:13	2048	----a-w-	c:\windows\system32\tzres.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-23 18:21 . 2009-04-23 11:52	--------	d-----w-	c:\users\Paul\AppData\Roaming\Skype
2010-06-23 18:14 . 2009-05-04 11:51	--------	d-----w-	c:\program files\Steam
2010-06-23 18:12 . 2008-01-21 07:15	621714	----a-w-	c:\windows\system32\perfh007.dat
2010-06-23 18:12 . 2008-01-21 07:15	123646	----a-w-	c:\windows\system32\perfc007.dat
2010-06-23 17:16 . 2009-04-23 11:54	--------	d-----w-	c:\users\Paul\AppData\Roaming\skypePM
2010-06-23 17:16 . 2009-10-28 15:16	--------	d-----w-	c:\program files\Runes of Magic
2010-06-18 10:23 . 2009-05-04 11:51	--------	d-----w-	c:\program files\Common Files\Steam
2010-06-16 17:40 . 2009-06-10 17:33	--------	d-----w-	c:\program files\TeamViewer
2010-06-14 14:17 . 2009-11-16 16:36	--------	d-----w-	c:\program files\WeGame
2010-06-13 10:37 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-06-12 18:12 . 2009-04-26 09:27	--------	d-----w-	c:\programdata\Microsoft Help
2010-06-06 13:52 . 2010-05-18 11:28	57344	----a-w-	c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-06-06 13:52 . 2010-05-18 11:27	--------	d-----w-	c:\programdata\DivX
2010-06-06 13:52 . 2009-07-08 19:54	--------	d-----w-	c:\program files\Common Files\DivX Shared
2010-06-06 13:52 . 2009-07-08 19:54	--------	d-----w-	c:\program files\DivX
2010-06-06 13:51 . 2010-05-18 11:43	1062184	----a-w-	c:\programdata\DivX\Setup\Resource.dll
2010-06-06 13:51 . 2010-05-18 11:28	895256	----a-w-	c:\programdata\DivX\Setup\DivXSetup.exe
2010-06-04 17:02 . 2009-07-06 19:06	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2010-06-04 17:02 . 2009-07-06 19:06	--------	d-----w-	c:\program files\AGEIA Technologies
2010-06-04 15:08 . 2008-10-27 13:47	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-05-29 17:14 . 2009-04-22 19:31	--------	d-----w-	c:\program files\Google
2010-05-26 17:06 . 2010-06-12 06:28	34304	----a-w-	c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-12 06:28	289792	----a-w-	c:\windows\system32\atmfd.dll
2010-05-23 15:28 . 2010-03-18 17:11	--------	d-----w-	c:\users\Paul\AppData\Roaming\TS3Client
2010-05-23 12:02 . 2010-03-18 17:11	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2010-05-21 12:14 . 2009-10-03 10:10	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-18 13:28 . 2009-07-09 16:25	--------	d-----w-	c:\users\Paul\AppData\Roaming\DivX
2010-05-18 11:43 . 2010-05-18 11:43	84040	----a-w-	c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	57054	----a-w-	c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	54166	----a-w-	c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	57532	----a-w-	c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	56458	----a-w-	c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	54174	----a-w-	c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	57409	----a-w-	c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	52963	----a-w-	c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	54073	----a-w-	c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-05-18 11:43 . 2010-05-18 11:43	56969	----a-w-	c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-05-16 14:18 . 2010-05-16 13:52	--------	d-----w-	c:\program files\MotioninJoy
2010-05-16 13:58 . 2010-05-16 13:58	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_MijUfilt_01009.Wdf
2010-05-16 13:58 . 2010-05-16 13:58	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-05-16 13:52 . 2010-05-16 13:52	67584	----a-w-	c:\programdata\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-05-16 13:52 . 2010-05-16 13:52	17408	----a-w-	c:\programdata\MotioninJoy\DS3tool\update\drivers\MijUfilt.sys
2010-05-16 13:52 . 2010-05-16 13:52	24576	----a-w-	c:\programdata\MotioninJoy\DS3tool\update\drivers\MijBThid.sys
2010-05-16 13:52 . 2010-05-16 13:52	--------	d-----w-	c:\programdata\MotioninJoy
2010-05-16 13:51 . 2010-05-16 13:45	--------	d-----w-	c:\program files\LibUSB-Win32-0.1.10.1
2010-05-12 16:39 . 2009-11-06 21:47	--------	d-----w-	c:\program files\Java
2010-05-04 19:15 . 2010-06-12 06:28	834048	----a-w-	c:\windows\system32\wininet.dll
2010-05-04 18:37 . 2010-06-12 06:28	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-05-01 14:13 . 2010-06-12 06:28	2037248	----a-w-	c:\windows\system32\win32k.sys
2010-04-28 20:37 . 2010-04-28 20:37	--------	d-----w-	c:\program files\psp ebook creator
2010-04-27 12:45 . 2010-04-27 12:45	72856	----a-w-	c:\windows\system32\xliveinstallhost.exe
2010-04-27 12:45 . 2010-04-27 12:45	187544	----a-w-	c:\windows\system32\xliveinstall.dll
2010-04-12 15:29 . 2010-05-12 16:39	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-04-05 17:01 . 2010-06-12 06:28	67072	----a-w-	c:\windows\system32\asycfilt.dll
2010-04-02 15:17 . 2010-04-02 15:17	15426200	----a-w-	c:\windows\system32\xlive.dll
2010-04-02 15:17 . 2010-04-02 15:17	13642904	----a-w-	c:\windows\system32\xlivefnt.dll
2010-03-31 01:58 . 2009-04-23 11:49	133616	------w-	c:\windows\system32\pxafs.dll
2010-03-31 01:58 . 2009-04-23 11:49	125424	------w-	c:\windows\system32\pxinsi64.exe
2010-03-31 01:58 . 2009-04-23 11:49	123888	------w-	c:\windows\system32\pxcpyi64.exe
2006-05-03 09:06 . 2009-12-27 22:29	163328	--sh--r-	c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-12-27 22:29	31232	--sh--r-	c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-12-27 22:29	216064	--sh--r-	c:\windows\System32\nbDX.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Steam"="c:\program files\steam\steam.exe" [2010-05-08 1238352]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"RGSC"="c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe" [2008-11-14 305064]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-09 6281760]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-10-14 20480]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetpointII.exe [2009-7-21 323584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
"VistaSp2"=hex(b):86,92,38,16,b7,53,ca,01

