Trojaner-Board - System-Check die Tausendste...

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - System-Check die Tausendste... (https://www.trojaner-board.de/112314-system-check-tausendste.html)

System-Check die Tausendste...

Hallo alle,

jetzt kommt hier der nächste Idiot an, der es nicht schafft, seinen Rechner sauber zu lassen. Und dabei bin ich immer einer der Leute, die sich über dieses "Problem" bei anderen aufregen, aber dieses Mal hat es mich kalt erwischt...

Habe mir in den anderen Threads schon die ungefähre Abfolge angeguckt, aber beim Auswerten und den einzelnen Schritten bräuchte ich bitte Hilfe.

Fangen wir an mit OTL, denn tdsskiller lässt er mich gar nicht erst starten :headbang:

OTL.txt

Code:

OTL logfile created on: 26.03.2012 00:37:21 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,06 Gb Available Physical Memory | 88,32% Memory free

12,50 Gb Paging File | 11,45 Gb Available in Paging File | 91,62% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 33,25 Gb Free Space | 59,60% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 125,60 Gb Free Space | 42,14% Space Free | Partition Type: NTFS

Drive H: | 1,92 Gb Total Space | 1,46 Gb Free Space | 76,40% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2012.02.14 23:16:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.12.16 03:31:53 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.12.09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidusbf.sys -- (hidusbf)

DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.01.18 16:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)

DRV:64bit: - [2012.01.18 16:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)

DRV:64bit: - [2012.01.03 23:22:54 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)

DRV:64bit: - [2011.12.14 02:03:37 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2010.05.15 20:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)

DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.12 00:49:10 | 000,178,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver4.1)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver2)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 D5 61 BC A7 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.28 19:15:10 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.28 19:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Extensions

[2012.02.28 19:15:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.02.16 16:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 12:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Google Update (Enabled) = C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

 

O1 HOSTS File: ([2012.01.06 04:55:29 | 000,440,068 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 15127 more lines...

O4 - HKLM..\Run: [LanLight] C:\Program Files (x86)\LanLights\LanLights.exe (Paul Mather)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7BE62C-886B-434A-AEE5-095EFA060844}: DhcpNameServer = 192.168.178.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\Shell - "" = AutoRun

O33 - MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\Shell\AutoRun\command - "" = G:\Autorun.exe

O33 - MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\Shell - "" = AutoRun

O33 - MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\Shell\AutoRun\command - "" = G:\steambackup.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: HDAudDeck - hkey= - key= - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

MsConfig:64bit - State: "services" - Reg Error: Key error.

MsConfig:64bit - State: "startup" - Reg Error: Key error.

MsConfig:64bit - State: "bootini" - Reg Error: Key error.

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.26 00:22:53 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:22:28 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\tdsskiller.exe

[2012.03.26 00:01:50 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Malwarebytes

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.26 00:01:39 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.03.26 00:01:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.03.26 00:00:00 | 015,540,296 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\scorp\Desktop\SUPERAntiSpyware.exe

[2012.03.25 23:40:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.03.25 23:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.25 23:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.03.25 23:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.03.25 22:59:40 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

[2012.03.22 00:57:01 | 000,008,064 | ---- | C] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 00:03:20 | 000,119,808 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\opnetext.dll

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\InstallShield

[2012.03.22 00:02:54 | 000,027,648 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\OKLMON64.DLL

[2012.03.14 21:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.03.14 21:16:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.03.14 21:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LanLights

[2012.02.28 22:07:05 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\The Way I See It [2oo8]

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Mozilla

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Local\Mozilla

[2012.02.28 19:15:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.26 00:32:46 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.26 00:32:46 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.26 00:29:49 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.26 00:29:49 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.26 00:29:49 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.26 00:29:49 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.26 00:29:49 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.26 00:25:40 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:22:29 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\tdsskiller.exe

[2012.03.26 00:01:40 | 000,001,091 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.26 00:00:08 | 015,540,296 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\scorp\Desktop\SUPERAntiSpyware.exe

[2012.03.25 23:28:18 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 23:06:05 | 000,000,440 | ---- | M] () -- C:\ProgramData\dBhW8pCn1tAWBP

[2012.03.25 22:59:40 | 000,000,264 | ---- | M] () -- C:\ProgramData\~dBhW8pCn1tAWBP

[2012.03.25 22:59:40 | 000,000,176 | ---- | M] () -- C:\ProgramData\~dBhW8pCn1tAWBPr

[2012.03.25 22:59:28 | 000,361,984 | ---- | M] ( ) -- C:\ProgramData\dBhW8pCn1tAWBP.exe

[2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 01:07:05 | 000,000,543 | ---- | M] () -- C:\Windows\NGO.cer

[2012.03.22 00:48:21 | 000,267,440 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.22 00:41:04 | 000,000,290 | ---- | M] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
 

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.03.26 00:01:40 | 000,001,091 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 22:59:40 | 000,000,264 | ---- | C] () -- C:\ProgramData\~dBhW8pCn1tAWBP

[2012.03.25 22:59:40 | 000,000,176 | ---- | C] () -- C:\ProgramData\~dBhW8pCn1tAWBPr

[2012.03.25 22:59:37 | 000,000,440 | ---- | C] () -- C:\ProgramData\dBhW8pCn1tAWBP

[2012.03.25 22:59:28 | 000,361,984 | ---- | C] ( ) -- C:\ProgramData\dBhW8pCn1tAWBP.exe

[2012.03.25 01:17:27 | 000,024,576 | ---- | C] () -- C:\Users\scorp\Desktop\memtest.exe

[2012.03.22 01:07:05 | 000,000,543 | ---- | C] () -- C:\Windows\NGO.cer

[2012.03.22 00:41:04 | 000,000,290 | ---- | C] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.22 00:03:20 | 000,003,252 | ---- | C] () -- C:\Windows\SysNative\opnedef.str

[2012.03.22 00:03:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysNative\opnetext.ver

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\opnetext.gid

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\opnetext.gid

[2012.03.12 20:20:02 | 734,130,177 | ---- | C] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:07:23 | 1488,550,308 | ---- | C] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

[2012.02.28 18:18:05 | 001,013,320 | ---- | C] () -- C:\Windows\SysNative\pwNative.exe

[2012.02.28 18:18:05 | 000,019,936 | ---- | C] () -- C:\Windows\SysNative\pwdrvio.sys

[2012.02.28 18:18:05 | 000,013,280 | ---- | C] () -- C:\Windows\SysNative\pwdspio.sys

[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2012.01.10 05:51:32 | 000,000,083 | ---- | C] () -- C:\Windows\SysWow64\config.ini

[2011.12.13 21:23:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.11.30 13:07:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.11.24 00:05:15 | 000,000,606 | ---- | C] () -- C:\ProgramData\ntuser.pol

[2011.11.22 19:55:38 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2011.11.21 13:37:48 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2011.11.21 13:37:48 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.11.21 13:36:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.11.20 22:22:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.20 22:18:10 | 000,007,606 | ---- | C] () -- C:\Users\scorp\AppData\Local\Resmon.ResmonCfg

[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== LOP Check ==========

 

[2012.02.02 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Auslogics

[2011.12.14 02:04:35 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\DAEMON Tools Lite

[2012.03.07 22:42:06 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\ICQ

[2011.11.23 00:01:44 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\SteelSeries Xai

[2011.11.30 18:34:07 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Ubisoft

[2009.07.14 07:08:49 | 000,009,954 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2011.12.10 05:36:01 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.01.31 23:04:34 | 000,000,000 | ---D | M] -- C:\AMD

[2011.12.15 08:00:35 | 000,000,000 | ---D | M] -- C:\ATI

[2011.11.21 22:24:38 | 000,000,000 | -HSD | M] -- C:\Boot

[2012.03.26 00:06:15 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2009.07.14 07:08:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings

[2011.11.20 21:33:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2011.12.22 00:42:59 | 000,000,000 | ---D | M] -- C:\Fraps

[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2011.12.11 06:00:52 | 000,000,000 | ---D | M] -- C:\ProcAlyzer Dumps

[2012.03.25 23:32:01 | 000,000,000 | ---D | M] -- C:\Program Files

[2012.03.26 00:06:15 | 000,000,000 | ---D | M] -- C:\Program Files (x86)

[2012.03.26 00:23:55 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2011.11.20 21:33:01 | 000,000,000 | ---D | M] -- C:\Programme

[2011.11.20 21:33:01 | 000,000,000 | ---D | M] -- C:\Recovery

[2012.03.25 23:40:54 | 000,000,000 | ---D | M] -- C:\sh4ldr

[2012.03.26 00:37:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.11.20 21:33:04 | 000,000,000 | ---D | M] -- C:\Users

[2012.03.25 23:31:46 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

 
 < MD5 for: REGEDIT.EXE  >

[2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe

[2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe

[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe

[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

 
 <           >
 

< End of report >

Extras.txt

Code:

OTL Extras logfile created on: 26.03.2012 00:37:21 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,06 Gb Available Physical Memory | 88,32% Memory free

12,50 Gb Paging File | 11,45 Gb Available in Paging File | 91,62% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 33,25 Gb Free Space | 59,60% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 125,60 Gb Free Space | 42,14% Space Free | Partition Type: NTFS

Drive H: | 1,92 Gb Total Space | 1,46 Gb Free Space | 76,40% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0C818871-6337-17AC-CA8C-A3942F15D92A}" = AMD Accelerated Video Transcoding

"{353D1262-B2D2-AD87-EB5E-6B1395AF9FAE}" = AMD Catalyst Install Manager

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{54FFD5AC-7350-52B9-FB8F-1A8A6CF1FB5B}" = AMD Media Foundation Decoders

"{551F4187-F029-4240-DEF9-836B5E43CB29}" = AMD Fuel

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{D6DDB606-CD15-98C7-AA65-6B617EE8CDA5}" = ccc-utility64

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"UDK-c9ba1dda-55c3-4842-b263-4e79d8d3928a" = My Game Long Name

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02446EBD-7E93-8DB2-662A-20A8BE5630E0}" = Catalyst Control Center InstallProxy

"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2

"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29

"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{375B0ACB-49BA-463E-96D0-E95F994DF594}" = AMD OverDrive Beta