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 MotioninJoyUSBFilter;MotioninJoy USB Filter Driver;c:\windows\system32\DRIVERS\MijUfilt.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-09-21 3474384]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-01-11 36384]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-05-21 173352]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners

2010-06-23 c:\windows\Tasks\User_Feed_Synchronization-{76706C6B-6B89-43B8-9B85-8AA43B5B84D2}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\l7sed1fr.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

URLSearchHooks-{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - (no file)
URLSearchHooks-{c9508125-4747-4733-b048-e4b82dc9716d} - (no file)
WebBrowser-{69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - (no file)
AddRemove-World of Warcraft - c:\program files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-23 20:38
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-499656830-2271843655-2083135542-1000\Software\SecuROM\License information*]
"datasecu"=hex:90,c8,f2,48,a1,ca,f3,0c,80,49,78,86,c8,78,4b,aa,1c,ac,ed,66,55,
   14,86,a6,6c,2c,36,d5,12,57,6c,6a,2c,05,91,94,df,70,a0,82,9d,06,85,a0,99,ba,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
Zeit der Fertigstellung: 2010-06-23  20:40:15
ComboFix-quarantined-files.txt  2010-06-23 18:40

Vor Suchlauf: 14 Verzeichnis(se), 605.384.462.336 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 605.314.572.288 Bytes frei

- - End Of File - - 712EE09B3AB87763BE1064D3C40DACD4
         
--- --- ---

Alt 24.06.2010, 11:00   #8
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



VirusTotal - Free Online Virus and Malware Scan
prüfe dort:
c:\programdata\9B84762691.sys
falls bereits analysiert, klickke erneut prüfen, ergebniss posten

Alt 24.06.2010, 13:11   #9
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Datei 9B84762691.sys empfangen 2010.06.24 12:03:46 (UTC)
Status: Beendet
Ergebnis: 0/41 (0%)

weitere Informationen
File size: 88 bytes
MD5...: 7b7950f919b879f1c289598cfa0d85dd
SHA1..: eebadb87063d098ba960967c0768b47a910920c5
SHA256: 3d3cfe0b988364b3e9d5ad2b7b8f7dd18066c395abe0a671361823b286f28985
ssdeep: 3:hl/1suj4Q:hR
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: MS Flight Simulator Aircraft Performance Info (100.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Alt 24.06.2010, 13:38   #10
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



ok, jetzt rechtsklick auf den avira schirm, guard deaktivieren.
dann öfnest du "mein computer" (arbeitsplatz) und dort c:
da siehst du _OTL
da einen rechtsklick, zu _OTL.rar oder zip hinzufügen, das selbe mit qoobox.
http://www.trojaner-board.de/54791-a...ner-board.html
hier an uns hochladen, gib bescheid, wenn fertig.
downloade nun malwarebytes:
Malwarebytes
instalieren, dann öffnen, registerkarte scanner, komplett scan, funde löschen, log posten, dann avira wieder einschalten

Alt 24.06.2010, 15:03   #11
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Ok, also.

Die rar Dateien habe ich hochgeladen.

(Datei: _OTL.rar empfangen
Datei: Qoobox.rar empfangen

Vorgang erfolgreich abgeschlossen.)


Malwarebytes-Log:
alwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4232

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

24.06.2010 16:00:25
mbam-log-2010-06-24 (16-00-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 344871
Laufzeit: 1 Stunde(n), 2 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Team17\Worms World Party\Install Fix - WWP.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Team17\Worms World Party\wwp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Alt 24.06.2010, 15:22   #12
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



avira

avira so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
dann öffne avira, lokaler schutz, rechtsklick auf lokale laufwerke, suchlauf als admin starten. funde in quarantäne, log posten

Alt 24.06.2010, 16:59   #13
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Das Antivir einen Log hat wusste ich nicht, und musste erstmal suchen. Ich hoffe ich habe damit das richtige gefunden was du brauchst:



Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Donnerstag, 24. Juni 2010 16:38

Es wird nach 2266069 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : Paul
Computername : PAUL-PC

Versionsinformationen:
BUILD.DAT : 10.0.0.567 32097 Bytes 19.04.2010 15:50:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 19.04.2010 11:56:58
AVSCAN.DLL : 10.0.3.0 56168 Bytes 19.04.2010 11:56:58
LUKE.DLL : 10.0.2.3 104296 Bytes 07.03.2010 17:32:59
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 10:59:47
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 13:04:34
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 13:04:34
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 13:55:23
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 14:11:15
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 07:36:05
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 21:29:43
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 13:45:15
VBASE007.VDF : 7.10.7.219 2048 Bytes 02.06.2010 13:45:15
VBASE008.VDF : 7.10.7.220 2048 Bytes 02.06.2010 13:45:15
VBASE009.VDF : 7.10.7.221 2048 Bytes 02.06.2010 13:45:15
VBASE010.VDF : 7.10.7.222 2048 Bytes 02.06.2010 13:45:15
VBASE011.VDF : 7.10.7.223 2048 Bytes 02.06.2010 13:45:15
VBASE012.VDF : 7.10.7.224 2048 Bytes 02.06.2010 13:45:15
VBASE013.VDF : 7.10.8.37 270336 Bytes 10.06.2010 06:19:00
VBASE014.VDF : 7.10.8.69 138752 Bytes 14.06.2010 11:54:13
VBASE015.VDF : 7.10.8.102 130560 Bytes 16.06.2010 12:07:07
VBASE016.VDF : 7.10.8.135 152064 Bytes 21.06.2010 10:03:13
VBASE017.VDF : 7.10.8.163 432128 Bytes 23.06.2010 14:27:15
VBASE018.VDF : 7.10.8.164 2048 Bytes 23.06.2010 14:27:15
VBASE019.VDF : 7.10.8.165 2048 Bytes 23.06.2010 14:27:15
VBASE020.VDF : 7.10.8.166 2048 Bytes 23.06.2010 14:27:15
VBASE021.VDF : 7.10.8.167 2048 Bytes 23.06.2010 14:27:15
VBASE022.VDF : 7.10.8.168 2048 Bytes 23.06.2010 14:27:15
VBASE023.VDF : 7.10.8.169 2048 Bytes 23.06.2010 14:27:15
VBASE024.VDF : 7.10.8.170 2048 Bytes 23.06.2010 14:27:15
VBASE025.VDF : 7.10.8.171 2048 Bytes 23.06.2010 14:27:15
VBASE026.VDF : 7.10.8.172 2048 Bytes 23.06.2010 14:27:15
VBASE027.VDF : 7.10.8.173 2048 Bytes 23.06.2010 14:27:15
VBASE028.VDF : 7.10.8.174 2048 Bytes 23.06.2010 14:27:15
VBASE029.VDF : 7.10.8.175 2048 Bytes 23.06.2010 14:27:15
VBASE030.VDF : 7.10.8.176 2048 Bytes 23.06.2010 14:27:15
VBASE031.VDF : 7.10.8.184 60928 Bytes 24.06.2010 14:27:15
Engineversion : 8.2.4.2
AEVDF.DLL : 8.1.2.0 106868 Bytes 25.04.2010 12:20:35
AESCRIPT.DLL : 8.1.3.33 1356155 Bytes 24.06.2010 14:27:17
AESCN.DLL : 8.1.6.1 127347 Bytes 14.05.2010 11:00:11
AESBX.DLL : 8.1.3.1 254324 Bytes 25.04.2010 12:20:35
AERDL.DLL : 8.1.4.6 541043 Bytes 17.04.2010 21:29:46
AEPACK.DLL : 8.2.2.5 430453 Bytes 24.06.2010 14:27:16
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 14.05.2010 11:00:11
AEHEUR.DLL : 8.1.1.38 2724214 Bytes 24.06.2010 14:27:16
AEHELP.DLL : 8.1.11.6 242038 Bytes 24.06.2010 14:27:15
AEGEN.DLL : 8.1.3.12 377204 Bytes 24.06.2010 14:27:15
AEEMU.DLL : 8.1.2.0 393588 Bytes 25.04.2010 12:20:35
AECORE.DLL : 8.1.15.3 192886 Bytes 14.05.2010 11:00:11
AEBB.DLL : 8.1.1.0 53618 Bytes 25.04.2010 12:20:35
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 10:59:10
AVPREF.DLL : 10.0.0.0 44904 Bytes 14.01.2010 10:59:07
AVREP.DLL : 10.0.0.8 62209 Bytes 18.02.2010 15:47:40
AVREG.DLL : 10.0.3.0 53096 Bytes 19.04.2010 11:56:59
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 19.04.2010 11:56:59
AVARKT.DLL : 10.0.0.14 227176 Bytes 19.04.2010 11:56:58
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 26.01.2010 08:53:25
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:57:53
AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 14:38:54
NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 13:40:55
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 12:10:08
RCTEXT.DLL : 10.0.53.0 98152 Bytes 19.04.2010 11:56:58