"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension

"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German

"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek

"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian

"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech

"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional

"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard

"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai

"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish

"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian

"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish

"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish

"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian

"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese

"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All

"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English

"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch

"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common

"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"DAEMON Tools Lite" = DAEMON Tools Lite

"Driver Cleaner Pro" = DH Driver Cleaner Professional Edition

"Fraps" = Fraps

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"JDownloader" = JDownloader

"KLiteCodecPack_is1" = K-Lite Codec Pack 7.9.0 (Standard)

"Lan Lights" = Lan Lights

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000

"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)

"mv61xxDriver" = marvell 61xx

"SpeedFan" = SpeedFan (remove only)

"VLC media player" = VLC media player 2.0.1

"Winamp" = Winamp

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 19.01.2012 20:44:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0xddc  Startzeit der fehlerhaften Anwendung: 0x01ccd70c9e0f08a6  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: dbbdf4e6-42ff-11e1-b1f9-e0cb4ec5ca56

 

Error - 19.01.2012 20:44:23 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0xd0c  Startzeit der fehlerhaften Anwendung: 0x01ccd70ca714cfa6  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: e4c5afff-42ff-11e1-b1f9-e0cb4ec5ca56

 

Error - 22.01.2012 15:47:18 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: BatmanAC.exe, Version: 1.0.0.0, Zeitstempel:

 0x00000000  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,

 Zeitstempel: 0x4e211319  Ausnahmecode: 0x00000001  Fehleroffset: 0x0000b9bc  ID des fehlerhaften

 Prozesses: 0x1078  Startzeit der fehlerhaften Anwendung: 0x01ccd93e6044d0f1  Pfad der

 fehlerhaften Anwendung: D:\Batman Arkham City\Binaries\Win32\BatmanAC.exe  Pfad des

 fehlerhaften Moduls: C:\Windows\syswow64\KERNELBASE.dll  Berichtskennung: e3b0cd01-4531-11e1-9cef-e0cb4ec5ca56

 

Error - 31.01.2012 17:05:43 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".

Die

 abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 05.02.2012 14:50:18 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xd50  Startzeit der fehlerhaften Anwendung: 0x01cce427a3fb7408  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 3f599496-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:02 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,

 Zeitstempel: 0x4e211319  Ausnahmecode: 0x0eedfade  Fehleroffset: 0x0000b9bc  ID des fehlerhaften

 Prozesses: 0x3a8  Startzeit der fehlerhaften Anwendung: 0x01cce4371b9ac6ee  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\syswow64\KERNELBASE.dll  Berichtskennung: 59556b6c-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:15 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0x750  Startzeit der fehlerhaften Anwendung: 0x01cce43723368533  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: 60e65418-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 23.02.2012 19:32:48 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl.exe, Version: 1.1.1.1, Zeitstempel:

 0x48feaf5a  Name des fehlerhaften Moduls: steam.dll, Version: 2.0.1320.120, Zeitstempel:

 0x4f442e99  Ausnahmecode: 0xc0000409  Fehleroffset: 0x001f3783  ID des fehlerhaften Prozesses:

 0x768  Startzeit der fehlerhaften Anwendung: 0x01ccf27504dc4068  Pfad der fehlerhaften

 Anwendung: c:\program files (x86)\steam\steamapps\procs27374\counter-strike\hl.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Steam\steam.dll  Berichtskennung:

 b1b6ad45-5e76-11e1-9b1a-e0cb4ec5ca56

 

Error - 01.03.2012 16:39:49 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01ccf7eb713657ac  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 b0222cf5-63de-11e1-a03e-e0cb4ec5ca56

 

Error - 21.03.2012 18:41:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: setup.exe_Microsoft IntelliType Pro

 / IntelliPoint, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Name des fehlerhaften

 Moduls: setup.exe, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Ausnahmecode: 0xc0000005

Fehleroffset:

 0x00031bf1  ID des fehlerhaften Prozesses: 0x614  Startzeit der fehlerhaften Anwendung:

 0x01cd07b3a9c78154  Pfad der fehlerhaften Anwendung: d:\eddd80f683e5e60828d51720733a\setup.exe

Pfad

 des fehlerhaften Moduls: d:\eddd80f683e5e60828d51720733a\setup.exe  Berichtskennung:

 f20688ca-73a6-11e1-8c4b-e0cb4ec5ca56

 

[ System Events ]

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 25.03.2012 18:37:48 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

 

< End of report >

Vielen Dank schonmal!

mfg

Hab' ich vergessen: Bevor ich mich hier angemeldet hab', hatte ich schon einen Versuch mit Malwarebytes gestartet und das System auch oberflächlich bereinigen können.

Die Logs vorher/nachher:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

Malwarebytes : Free anti-malware, anti-virus and spyware removal download
 

Datenbank Version: v2012.03.25.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

scorp :: SCORP-PC [Administrator]
 

Schutz: Aktiviert
 

26.03.2012 00:03:25

mbam-log-2012-03-26 (00-03-25).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 186165

Laufzeit: 39 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|bYXmuYDuwsvN.exe (Trojan.Agent) -> Daten: C:\ProgramData\bYXmuYDuwsvN.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\ProgramData\BYXMUYDUWSVN.EXE (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

Malwarebytes : Free anti-malware, anti-virus and spyware removal download
 

Datenbank Version: v2012.03.25.03
 

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

scorp :: SCORP-PC [Administrator]
 

Schutz: Deaktiviert
 

26.03.2012 01:06:50

mbam-log-2012-03-26 (01-06-50).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 274719

Laufzeit: 6 Minute(n), 25 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

Zitat:

"Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
- da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
- also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
Charakteristische Merkmale/Profilinformationen:
- aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] oder Sternchen (*) ersetzen
Die Systemprüfung und Bereinigung:
- kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
Innerhalb der Betreuungszeit:
- ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
Die Reihenfolge:
- genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
Ansonsten unsere Forumsregeln:
- Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)

Zitat:

Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Lesestoff: "Hilfe: Ich wurde das Opfer eines Hackerangriffs. Was soll ich tun?" - Säubern eines gefährdeten Systems

Falls du doch für die Systemreinigung entscheidest - Ein System zu bereinigen kann ein paar Tage dauern (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst::

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.

Zitat:

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

[2012.02.16 12:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\Shell - "" = AutoRun

O33 - MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\Shell\AutoRun\command - "" = G:\Autorun.exe

O33 - MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\Shell - "" = AutoRun

O33 - MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\Shell\AutoRun\command - "" = G:\steambackup.exe
 

:Files

C:\ProgramData\dBhW8pCn1tAWBP

C:\ProgramData\~dBhW8pCn1tAWBP

C:\ProgramData\~dBhW8pCn1tAWBPr

C:\ProgramData\dBhW8pCn1tAWBP.exe

ipconfig /flushdns /c
 

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Code-Tags in Deinen Thread.

2.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:

Download den CCleaner - Installer herunter
Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

3.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

4.
Hast du den Rechner bereits auf Viren überprüft? Folgende Ergebnisse möchte ich noch sehen:

Code:

SuperAntiSpyware Free Edition

(alle vorhandenen Protokolle!)

Zitat:

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
kira

1. OTL FIX

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

Prefs.js: "www.google.com" removed from browser.startup.homepage

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll moved successfully.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

File C:\Users\scorp\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll not found.

C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml moved successfully.

C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a906ee7c-1556-11e1-9b9d-e0cb4ec5ca56}\ not found.

File G:\Autorun.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb5aa2e1-25cb-11e1-91c6-e0cb4ec5ca56}\ not found.

File G:\steambackup.exe not found.

========== FILES ==========

C:\ProgramData\dBhW8pCn1tAWBP moved successfully.

C:\ProgramData\~dBhW8pCn1tAWBP moved successfully.

C:\ProgramData\~dBhW8pCn1tAWBPr moved successfully.

File\Folder C:\ProgramData\dBhW8pCn1tAWBP.exe not found.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\scorp\Desktop\cmd.bat deleted successfully.

C:\Users\scorp\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: scorp

->Temp folder emptied: 768909 bytes

->Temporary Internet Files folder emptied: 17810244 bytes

->Java cache emptied: 1844647 bytes

->FireFox cache emptied: 70383251 bytes

->Flash cache emptied: 30701 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 1713319 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 2748 bytes

 

Total Files Cleaned = 88,00 mb

 

 

OTL by OldTimer - Version 3.2.39.2 log created on 03262012_090226
 

Files\Folders moved on Reboot...

C:\Users\scorp\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

OTL TXT

Code:

OTL logfile created on: 26.03.2012 09:14:57 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 6,89 Gb Available Physical Memory | 86,19% Memory free

12,50 Gb Paging File | 11,35 Gb Available in Paging File | 90,85% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 32,81 Gb Free Space | 58,80% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.12.15 00:28:16 | 000,507,904 | ---- | M] (Paul Mather) -- C:\Program Files (x86)\LanLights\LanLights.exe

PRC - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2012.02.14 23:16:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.12.16 03:31:53 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.12.09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidusbf.sys -- (hidusbf)

DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.01.18 16:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)

DRV:64bit: - [2012.01.18 16:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)

DRV:64bit: - [2012.01.03 23:22:54 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)

DRV:64bit: - [2011.12.14 02:03:37 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV:64bit: - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2010.05.15 20:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)

DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.12 00:49:10 | 000,178,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver4.1)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver2)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 D5 61 BC A7 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.selectedEngine: "WOT Safe Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.28 19:15:10 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.28 19:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Extensions

[2012.03.26 03:00:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions

[2012.03.26 03:00:32 | 000,000,000 | ---D | M] (WOT) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.03.26 03:00:35 | 000,002,112 | ---- | M] () -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\searchplugins\wot-safe-search.xml

[2012.02.28 19:15:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\AUTOCOPY2@TEO.PL.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\SECURELOGIN@BLUEIMP.NET.XPI

[2012.02.16 16:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

 

O1 HOSTS File: ([2012.03.26 02:39:05 | 000,441,467 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 127.0.0.1        123fporn.info

O1 - Hosts: 15170 more lines...

O4 - HKLM..\Run: [LanLight] C:\Program Files (x86)\LanLights\LanLights.exe (Paul Mather)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7BE62C-886B-434A-AEE5-095EFA060844}: DhcpNameServer = 192.168.178.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.26 09:11:52 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\otl old

[2012.03.26 09:02:26 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.26 02:20:30 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\SUPERAntiSpyware.com

[2012.03.26 02:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.03.26 02:20:13 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.03.26 02:20:13 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.03.26 00:56:50 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.26 00:22:53 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:50 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Malwarebytes

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.26 00:01:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.03.26 00:00:00 | 015,540,296 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\scorp\Desktop\SUPERAntiSpyware.exe

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.03.25 23:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.25 23:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.03.25 23:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.03.25 22:59:40 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

[2012.03.22 00:57:01 | 000,008,064 | ---- | C] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 00:03:20 | 000,119,808 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\opnetext.dll

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\InstallShield

[2012.03.22 00:02:54 | 000,027,648 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\OKLMON64.DLL

[2012.03.14 21:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.03.14 21:16:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.03.14 21:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.03.07 07:44:57 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\Ugly Duckling - Moving At Breakneck Speed (2011)

[2012.03.03 03:57:56 | 001,081,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomctl.ocx

[2012.03.03 03:57:56 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Msinet.ocx

[2012.03.03 03:57:56 | 000,124,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mswinsck.ocx

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LanLights

[2012.02.28 22:07:05 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\The Way I See It [2oo8]

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Mozilla

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Local\Mozilla

[2012.02.28 19:15:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.26 09:10:51 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.26 09:10:51 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.26 09:07:58 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.26 09:07:58 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.26 09:07:58 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.26 09:07:58 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.26 09:07:58 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.26 09:03:45 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2012.03.26 02:39:05 | 000,441,467 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.03.26 02:32:13 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 02:20:17 | 000,001,784 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:40 | 000,001,091 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.26 00:00:08 | 015,540,296 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\scorp\Desktop\SUPERAntiSpyware.exe

[2012.03.25 23:28:18 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.24 04:12:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 01:07:05 | 000,000,543 | ---- | M] () -- C:\Windows\NGO.cer

[2012.03.22 00:48:21 | 000,267,440 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.22 00:41:04 | 000,000,290 | ---- | M] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.21 17:42:08 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.12 22:20:58 | 734,130,177 | ---- | M] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:35:55 | 1488,550,308 | ---- | M] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

 
 ========== Files Created - No Company Name ==========

 

[2012.03.26 02:32:13 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.03.26 02:32:13 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 02:20:17 | 000,001,784 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.03.26 00:01:40 | 000,001,091 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 01:17:27 | 000,024,576 | ---- | C] () -- C:\Users\scorp\Desktop\memtest.exe

[2012.03.22 01:07:05 | 000,000,543 | ---- | C] () -- C:\Windows\NGO.cer

[2012.03.22 00:41:04 | 000,000,290 | ---- | C] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.22 00:03:20 | 000,003,252 | ---- | C] () -- C:\Windows\SysNative\opnedef.str

[2012.03.22 00:03:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysNative\opnetext.ver

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\opnetext.gid

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\opnetext.gid

[2012.03.12 20:20:02 | 734,130,177 | ---- | C] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:07:23 | 1488,550,308 | ---- | C] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

[2012.02.28 18:18:05 | 001,013,320 | ---- | C] () -- C:\Windows\SysNative\pwNative.exe

[2012.02.28 18:18:05 | 000,019,936 | ---- | C] () -- C:\Windows\SysNative\pwdrvio.sys

[2012.02.28 18:18:05 | 000,013,280 | ---- | C] () -- C:\Windows\SysNative\pwdspio.sys

[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2012.01.10 05:51:32 | 000,000,083 | ---- | C] () -- C:\Windows\SysWow64\config.ini

[2011.12.13 21:23:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.11.30 13:07:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.11.24 00:05:15 | 000,000,606 | ---- | C] () -- C:\ProgramData\ntuser.pol

[2011.11.22 19:55:38 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2011.11.21 13:37:48 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2011.11.21 13:37:48 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.11.21 13:36:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.11.20 22:22:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.20 22:18:10 | 000,007,606 | ---- | C] () -- C:\Users\scorp\AppData\Local\Resmon.ResmonCfg

[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== LOP Check ==========

 

[2012.02.02 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Auslogics

[2011.12.14 02:04:35 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\DAEMON Tools Lite

[2012.03.07 22:42:06 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\ICQ

[2011.11.23 00:01:44 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\SteelSeries Xai

[2011.11.30 18:34:07 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Ubisoft

[2009.07.14 07:08:49 | 000,009,954 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Extras TXT

Code:

OTL Extras logfile created on: 26.03.2012 09:14:57 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 6,89 Gb Available Physical Memory | 86,19% Memory free

12,50 Gb Paging File | 11,35 Gb Available in Paging File | 90,85% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 32,81 Gb Free Space | 58,80% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0C818871-6337-17AC-CA8C-A3942F15D92A}" = AMD Accelerated Video Transcoding

"{353D1262-B2D2-AD87-EB5E-6B1395AF9FAE}" = AMD Catalyst Install Manager

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{54FFD5AC-7350-52B9-FB8F-1A8A6CF1FB5B}" = AMD Media Foundation Decoders

"{551F4187-F029-4240-DEF9-836B5E43CB29}" = AMD Fuel

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{D6DDB606-CD15-98C7-AA65-6B617EE8CDA5}" = ccc-utility64

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"UDK-c9ba1dda-55c3-4842-b263-4e79d8d3928a" = My Game Long Name

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02446EBD-7E93-8DB2-662A-20A8BE5630E0}" = Catalyst Control Center InstallProxy

"{025381B0-29B2-4935-88DE-96E320DB9E0B}_is1" = Defense Grid - Gold version 1.0

"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2

"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29

"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{375B0ACB-49BA-463E-96D0-E95F994DF594}" = AMD OverDrive Beta

"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension

"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German

"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish

"{4113C4B5-AF36-4984-8F57-F21F334B807D}_is1" = Metro 2033

"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek

"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian

"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech

"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional

"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard

"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai

"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7

"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish

"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian

"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish

"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B531E735-8ED5-4270-ACCE-3809086FBD02}_is1" = Batman Arkham City version 1.0

"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish

"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian

"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese

"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All

"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy

"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English

"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch

"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common

"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"DAEMON Tools Lite" = DAEMON Tools Lite

"Fraps" = Fraps

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"JDownloader" = JDownloader

"KLiteCodecPack_is1" = K-Lite Codec Pack 7.9.0 (Standard)

"Lan Lights" = Lan Lights

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000

"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)

"mv61xxDriver" = marvell 61xx

"SpeedFan" = SpeedFan (remove only)

"StarCraft II" = StarCraft II

"Steam App 10" = Counter-Strike

"VLC media player" = VLC media player 2.0.1

"Winamp" = Winamp

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 19.01.2012 20:44:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0xddc  Startzeit der fehlerhaften Anwendung: 0x01ccd70c9e0f08a6  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: dbbdf4e6-42ff-11e1-b1f9-e0cb4ec5ca56

 

Error - 19.01.2012 20:44:23 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0xd0c  Startzeit der fehlerhaften Anwendung: 0x01ccd70ca714cfa6  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: e4c5afff-42ff-11e1-b1f9-e0cb4ec5ca56

 

Error - 22.01.2012 15:47:18 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: BatmanAC.exe, Version: 1.0.0.0, Zeitstempel:

 0x00000000  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,

 Zeitstempel: 0x4e211319  Ausnahmecode: 0x00000001  Fehleroffset: 0x0000b9bc  ID des fehlerhaften

 Prozesses: 0x1078  Startzeit der fehlerhaften Anwendung: 0x01ccd93e6044d0f1  Pfad der

 fehlerhaften Anwendung: D:\Batman Arkham City\Binaries\Win32\BatmanAC.exe  Pfad des

 fehlerhaften Moduls: C:\Windows\syswow64\KERNELBASE.dll  Berichtskennung: e3b0cd01-4531-11e1-9cef-e0cb4ec5ca56

 

Error - 31.01.2012 17:05:43 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".

Die

 abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 05.02.2012 14:50:18 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xd50  Startzeit der fehlerhaften Anwendung: 0x01cce427a3fb7408  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 3f599496-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:02 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,

 Zeitstempel: 0x4e211319  Ausnahmecode: 0x0eedfade  Fehleroffset: 0x0000b9bc  ID des fehlerhaften

 Prozesses: 0x3a8  Startzeit der fehlerhaften Anwendung: 0x01cce4371b9ac6ee  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\syswow64\KERNELBASE.dll  Berichtskennung: 59556b6c-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:15 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0x750  Startzeit der fehlerhaften Anwendung: 0x01cce43723368533  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: 60e65418-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 23.02.2012 19:32:48 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl.exe, Version: 1.1.1.1, Zeitstempel:

 0x48feaf5a  Name des fehlerhaften Moduls: steam.dll, Version: 2.0.1320.120, Zeitstempel:

 0x4f442e99  Ausnahmecode: 0xc0000409  Fehleroffset: 0x001f3783  ID des fehlerhaften Prozesses:

 0x768  Startzeit der fehlerhaften Anwendung: 0x01ccf27504dc4068  Pfad der fehlerhaften

 Anwendung: c:\program files (x86)\steam\steamapps\procs27374\counter-strike\hl.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Steam\steam.dll  Berichtskennung:

 b1b6ad45-5e76-11e1-9b1a-e0cb4ec5ca56

 

Error - 01.03.2012 16:39:49 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01ccf7eb713657ac  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 b0222cf5-63de-11e1-a03e-e0cb4ec5ca56

 

Error - 21.03.2012 18:41:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: setup.exe_Microsoft IntelliType Pro

 / IntelliPoint, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Name des fehlerhaften

 Moduls: setup.exe, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Ausnahmecode: 0xc0000005

Fehleroffset:

 0x00031bf1  ID des fehlerhaften Prozesses: 0x614  Startzeit der fehlerhaften Anwendung:

 0x01cd07b3a9c78154  Pfad der fehlerhaften Anwendung: d:\eddd80f683e5e60828d51720733a\setup.exe

Pfad

 des fehlerhaften Moduls: d:\eddd80f683e5e60828d51720733a\setup.exe  Berichtskennung:

 f20688ca-73a6-11e1-8c4b-e0cb4ec5ca56

 

[ System Events ]

Error - 26.03.2012 02:52:53 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, 

der aufgrund folgenden Fehlers nicht gestartet wurde:   %%2

 

Error - 26.03.2012 03:02:27 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies

 ist bereits 1 Mal passiert.