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:, I:, J:, K:, F:, G:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: ein
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch

Beginn des Suchlaufs: Donnerstag, 24. Juni 2010 16:38

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmplayer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GameOverlayUI.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hl2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WMPNSCFG.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'OUTLOOK.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'skypePM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SteamService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'KHALMNPR.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SetpointII.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'steam.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IoctlSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NBService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD3
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD4
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'E:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'I:\'
[INFO] Im Laufwerk 'I:\' ist kein Datenträger eingelegt!
Bootsektor 'J:\'
[INFO] Im Laufwerk 'J:\' ist kein Datenträger eingelegt!
Bootsektor 'K:\'
[INFO] Im Laufwerk 'K:\' ist kein Datenträger eingelegt!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1797' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <BOOT>
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RDWLG3X.rar
[0] Archivtyp: RAR
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
--> _OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RM90UWG.exe
[WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht!
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RKNNNE3\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RN9FTMG\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RTMDN3J\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
C:\Program Files\7-Zip\Uninstall.exe
[WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht!
C:\Users\Paul\AppData\Local\Mozilla\Firefox\Profiles\l7sed1fr.default\Cache\02F716A9d01
[WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht!
C:\Users\Paul\AppData\Local\Mozilla\Firefox\Profiles\l7sed1fr.default\Cache\C3ED8F3Bd01
[WARNUNG] Zu wenig Speicher! Die Datei wurde nicht durchsucht!
C:\Users\Paul\Desktop\Verschiedenes\_OTL.rar
[0] Archivtyp: RAR
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
--> _OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
Beginne mit der Suche in 'D:\' <RECOVER>
C:\_OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
Beginne mit der Suche in 'E:\' <DATA>
Beginne mit der Suche in 'I:\'
Der zu durchsuchende Pfad I:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'J:\'
Der zu durchsuchende Pfad J:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'K:\'
Der zu durchsuchende Pfad K:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'G:\' <CSS>