 

Error - 26.03.2012 03:03:46 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :0" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 26.03.2012 03:03:46 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%183

 

Error - 26.03.2012 03:03:48 | Computer Name = scorp-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{8B7BE62C-886B-434A-AEE5-095EFA060844} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 26.03.2012 03:03:48 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 26.03.2012 03:04:27 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:   %%2

 

Error - 26.03.2012 03:04:48 | Computer Name = scorp-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 26.03.2012 03:05:49 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht 

gestartet:   %%2

 

Error - 26.03.2012 03:05:49 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, 

der aufgrund folgenden Fehlers nicht gestartet wurde:   %%2

 

 

< End of report >

Superantispyware Scan Log

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 03/26/2012 at 09:49 AM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8377

Trace Rules Database Version: 6189
 

Scan type       : Complete Scan

Total Scan Time : 00:07:27
 

Operating System Information

Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 615

Memory threats detected   : 0

Registry items scanned    : 63626

Registry threats detected : 0

File items scanned        : 34853

File threats detected     : 14
 

Adware.Tracking Cookie

        C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Cookies\scorp@accounts.google[1].txt [ /accounts.google ]

        C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Cookies\scorp@serving-sys[2].txt [ /serving-sys ]

        C:\USERS\SCORP\Cookies\scorp@accounts.google[1].txt [ Cookie:scorp@accounts.google.com/ ]

        de.sitestat.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\COOKIES.SQLITE ]

Kleiner Zusatz:

Hab' mir das Dingen mit Chrome eingefangen, jetzt allerdings wieder Firefox installiert und Chrome rausgeschmissen.

CC CLEANER

Code:

3DMark 11        Futuremark Corporation        09.01.2012                1.0.3

Adobe Flash Player 11 ActiveX 64-bit        Adobe Systems Incorporated        12.12.2011        6,00MB        11.1.102.55

Adobe Flash Player 11 Plugin 64-bit        Adobe Systems Incorporated        23.03.2012        6,00MB        11.1.102.63

Adobe Reader X (10.1.2) - Deutsch        Adobe Systems Incorporated        16.01.2012        121,1MB        10.1.2

AMD Catalyst Install Manager        Advanced Micro Devices, Inc.        13.03.2012        26,3MB        3.0.868.0

AMD OverDrive Beta        Advanced Micro Devices, Inc.        12.12.2011        19,7MB        4.0.5.0534

Batman Arkham City version 1.0        WB Games        26.12.2011                1.0

CCleaner        Piriform        24.03.2012                3.16

Counter-Strike        Valve        15.12.2011                

DAEMON Tools Lite        DT Soft Ltd        13.12.2011                4.45.1.0236

Defense Grid - Gold version 1.0                08.01.2012        1.145MB        1.0

Fraps                21.12.2011                

Futuremark SystemInfo        Futuremark Corporation        09.01.2012                4.6.0

Geeks3D.com FurMark 1.9.2        Geeks3D.com        14.01.2012        4,62MB        

ICQ7.7        ICQ        20.11.2011                7.7

Java(TM) 6 Update 29        Oracle        22.11.2011        95,0MB        6.0.290

JDownloader        AppWork UG (haftungsbeschränkt)        12.12.2011                

K-Lite Codec Pack 7.9.0 (Standard)                21.11.2011        39,6MB        7.9.0

Lan Lights                02.03.2012                

Malwarebytes Anti-Malware Version 1.60.1.1000        Malwarebytes Corporation        25.03.2012        17,4MB        1.60.1.1000

marvell 61xx        Marvell        20.11.2011                1.2.0.69

Metro 2033        Grosses_K        22.11.2011                v1.2

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        20.11.2011        38,8MB        4.0.30319

Microsoft Games for Windows - LIVE Redistributable        Microsoft Corporation        26.12.2011        31,3MB        3.5.88.0

Microsoft Games for Windows Marketplace        Microsoft Corporation        26.12.2011        6,04MB        3.5.50.0

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        22.11.2011        0,34MB        8.0.59193

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        29.11.2011        0,58MB        9.0.30729

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319        Microsoft Corporation        19.11.2011        13,7MB        10.0.30319

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        19.11.2011        11,1MB        10.0.40219

Mozilla Firefox 10.0.2 (x86 de)        Mozilla        27.02.2012        35,5MB        10.0.2

My Game Long Name        Epic Games, Inc.        05.03.2012                

NVIDIA PhysX        NVIDIA Corporation        15.01.2012        86,1MB        9.11.1107

OKI Network Extension        Okidata        20.03.2012                1.00.000

Revo Uninstaller Pro 2.5.7        VS Revo Group, Ltd.        14.12.2011        54,3MB        2.5.7

SpeedFan (remove only)                10.01.2012                

Spybot - Search & Destroy        Safer Networking Limited        05.01.2012                1.6.2

StarCraft II        Blizzard Entertainment        21.02.2012                1.4.3.21029

Steam        Valve Corporation        15.12.2011        1,59MB        1.0.0.0

SUPERAntiSpyware        SUPERAntiSpyware.com        25.03.2012        97,7MB        5.0.1146

Ubisoft Game Launcher        UBISOFT        29.11.2011                1.0.0.0

VIA Plattform-Geräte-Manager        VIA Technologies, Inc.        20.11.2011        2,62MB        1.34

VLC media player 2.0.1        VideoLAN        19.03.2012                2.0.1

Winamp        Nullsoft, Inc        01.02.2012                5.623 

Windows Live ID Sign-in Assistant        Microsoft Corporation        26.12.2011        10,0MB        6.500.3165.0

WinRAR 4.01 (64-Bit)        win.rar GmbH        19.11.2011                4.01.0

Hallo wieder,

da scheint noch irgendetwas im Argen zu sein. Beim Firefox hat sich ganz willkürlich ein Tab selbst umgeleitet.

Wäre schön, wenn mir nochmal jemand helfen könnte, auch wenn hier heute scheinbar die Hölle los ist :D

mfg

Zitat:

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
 

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

2.
Java aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version 6 Update 31 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

3.
reinige dein System mit CCleaner:

"CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

4.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

5.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

6.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

7.
MBR mit aswMBR von Avast prüfen

Lade aswMBR.exe von Avast herunter und speichere das Tool auf deinem Desktop (nicht woanders hin).
XP Benutzer: Doppelklick auf die aswMBR.exe, um das Tool zu starten.
Vista und Windows 7 Benutzer: Rechtsklick auf die aswMBR.exe und Als Administrator starten wählen.
Es wird sich ein Eingabe-Fenster mit einigen Angaben öffnen.

Klicke Scan, um den Suchlauf zu starten.

Wenn der Scan beendet ist, was mit Scan finished sucessfull! gemeldet wird, klicke Save log, um das Logfile zu speichern.
Poste mir den Inhalt von aswASW.log vom Desktop hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

1. OTL FIX:

Code:

All processes killed

========== OTL ==========

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\scorp\Desktop\cmd.bat deleted successfully.

C:\Users\scorp\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: scorp

->Temp folder emptied: 270186 bytes

->Temporary Internet Files folder emptied: 17328426 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 509130918 bytes

->Flash cache emptied: 1153 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 46684014 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 547,00 mb

 

 

OTL by OldTimer - Version 3.2.39.2 log created on 03272012_004448
 

Files\Folders moved on Reboot...

C:\Users\scorp\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Users\scorp\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PPCXQW16\ac7[6].htm not found!
 

Registry entries deleted on Reboot...

2. Java aktualisiert

3. CCleaner Done!

4. Check

5. ESET -> Clean

6. OTL. txt

Code:

OTL logfile created on: 27.03.2012 01:16:56 - Run 5

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 6,41 Gb Available Physical Memory | 80,13% Memory free

12,50 Gb Paging File | 10,90 Gb Available in Paging File | 87,21% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,36 Gb Free Space | 56,20% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.12.15 00:28:16 | 000,507,904 | ---- | M] (Paul Mather) -- C:\Program Files (x86)\LanLights\LanLights.exe

PRC - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

PRC - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2012.02.14 23:16:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.03.20 23:43:00 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.12.09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidusbf.sys -- (hidusbf)

DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.01.18 16:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)

DRV:64bit: - [2012.01.18 16:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)

DRV:64bit: - [2012.01.03 23:22:54 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)

DRV:64bit: - [2011.12.14 02:03:37 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV:64bit: - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2010.05.15 20:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)

DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.12 00:49:10 | 000,178,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver4.1)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver2)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 D5 61 BC A7 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.26 20:31:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.28 19:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Extensions

[2012.03.26 03:00:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions

[2012.03.26 03:00:32 | 000,000,000 | ---D | M] (WOT) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.03.26 03:00:35 | 000,002,112 | ---- | M] () -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\searchplugins\wot-safe-search.xml

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\AUTOCOPY2@TEO.PL.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\SECURELOGIN@BLUEIMP.NET.XPI

[2012.03.26 20:31:21 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

 

O1 HOSTS File: ([2012.03.26 02:39:05 | 000,441,467 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 127.0.0.1        123fporn.info

O1 - Hosts: 15170 more lines...

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [LanLight] C:\Program Files (x86)\LanLights\LanLights.exe (Paul Mather)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7BE62C-886B-434A-AEE5-095EFA060844}: DhcpNameServer = 192.168.178.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.27 01:01:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.03.27 00:50:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.03.27 00:50:03 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 20:41:53 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.03.26 20:41:53 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.03.26 20:41:53 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.03.26 20:38:36 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll

[2012.03.26 20:38:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2012.03.26 20:38:31 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.03.26 20:38:28 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2012.03.26 20:38:28 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2012.03.26 20:38:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll

[2012.03.26 20:38:28 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2012.03.26 20:38:28 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.03.26 20:38:28 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2012.03.26 20:38:27 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2012.03.26 20:38:27 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll

[2012.03.26 20:38:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.03.26 20:38:27 | 000,918,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.03.26 20:38:27 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll

[2012.03.26 20:38:27 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2012.03.26 20:38:26 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll

[2012.03.26 20:38:26 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll

[2012.03.26 20:38:26 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll

[2012.03.26 20:38:26 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll

[2012.03.26 20:38:26 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll

[2012.03.26 20:38:25 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl

[2012.03.26 20:38:25 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl

[2012.03.26 20:38:25 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.03.26 20:38:25 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.03.26 20:38:25 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe

[2012.03.26 20:38:09 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll

[2012.03.26 20:38:09 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll

[2012.03.26 20:38:08 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll

[2012.03.26 20:38:08 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll

[2012.03.26 09:11:52 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\otl old

[2012.03.26 09:02:26 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.26 02:20:30 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\SUPERAntiSpyware.com

[2012.03.26 02:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.03.26 02:20:13 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.03.26 02:20:13 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.03.26 00:56:50 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.26 00:22:53 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:50 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Malwarebytes

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.26 00:01:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.03.25 23:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.25 23:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.03.25 23:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.03.25 22:59:40 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

[2012.03.22 00:57:01 | 000,008,064 | ---- | C] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 00:03:20 | 000,119,808 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\opnetext.dll

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\InstallShield

[2012.03.22 00:02:54 | 000,027,648 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\OKLMON64.DLL

[2012.03.14 21:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.03.14 21:16:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.03.14 21:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.03.07 07:44:57 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\Ugly Duckling - Moving At Breakneck Speed (2011)

[2012.03.03 03:57:56 | 001,081,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomctl.ocx

[2012.03.03 03:57:56 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Msinet.ocx

[2012.03.03 03:57:56 | 000,124,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mswinsck.ocx

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LanLights

[2012.02.28 22:07:05 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\The Way I See It [2oo8]

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Mozilla

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Local\Mozilla

[2012.02.28 19:15:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.27 01:05:06 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.27 01:05:06 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.27 01:02:17 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.27 01:02:17 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.27 01:02:17 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.27 01:02:17 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.27 01:02:17 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.27 00:58:00 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2012.03.27 00:56:27 | 000,073,052 | ---- | M] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.27 00:49:53 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2012.03.27 00:49:53 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 21:04:16 | 000,267,440 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.26 18:34:33 | 000,302,592 | ---- | M] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:39:05 | 000,441,467 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.03.26 02:32:13 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 02:20:17 | 000,001,784 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:40 | 000,001,091 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.24 04:12:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 01:07:05 | 000,000,543 | ---- | M] () -- C:\Windows\NGO.cer

[2012.03.22 00:41:04 | 000,000,290 | ---- | M] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.21 17:42:08 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.12 22:20:58 | 734,130,177 | ---- | M] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:35:55 | 1488,550,308 | ---- | M] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

 
 ========== Files Created - No Company Name ==========

 

[2012.03.27 00:56:14 | 000,073,052 | ---- | C] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.26 18:34:39 | 000,302,592 | ---- | C] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:32:13 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.03.26 02:32:13 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 02:20:17 | 000,001,784 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.03.26 00:01:40 | 000,001,091 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 01:17:27 | 000,024,576 | ---- | C] () -- C:\Users\scorp\Desktop\memtest.exe

[2012.03.22 01:07:05 | 000,000,543 | ---- | C] () -- C:\Windows\NGO.cer

[2012.03.22 00:41:04 | 000,000,290 | ---- | C] () -- C:\Windows\tasks\Microsoft_Hardware_Launch_IPoint_exe.job

[2012.03.22 00:40:58 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.22 00:03:20 | 000,003,252 | ---- | C] () -- C:\Windows\SysNative\opnedef.str

[2012.03.22 00:03:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysNative\opnetext.ver

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\opnetext.gid

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\opnetext.gid

[2012.03.12 20:20:02 | 734,130,177 | ---- | C] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:07:23 | 1488,550,308 | ---- | C] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

[2012.02.28 18:18:05 | 001,013,320 | ---- | C] () -- C:\Windows\SysNative\pwNative.exe

[2012.02.28 18:18:05 | 000,019,936 | ---- | C] () -- C:\Windows\SysNative\pwdrvio.sys

[2012.02.28 18:18:05 | 000,013,280 | ---- | C] () -- C:\Windows\SysNative\pwdspio.sys

[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2012.01.10 05:51:32 | 000,000,083 | ---- | C] () -- C:\Windows\SysWow64\config.ini

[2011.12.13 21:23:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.11.30 13:07:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.11.24 00:05:15 | 000,000,606 | ---- | C] () -- C:\ProgramData\ntuser.pol

[2011.11.22 19:55:38 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2011.11.21 13:37:48 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2011.11.21 13:37:48 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.11.21 13:36:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.11.20 22:22:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.20 22:18:10 | 000,007,606 | ---- | C] () -- C:\Users\scorp\AppData\Local\Resmon.ResmonCfg

[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== LOP Check ==========

 

[2012.02.02 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Auslogics

[2011.12.14 02:04:35 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\DAEMON Tools Lite

[2012.03.07 22:42:06 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\ICQ

[2011.11.23 00:01:44 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\SteelSeries Xai

[2011.11.30 18:34:07 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Ubisoft

[2009.07.14 07:08:49 | 000,009,954 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Extras.txt

Code:

OTL Extras logfile created on: 27.03.2012 01:16:56 - Run 5

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 6,41 Gb Available Physical Memory | 80,13% Memory free

12,50 Gb Paging File | 10,90 Gb Available in Paging File | 87,21% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,36 Gb Free Space | 56,20% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- Reg Error: Key error.

htmlfile [opennew] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- Reg Error: Key error.

htmlfile [opennew] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Disabled:Spybot-S&D 2 Scanner Service

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0C818871-6337-17AC-CA8C-A3942F15D92A}" = AMD Accelerated Video Transcoding

"{353D1262-B2D2-AD87-EB5E-6B1395AF9FAE}" = AMD Catalyst Install Manager

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{54FFD5AC-7350-52B9-FB8F-1A8A6CF1FB5B}" = AMD Media Foundation Decoders

"{551F4187-F029-4240-DEF9-836B5E43CB29}" = AMD Fuel

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{D6DDB606-CD15-98C7-AA65-6B617EE8CDA5}" = ccc-utility64

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"UDK-c9ba1dda-55c3-4842-b263-4e79d8d3928a" = My Game Long Name

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02446EBD-7E93-8DB2-662A-20A8BE5630E0}" = Catalyst Control Center InstallProxy

"{025381B0-29B2-4935-88DE-96E320DB9E0B}_is1" = Defense Grid - Gold version 1.0

"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{375B0ACB-49BA-463E-96D0-E95F994DF594}" = AMD OverDrive Beta

"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension

"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German

"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish

"{4113C4B5-AF36-4984-8F57-F21F334B807D}_is1" = Metro 2033

"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek

"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian

"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech

"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional

"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard

"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7

"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish

"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian

"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish

"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B531E735-8ED5-4270-ACCE-3809086FBD02}_is1" = Batman Arkham City version 1.0

"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish

"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian

"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese

"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All

"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy

"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English

"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch

"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common

"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"DAEMON Tools Lite" = DAEMON Tools Lite

"Fraps" = Fraps

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"JDownloader" = JDownloader

"KLiteCodecPack_is1" = K-Lite Codec Pack 7.9.0 (Standard)

"Lan Lights" = Lan Lights

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000

"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)

"mv61xxDriver" = marvell 61xx

"SpeedFan" = SpeedFan (remove only)

"StarCraft II" = StarCraft II

"Steam App 10" = Counter-Strike

"VLC media player" = VLC media player 2.0.1

"Winamp" = Winamp

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 31.01.2012 17:05:43 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\ATI\CIM\Bin64\SetACL64.exe".

Die

 abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 05.02.2012 14:50:18 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xd50  Startzeit der fehlerhaften Anwendung: 0x01cce427a3fb7408  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 3f599496-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:02 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,

 Zeitstempel: 0x4e211319  Ausnahmecode: 0x0eedfade  Fehleroffset: 0x0000b9bc  ID des fehlerhaften

 Prozesses: 0x3a8  Startzeit der fehlerhaften Anwendung: 0x01cce4371b9ac6ee  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\syswow64\KERNELBASE.dll  Berichtskennung: 59556b6c-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 05.02.2012 14:51:15 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Name des fehlerhaften Moduls: speedfan.exe, Version: 4.45.0.355,

 Zeitstempel: 0x2a425e19  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000044ce  ID des fehlerhaften

 Prozesses: 0x750  Startzeit der fehlerhaften Anwendung: 0x01cce43723368533  Pfad der

 fehlerhaften Anwendung: C:\Program Files (x86)\SpeedFan\speedfan.exe  Pfad des fehlerhaften

 Moduls: C:\Program Files (x86)\SpeedFan\speedfan.exe  Berichtskennung: 60e65418-502a-11e1-b1ba-e0cb4ec5ca56

 

Error - 23.02.2012 19:32:48 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl.exe, Version: 1.1.1.1, Zeitstempel:

 0x48feaf5a  Name des fehlerhaften Moduls: steam.dll, Version: 2.0.1320.120, Zeitstempel:

 0x4f442e99  Ausnahmecode: 0xc0000409  Fehleroffset: 0x001f3783  ID des fehlerhaften Prozesses:

 0x768  Startzeit der fehlerhaften Anwendung: 0x01ccf27504dc4068  Pfad der fehlerhaften

 Anwendung: c:\program files (x86)\steam\steamapps\procs27374\counter-strike\hl.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Steam\steam.dll  Berichtskennung:

 b1b6ad45-5e76-11e1-9b1a-e0cb4ec5ca56

 

Error - 01.03.2012 16:39:49 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01ccf7eb713657ac  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 b0222cf5-63de-11e1-a03e-e0cb4ec5ca56

 

Error - 21.03.2012 18:41:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: setup.exe_Microsoft IntelliType Pro

 / IntelliPoint, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Name des fehlerhaften

 Moduls: setup.exe, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Ausnahmecode: 0xc0000005

Fehleroffset:

 0x00031bf1  ID des fehlerhaften Prozesses: 0x614  Startzeit der fehlerhaften Anwendung:

 0x01cd07b3a9c78154  Pfad der fehlerhaften Anwendung: d:\eddd80f683e5e60828d51720733a\setup.exe

Pfad

 des fehlerhaften Moduls: d:\eddd80f683e5e60828d51720733a\setup.exe  Berichtskennung:

 f20688ca-73a6-11e1-8c4b-e0cb4ec5ca56

 

Error - 26.03.2012 19:01:13 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:14 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:17 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

[ System Events ]

Error - 26.03.2012 18:49:41 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 26.03.2012 18:49:41 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 26.03.2012 18:49:41 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 26.03.2012 18:49:41 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 26.03.2012 18:49:41 | Computer Name = scorp-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

 

Error - 26.03.2012 18:58:01 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%183

 

Error - 26.03.2012 18:58:42 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:   %%2

 

Error - 26.03.2012 18:59:03 | Computer Name = scorp-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 26.03.2012 19:00:04 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht 

gestartet:   %%2

 

Error - 26.03.2012 19:00:04 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, 

der aufgrund folgenden Fehlers nicht gestartet wurde:   %%2

 

 

< End of report >

7. aswMBR.exe von Avast lässt sich genauso wie tdsskiller.exe (s.o.) nicht starten. Es passiert nach der Bestätigung die *exe als Admin ausführen zu wollen nichts, bzw. gestartete Prozesse werden innerhalb von Bruchteilen wieder beendet.