Beginne mit der Desinfektion:
C:\_OTL\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ab1dbbc.qua' verschoben!
C:\Users\Paul\Desktop\Verschiedenes\_OTL.rar
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52dcf40e.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RTMDN3J\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0079aef3.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RN9FTMG\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '664ee131.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RKNNNE3\MovedFiles\06232010_200353\C_Users\Paul\AppData\Local\Temp\Pdj.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '23cacc0f.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-499656830-2271843655-2083135542-1000\$RDWLG3X.rar
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c3bfe7c.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 24. Juni 2010 17:50
Benötigte Zeit: 1:11:02 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

25150 Verzeichnisse wurden überprüft
462866 Dateien wurden geprüft
6 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
6 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
462860 Dateien ohne Befall
5127 Archive wurden durchsucht
4 Warnungen
6 Hinweise

Alt 24.06.2010, 17:07   #14
markusg
/// Malware-holic
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



leere mal den papierkorb.
berichte, wie der pc läuft.

Alt 24.06.2010, 17:27   #15
Katowl
 
Internet Explorer öffnet von selbst und ungefragt - Standard

Internet Explorer öffnet von selbst und ungefragt



Papierkorb geleert.
Soll ich die 6 in Quarantäne verschobene Dateien löschen?

Ansonsten hat mein Internet Explorer bisher keinen Laut mehr von sich gegeben. Ich glaube du hast meinen PC geheilt.

Du hast bisher sonst nicht viel zu dem gesagt was passiert ist. Weißt du was nun der Übeltäter war?

Antwort

Themen zu Internet Explorer öffnet von selbst und ungefragt
adobe, antivir, antivir guard, avg, avira, bho, defender, desktop, ebay, explorer, firefox, google, hijack, internet, internet explorer, local\temp, mein log, mozilla, nvidia, plug-in, problem, rundll, software, system, temp, vista, von selbst, windows, öffnet



Ähnliche Themen: Internet Explorer öffnet von selbst und ungefragt


  1. Internet explorer öffnet sich von selbst
    Log-Analyse und Auswertung - 14.07.2013 (1)
  2. Internet Explorer öffnet sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 18.02.2011 (1)
  3. Internet explorer öffnet sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 14.01.2011 (3)
  4. Internet Explorer öffnet sich selbst
    Plagegeister aller Art und deren Bekämpfung - 23.08.2010 (8)
  5. Internet Explorer öffnet sich von selbst :(
    Plagegeister aller Art und deren Bekämpfung - 06.07.2010 (7)
  6. Internet Explorer öffnet sich von selbst
    Log-Analyse und Auswertung - 16.06.2010 (15)
  7. Internet Explorer öffnet sich von selbst!
    Log-Analyse und Auswertung - 27.05.2010 (11)
  8. Internet explorer öffnet sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 01.05.2010 (3)
  9. Internet Explorer öffnet sich von selbst
    Log-Analyse und Auswertung - 26.04.2010 (5)
  10. Internet Explorer öffnet sich von selbst!
    Plagegeister aller Art und deren Bekämpfung - 26.03.2010 (3)
  11. Internet Explorer öffnet sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 21.01.2010 (2)
  12. Internet Explorer öffnet sich von selbst
    Log-Analyse und Auswertung - 13.01.2010 (1)
  13. Internet Explorer öffnet von selbst Werbung
    Log-Analyse und Auswertung - 01.09.2009 (13)
  14. Internet Explorer öffnet sich von selbst
    Log-Analyse und Auswertung - 01.07.2009 (2)
  15. Internet Explorer öffnet sich von selbst!!
    Log-Analyse und Auswertung - 29.12.2008 (1)
  16. Internet Explorer öffnet sich von selbst !
    Log-Analyse und Auswertung - 12.06.2006 (1)
  17. Internet-Explorer-öffnet-sich-selbst
    Log-Analyse und Auswertung - 06.02.2006 (2)

Zum Thema Internet Explorer öffnet von selbst und ungefragt - Guten Tag. Von Zeit zu Zeit öffnet sich mein Internet Explorer selbst. Manchmal mit einer Werbungsseite, manchmal scheint es die zu öffnende Seite nicht mehr zu geben. Antivir habe ich - Internet Explorer öffnet von selbst und ungefragt...
Archiv
Du betrachtest: Internet Explorer öffnet von selbst und ungefragt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.