Sowohl als normaler Benutzer, als auch als Admin und das Ganze auch im abgesicherten Modus :(

1.
Deinstalliere:

Zitat:

Spybot

- würde ich nicht mehr empfehlen, da erfüllt nicht die neue Schutzanforderungen und Lösungen Schutz vor Malware bzw gegenüber ganz neuen Herausforderungen arbeitet nicht zufriedenstellend
meiner Meinung nach bietet nicht mehr ausreichenden Schutz gegen "moderne Malwarearten"...
Außerdem behindert uns nur bei der Bereinigung

2.
WOT Safe Search
würd ich auch deinstallieren, schließlich sein Versprechen nicht halten können

3.

Zitat:

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
 

:Reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" =-

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" =-
 

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[resethosts]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

4.
Vor dem nächsten Schritt, also bevor wir weitermachen:
Da jederzeit etwas passieren kann, wenn du wichtige Daten hast die Du sichern möchtest, empfehle ich Dir es jetzt machen (wie Bilder, Musik usw)
►Achte darauf: Die sicherten Daten sollen keine "Ausführbare Dateien" enthalten! - ►Dateiendungen - Dies ist eine Liste von Dateiendungen, die Dateien mit ausführbarem Code bezeichnen können.
Unabhängig von einem Befall (weil ja kann eine Festplatte auch kaputt gehen, oder es gibt andere technische Probleme ), sollte man regelmäßig Sicherung machen und an einem sicheren Ort bewahren, wie CD und DVD, externe Festplatten oder/und USB-Sticks
Mache das jetzt bitte!

5.
Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

Windows XP (nur 32-bit)
Windows 2000 (nur 32-bit)
Windows Vista (32-bit/64-bit)
Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
Liste der zu deaktivierenden Programme.
Bei Unklarheiten bitte vorher fragen.
Bitte während des Laufs von Combofix nicht in das Combofix-Fenster klicken.
Das könnte Dein System einfrieren oder hängen bleiben lassen.
Es kann circa eine Viertelstunde dauern, bis der Scan fertig ist.
ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
Teile uns das mit und warte auf unsere Anweisungen.

Kurzanleitung zur Installation der Wiederherstellungskonsole unter XP

Doppelklicke auf die ComboFix.exe und folge den Anweisungen.
Akzeptiere die Bedingungen (Disclaimer) mit "Ja".
ComboFix wird schauen, ob die Microsoft-Windows-Wiederherstellungskonsole installiert ist.
Dies ist Teil des Prozesses. Angesichts der Art von Malware Infizierungen, die es heute gibt, wird dringend empfohlen, diese Wiederherstellungskonsole auf dem PC installiert zu haben, bevor jegliche Reinigung von Malware durchgeführt wird.
Folge den Anweisungen, um ComboFix das Herunterladen und Installieren der Wiederherstellungskonsole zu ermöglichen und stimme dem Lizenzvertrag (EULA) zu, sobald Du dazu aufgefordert wirst.

** Zur Information: Sollte die Wiederherstellungskonsole schon installiert sein, so wird ComboFix seine Malware-Entfernungsprozedur normal fortfahren.

http://i94.photobucket.com/albums/l8...eWHKonsole.jpg

Sobald die Wiederherstellungskonsole durch ComboFix installiert wurde, solltest Du folgende Nachricht sehen:

http://i94.photobucket.com/albums/l8...nstalliert.jpg

Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.

Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

6.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

1. Spybot entfernt

2. WOT entfernt (das zu installieren war auch mehr eine Panik-Handlung gestern :D)

3. OTL Log

Code:

All processes killed

========== OTL ==========

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe not found.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\scorp\Desktop\cmd.bat deleted successfully.

C:\Users\scorp\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: scorp

->Temp folder emptied: 867460 bytes

->Temporary Internet Files folder emptied: 2104411 bytes

->Java cache emptied: 888660 bytes

->FireFox cache emptied: 52566359 bytes

->Flash cache emptied: 811 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 54,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 03272012_154231
 

Files\Folders moved on Reboot...

C:\Users\scorp\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\scorp\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VLNSPENM\;sz=1x1;tile=3;klg=de;kt=K;kga=-1;kgg=-1;kcr=de;dc_dedup=1;kmyd=ad_creative_3;ord=270123219594778[1].htm moved successfully.

C:\Users\scorp\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VLNSPENM\si[1].htm moved successfully.

C:\Users\scorp\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7PWL5I6S\youtube_com[1].htm moved successfully.
 

Registry entries deleted on Reboot...

4. Datensicherung nicht nötig

5. Combofix startet nach der Installation nicht von selbst. Welche Datei muss ich im Ordner ausführen, bzw. wie geht's weiter?

Zitat:

Zitat von procs18 (Beitrag 801499)

5. Combofix startet nach der Installation nicht von selbst. Welche Datei muss ich im Ordner ausführen, bzw. wie geht's weiter?

Wo steht in der Anleitung, das ComboFix "von selbst" startet? bitte nochmal gründlich lesen was Du zu tun mußt!

Zitat:

Doppelklicke auf die ComboFix.exe und folge den Anweisungen.

Das war wohl ein Missverständnis!

Natürlich habe ich die Combofix.exe ausgeführt, allerdings bricht er dann nach der Installation/dem Dekomprimieren ab und startet nicht das eigentliche Programm.

*Update*

Hab's hinbekommen:

Combofix.txt

Code:

ComboFix 12-03-27.02 - scorp 28.03.2012   9:37.1.4 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.8191.7180 [GMT 2:00]

ausgeführt von:: c:\users\scorp\Desktop\aSFYT.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\Config.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-28 bis 2012-03-28  ))))))))))))))))))))))))))))))

.

.

2012-03-28 08:03 . 2012-03-28 08:03        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-03-26 22:50 . 2012-03-26 22:50        --------        d-----w-        c:\program files (x86)\Common Files\Java

2012-03-26 18:41 . 2011-11-19 15:20        5559152        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-26 18:41 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-03-26 18:41 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-03-26 07:02 . 2012-03-26 07:02        --------        d-----w-        C:\_OTL

2012-03-25 22:01 . 2012-03-25 22:01        --------        d-----w-        c:\users\scorp\AppData\Roaming\Malwarebytes

2012-03-25 22:01 . 2012-03-25 22:01        --------        d-----w-        c:\programdata\Malwarebytes

2012-03-25 21:32 . 2012-03-25 21:40        --------        d-----w-        C:\sh4ldr

2012-03-25 21:32 . 2012-03-25 21:32        --------        d-----w-        c:\program files\Enigma Software Group

2012-03-25 21:31 . 2012-03-25 21:31        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard

2012-03-25 21:28 . 2012-03-25 21:28        --------        d-----w-        c:\program files\CCleaner

2012-03-21 22:57 . 2012-03-21 23:22        8064        ----a-w-        c:\windows\system32\drivers\hidusbf.sys

2012-03-21 22:03 . 2012-03-21 22:03        --------        d-----w-        c:\users\scorp\AppData\Roaming\InstallShield

2012-03-21 22:03 . 2012-03-21 22:03        --------        d-----w-        c:\programdata\Okidata

2012-03-21 22:03 . 2012-03-21 22:03        --------        d-----w-        c:\program files\Okidata

2012-03-21 22:03 . 2009-04-13 00:19        119808        ----a-w-        c:\windows\system32\opnetext.dll

2012-03-21 22:03 . 2011-04-20 08:45        43520        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\OPLAPP3.DLL

2012-03-21 22:02 . 2009-06-25 17:00        27648        ----a-w-        c:\windows\system32\OKLMON64.DLL

2012-03-14 19:18 . 2012-03-14 19:18        --------        d-----w-        c:\programdata\ATI

2012-03-14 19:16 . 2012-03-14 19:16        --------        d-----w-        c:\program files (x86)\AMD AVT

2012-03-03 01:57 . 2012-03-03 01:57        --------        d-----w-        c:\program files (x86)\LanLights

2012-03-03 01:57 . 2004-03-08 22:00        132880        ----a-w-        c:\windows\SysWow64\Msinet.ocx

2012-03-03 01:57 . 2004-03-08 22:00        124688        ----a-w-        c:\windows\SysWow64\Mswinsck.ocx

2012-03-03 01:57 . 2004-03-08 22:00        1081616        ----a-w-        c:\windows\SysWow64\mscomctl.ocx

2012-02-28 17:15 . 2012-02-28 17:15        --------        d-----w-        c:\users\scorp\AppData\Local\Mozilla

2012-02-28 16:18 . 2012-01-18 14:56        19936        ------w-        c:\windows\system32\pwdrvio.sys

2012-02-28 16:18 . 2012-01-18 14:56        13280        ------w-        c:\windows\system32\pwdspio.sys

2012-02-28 16:18 . 2012-01-18 14:56        1013320        ----a-w-        c:\windows\system32\pwNative.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-26 22:49 . 2011-11-23 01:14        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-03-24 02:12 . 2011-12-13 20:43        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-15 03:48 . 2012-02-15 03:48        10856960        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2012-02-15 03:21 . 2012-02-15 03:21        25839104        ----a-w-        c:\windows\system32\atio6axx.dll

2012-02-15 03:18 . 2012-02-15 03:18        159744        ----a-w-        c:\windows\system32\atiapfxx.exe

2012-02-15 03:18 . 2012-02-15 03:18        791040        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2012-02-15 03:17 . 2012-02-15 03:17        957952        ----a-w-        c:\windows\system32\aticfx64.dll

2012-02-15 03:13 . 2012-02-15 03:13        442368        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2012-02-15 03:13 . 2012-02-15 03:13        496128        ----a-w-        c:\windows\system32\atieclxx.exe

2012-02-15 03:13 . 2012-02-15 03:13        235520        ----a-w-        c:\windows\system32\atiesrxx.exe

2012-02-15 03:11 . 2012-02-15 03:11        120320        ----a-w-        c:\windows\system32\atitmm64.dll

2012-02-15 03:10 . 2012-02-15 03:10        21504        ----a-w-        c:\windows\system32\atimuixx.dll

2012-02-15 03:10 . 2012-02-15 03:10        59392        ----a-w-        c:\windows\system32\atiedu64.dll

2012-02-15 03:10 . 2012-02-15 03:10        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll

2012-02-15 03:07 . 2012-02-15 03:07        6200320        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2012-02-15 02:58 . 2012-02-15 02:58        19392000        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2012-02-15 02:52 . 2012-02-15 02:52        7646208        ----a-w-        c:\windows\system32\atidxx64.dll

2012-02-15 02:41 . 2012-02-15 02:41        1113088        ----a-w-        c:\windows\system32\atiumd6v.dll

2012-02-15 02:40 . 2012-02-15 02:40        1828864        ----a-w-        c:\windows\SysWow64\atiumdmv.dll

2012-02-15 02:40 . 2012-02-15 02:40        4958208        ----a-w-        c:\windows\system32\atiumd6a.dll

2012-02-15 02:34 . 2012-02-15 02:34        51200        ----a-w-        c:\windows\system32\aticalrt64.dll

2012-02-15 02:34 . 2012-02-15 02:34        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2012-02-15 02:34 . 2012-02-15 02:34        44544        ----a-w-        c:\windows\system32\aticalcl64.dll

2012-02-15 02:34 . 2012-02-15 02:34        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2012-02-15 02:34 . 2012-02-15 02:34        5954048        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2012-02-15 02:34 . 2012-02-15 02:34        13859840        ----a-w-        c:\windows\system32\aticaldd64.dll

2012-02-15 02:29 . 2012-02-15 02:29        5062656        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2012-02-15 02:29 . 2012-02-15 02:29        11561984        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2012-02-15 02:25 . 2012-02-15 02:25        7551488        ----a-w-        c:\windows\system32\atiumd64.dll

2012-02-15 02:16 . 2011-12-13 19:23        58880        ----a-w-        c:\windows\system32\coinst.dll

2012-02-15 02:14 . 2012-02-15 02:14        512000        ----a-w-        c:\windows\system32\atiadlxx.dll

2012-02-15 02:13 . 2012-02-15 02:13        356352        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2012-02-15 02:13 . 2012-02-15 02:13        17408        ----a-w-        c:\windows\system32\atig6pxx.dll

2012-02-15 02:13 . 2012-02-15 02:13        14336        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2012-02-15 02:13 . 2012-02-15 02:13        14336        ----a-w-        c:\windows\system32\atiglpxx.dll

2012-02-15 02:13 . 2012-02-15 02:13        39936        ----a-w-        c:\windows\system32\atig6txx.dll

2012-02-15 02:13 . 2012-02-15 02:13        33280        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2012-02-15 02:13 . 2012-02-15 02:13        327680        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2012-02-15 02:12 . 2011-12-13 19:23        43008        ----a-w-        c:\windows\system32\atiuxp64.dll

2012-02-15 02:12 . 2012-02-15 02:12        33280        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2012-02-15 02:12 . 2012-02-15 02:12        39936        ----a-w-        c:\windows\system32\atiu9p64.dll

2012-02-15 02:12 . 2012-02-15 02:12        30208        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2012-02-15 02:11 . 2012-02-15 02:11        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2012-02-15 02:11 . 2012-02-15 02:11        54784        ----a-w-        c:\windows\system32\atimpc64.dll

2012-02-15 02:11 . 2012-02-15 02:11        54784        ----a-w-        c:\windows\system32\amdpcom64.dll

2012-02-15 02:11 . 2012-02-15 02:11        53760        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2012-02-15 02:11 . 2012-02-15 02:11        53760        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2012-01-31 05:02 . 2012-01-31 05:02        21504        ----a-w-        c:\windows\system32\kdbsdk64.dll

2012-01-31 05:00 . 2012-01-31 05:00        16896        ----a-w-        c:\windows\SysWow64\kdbsdk32.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-14 636032]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"LanLight"="c:\program files (x86)\LanLights\LanLights.exe" [2011-12-14 507904]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean64.exe

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 AODDriver4.1;AODDriver4.1;c:\program files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [2011-10-13 55936]

R2 AODService;AODService;c:\program files (x86)\AMD\OverDrive\AODAssist.exe [2011-10-13 136616]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 AODDriver2;AODDriver2;c:\program files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [2011-10-13 55936]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-12-09 135584]

R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\DRIVERS\hidusbf.sys [x]

R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]

R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]

R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-02-14 361984]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-01-03 55936]

S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-12-28 96896]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4285538796-3065701829-1430259361-1000Core.job

- c:\users\scorp\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-20 19:52]

.

2011-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4285538796-3065701829-1430259361-1000UA.job

- c:\users\scorp\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-20 19:52]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-03-28  11:42:38 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-03-28 09:42

.

Vor Suchlauf: 17 Verzeichnis(se), 33.950.068.736 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 33.740.267.520 Bytes frei

.

- - End Of File - - 99123DD0E28999898777DDE085972A0D

Remove Programs txt

Code:

3DMark 11

Adobe Reader X (10.1.2) - Deutsch

AMD OverDrive Beta

AMD VISION Engine Control Center

Batman Arkham City version 1.0

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Counter-Strike

DAEMON Tools Lite

Defense Grid - Gold version 1.0

Fraps

Futuremark SystemInfo

Geeks3D.com FurMark 1.9.2

ICQ7.7

Java Auto Updater

Java(TM) 6 Update 31

JDownloader

K-Lite Codec Pack 7.9.0 (Standard)

Lan Lights

marvell 61xx

Metro 2033

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Mozilla Firefox 11.0 (x86 de)

NVIDIA PhysX

OKI Network Extension

Platform

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

SpeedFan (remove only)

StarCraft II

Steam

Ubisoft Game Launcher

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

VIA Plattform-Geräte-Manager

VLC media player 2.0.1

Winamp

OTL

Code:

OTL logfile created on: 28.03.2012 15:10:02 - Run 7

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,03 Gb Available Physical Memory | 87,85% Memory free

12,50 Gb Paging File | 11,61 Gb Available in Paging File | 92,89% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,50 Gb Free Space | 56,45% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.12.15 00:28:16 | 000,507,904 | ---- | M] (Paul Mather) -- C:\Program Files (x86)\LanLights\LanLights.exe

PRC - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2012.02.14 23:16:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.03.20 23:43:00 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.12.09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidusbf.sys -- (hidusbf)

DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.01.18 16:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)

DRV:64bit: - [2012.01.18 16:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)

DRV:64bit: - [2012.01.03 23:22:54 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)

DRV:64bit: - [2011.12.14 02:03:37 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2010.05.15 20:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)

DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.12 00:49:10 | 000,178,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver4.1)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver2)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 D5 61 BC A7 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.26 20:31:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.28 19:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Extensions

[2012.03.27 15:45:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions

[2012.03.26 03:00:35 | 000,002,112 | ---- | M] () -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\searchplugins\wot-safe-search.xml

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\AUTOCOPY2@TEO.PL.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\SECURELOGIN@BLUEIMP.NET.XPI

[2012.03.26 20:31:21 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

 

O1 HOSTS File: ([2012.03.28 11:24:32 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [LanLight] C:\Program Files (x86)\LanLights\LanLights.exe (Paul Mather)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7BE62C-886B-434A-AEE5-095EFA060844}: DhcpNameServer = 192.168.178.1

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.28 11:43:10 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.03.28 09:30:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.03.28 09:30:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.03.28 09:30:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.03.28 09:29:11 | 000,000,000 | ---D | C] -- C:\aSFYT

[2012.03.27 15:56:31 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.03.27 15:51:00 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.03.27 15:47:01 | 004,447,641 | R--- | C] (Swearware) -- C:\Users\scorp\Desktop\aSFYT.exe

[2012.03.27 01:22:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\scorp\Desktop\aswMBR.exe

[2012.03.27 00:50:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.03.27 00:50:03 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 20:41:53 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.03.26 20:41:53 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.03.26 20:41:53 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.03.26 20:38:36 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll

[2012.03.26 20:38:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2012.03.26 20:38:31 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.03.26 20:38:28 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2012.03.26 20:38:28 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2012.03.26 20:38:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll

[2012.03.26 20:38:28 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2012.03.26 20:38:28 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.03.26 20:38:28 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2012.03.26 20:38:27 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2012.03.26 20:38:27 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll

[2012.03.26 20:38:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.03.26 20:38:27 | 000,918,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.03.26 20:38:27 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll

[2012.03.26 20:38:27 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2012.03.26 20:38:26 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll

[2012.03.26 20:38:26 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll

[2012.03.26 20:38:26 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll

[2012.03.26 20:38:26 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll

[2012.03.26 20:38:26 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll

[2012.03.26 20:38:25 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl

[2012.03.26 20:38:25 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl

[2012.03.26 20:38:25 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.03.26 20:38:25 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.03.26 20:38:25 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe

[2012.03.26 20:38:09 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll

[2012.03.26 20:38:09 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll

[2012.03.26 20:38:08 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll

[2012.03.26 20:38:08 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll

[2012.03.26 09:02:26 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.26 00:56:50 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.26 00:22:53 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:50 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Malwarebytes

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.03.25 23:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.25 23:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.03.25 23:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.03.22 00:57:01 | 000,008,064 | ---- | C] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 00:03:20 | 000,119,808 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\opnetext.dll

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\InstallShield

[2012.03.22 00:02:54 | 000,027,648 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\OKLMON64.DLL

[2012.03.14 21:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.03.14 21:16:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.03.14 21:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.03.07 07:44:57 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\Ugly Duckling - Moving At Breakneck Speed (2011)

[2012.03.03 03:57:56 | 001,081,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomctl.ocx

[2012.03.03 03:57:56 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Msinet.ocx

[2012.03.03 03:57:56 | 000,124,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mswinsck.ocx

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LanLights

[2012.02.28 22:07:05 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\The Way I See It [2oo8]

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Mozilla

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Local\Mozilla

[2012.02.28 19:15:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.28 15:04:17 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2012.03.28 11:24:32 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.03.28 10:13:09 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.28 10:13:09 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.28 10:10:11 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.28 10:10:11 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.28 10:10:11 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.28 10:10:11 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.28 10:10:11 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.27 15:47:16 | 004,447,641 | R--- | M] (Swearware) -- C:\Users\scorp\Desktop\aSFYT.exe

[2012.03.27 01:22:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\scorp\Desktop\aswMBR.exe

[2012.03.27 00:56:27 | 000,073,052 | ---- | M] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.27 00:49:53 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2012.03.27 00:49:53 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 21:04:16 | 000,267,440 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.26 18:34:33 | 000,302,592 | ---- | M] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:32:13 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.25 23:28:18 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.24 04:12:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 01:07:05 | 000,000,543 | ---- | M] () -- C:\Windows\NGO.cer

[2012.03.22 00:40:58 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.21 17:42:08 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.12 22:20:58 | 734,130,177 | ---- | M] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:35:55 | 1488,550,308 | ---- | M] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

 
 ========== Files Created - No Company Name ==========

 

[2012.03.28 09:30:25 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.03.28 09:30:25 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.03.28 09:30:25 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.03.28 09:30:25 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.03.28 09:30:25 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.03.27 00:56:14 | 000,073,052 | ---- | C] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.26 18:34:39 | 000,302,592 | ---- | C] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:32:13 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.03.26 02:32:13 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 01:17:27 | 000,024,576 | ---- | C] () -- C:\Users\scorp\Desktop\memtest.exe

[2012.03.22 01:07:05 | 000,000,543 | ---- | C] () -- C:\Windows\NGO.cer

[2012.03.22 00:40:58 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.22 00:03:20 | 000,003,252 | ---- | C] () -- C:\Windows\SysNative\opnedef.str

[2012.03.22 00:03:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysNative\opnetext.ver

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\opnetext.gid

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\opnetext.gid

[2012.03.12 20:20:02 | 734,130,177 | ---- | C] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:07:23 | 1488,550,308 | ---- | C] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

[2012.02.28 18:18:05 | 001,013,320 | ---- | C] () -- C:\Windows\SysNative\pwNative.exe

[2012.02.28 18:18:05 | 000,019,936 | ---- | C] () -- C:\Windows\SysNative\pwdrvio.sys

[2012.02.28 18:18:05 | 000,013,280 | ---- | C] () -- C:\Windows\SysNative\pwdspio.sys

[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2011.12.13 21:23:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.11.30 13:07:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.11.24 00:05:15 | 000,000,606 | ---- | C] () -- C:\ProgramData\ntuser.pol

[2011.11.22 19:55:38 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2011.11.21 13:37:48 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2011.11.21 13:37:48 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.11.21 13:36:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.11.20 22:22:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.20 22:18:10 | 000,007,606 | ---- | C] () -- C:\Users\scorp\AppData\Local\Resmon.ResmonCfg

[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== LOP Check ==========

 

[2012.02.02 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Auslogics

[2011.12.14 02:04:35 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\DAEMON Tools Lite

[2012.03.07 22:42:06 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\ICQ

[2011.11.23 00:01:44 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\SteelSeries Xai

[2011.11.30 18:34:07 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Ubisoft

[2009.07.14 07:08:49 | 000,009,954 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Extras

Code:

OTL Extras logfile created on: 28.03.2012 15:10:02 - Run 7

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,03 Gb Available Physical Memory | 87,85% Memory free

12,50 Gb Paging File | 11,61 Gb Available in Paging File | 92,89% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,50 Gb Free Space | 56,45% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)

http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1

http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0C818871-6337-17AC-CA8C-A3942F15D92A}" = AMD Accelerated Video Transcoding

"{353D1262-B2D2-AD87-EB5E-6B1395AF9FAE}" = AMD Catalyst Install Manager

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{54FFD5AC-7350-52B9-FB8F-1A8A6CF1FB5B}" = AMD Media Foundation Decoders

"{551F4187-F029-4240-DEF9-836B5E43CB29}" = AMD Fuel

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{D6DDB606-CD15-98C7-AA65-6B617EE8CDA5}" = ccc-utility64

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"UDK-c9ba1dda-55c3-4842-b263-4e79d8d3928a" = My Game Long Name

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02446EBD-7E93-8DB2-662A-20A8BE5630E0}" = Catalyst Control Center InstallProxy

"{025381B0-29B2-4935-88DE-96E320DB9E0B}_is1" = Defense Grid - Gold version 1.0

"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{375B0ACB-49BA-463E-96D0-E95F994DF594}" = AMD OverDrive Beta

"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension

"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German

"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish

"{4113C4B5-AF36-4984-8F57-F21F334B807D}_is1" = Metro 2033

"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek

"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian

"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech

"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional

"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard

"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7

"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish

"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian

"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish

"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian

"{B531E735-8ED5-4270-ACCE-3809086FBD02}_is1" = Batman Arkham City version 1.0

"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish

"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian

"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese

"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All

"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy

"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English

"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch

"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common

"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"DAEMON Tools Lite" = DAEMON Tools Lite

"Fraps" = Fraps

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"JDownloader" = JDownloader

"KLiteCodecPack_is1" = K-Lite Codec Pack 7.9.0 (Standard)

"Lan Lights" = Lan Lights

"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)

"mv61xxDriver" = marvell 61xx

"SpeedFan" = SpeedFan (remove only)

"StarCraft II" = StarCraft II

"Steam App 10" = Counter-Strike

"VLC media player" = VLC media player 2.0.1

"Winamp" = Winamp

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 23.02.2012 19:32:48 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl.exe, Version: 1.1.1.1, Zeitstempel:

 0x48feaf5a  Name des fehlerhaften Moduls: steam.dll, Version: 2.0.1320.120, Zeitstempel:

 0x4f442e99  Ausnahmecode: 0xc0000409  Fehleroffset: 0x001f3783  ID des fehlerhaften Prozesses:

 0x768  Startzeit der fehlerhaften Anwendung: 0x01ccf27504dc4068  Pfad der fehlerhaften

 Anwendung: c:\program files (x86)\steam\steamapps\procs27374\counter-strike\hl.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Steam\steam.dll  Berichtskennung:

 b1b6ad45-5e76-11e1-9b1a-e0cb4ec5ca56

 

Error - 01.03.2012 16:39:49 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01ccf7eb713657ac  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 b0222cf5-63de-11e1-a03e-e0cb4ec5ca56

 

Error - 21.03.2012 18:41:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: setup.exe_Microsoft IntelliType Pro

 / IntelliPoint, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Name des fehlerhaften

 Moduls: setup.exe, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Ausnahmecode: 0xc0000005

Fehleroffset:

 0x00031bf1  ID des fehlerhaften Prozesses: 0x614  Startzeit der fehlerhaften Anwendung:

 0x01cd07b3a9c78154  Pfad der fehlerhaften Anwendung: d:\eddd80f683e5e60828d51720733a\setup.exe

Pfad

 des fehlerhaften Moduls: d:\eddd80f683e5e60828d51720733a\setup.exe  Berichtskennung:

 f20688ca-73a6-11e1-8c4b-e0cb4ec5ca56

 

Error - 26.03.2012 19:01:13 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:14 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:17 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 27.03.2012 09:47:47 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d672ee4  Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.17755,

 Zeitstempel: 0x4f042c80  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a819

ID

 des fehlerhaften Prozesses: 0x8c0  Startzeit der fehlerhaften Anwendung: 0x01cd0c1faf441cf3

Pfad

 der fehlerhaften Anwendung: C:\Windows\Explorer.EXE  Pfad des fehlerhaften Moduls:

 C:\Windows\system32\SHELL32.dll  Berichtskennung: 6f8df070-7813-11e1-987e-e0cb4ec5ca56

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfFsMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfNetMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfSysMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

[ System Events ]

Error - 28.03.2012 04:06:06 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 28.03.2012 04:06:06 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Windows Defender" wurde mit folgendem Fehler beendet: 

  %%126

 

Error - 28.03.2012 04:06:46 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:   %%2

 

Error - 28.03.2012 04:07:06 | Computer Name = scorp-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 28.03.2012 05:24:05 | Computer Name = scorp-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{8B7BE62C-886B-434A-AEE5-095EFA060844} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 28.03.2012 05:24:05 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :0" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 28.03.2012 05:24:05 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 28.03.2012 09:04:32 | Computer Name = scorp-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{8B7BE62C-886B-434A-AEE5-095EFA060844} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 28.03.2012 09:04:32 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :0" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 28.03.2012 09:04:32 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

 

< End of report >

Zitat:

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
 

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

2.
Öffne CCleaner - Anleitung CCleaner

"Cleaner"->"Analysieren"->Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"-> "Fehler beheben"->"Alle beheben"
Starte dein System neu auf

3.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

4.
versuche erneut ausführen:
TDSSKiller.exe
aswMBR.exe

5.
Dateiname sagt mir nichts? Um was handelt es sich dabei? besonders die rot markierten!:

Code:

C:\Users\scorp\Desktop\vi0to8rc.exe

OTL LOG

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\scorp\Desktop\cmd.bat deleted successfully.

C:\Users\scorp\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: scorp

->Temp folder emptied: 19036538 bytes

->Temporary Internet Files folder emptied: 51387577 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 94102689 bytes

->Flash cache emptied: 1785 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 280 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 157,00 mb

 

 

OTL by OldTimer - Version 3.2.39.2 log created on 03292012_104738
 

Files\Folders moved on Reboot...

C:\Users\scorp\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Users\scorp\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OSIIVOD0\ac7[1].htm not found!
 

Registry entries deleted on Reboot...

Extras OTL

Code:

OTL Extras logfile created on: 29.03.2012 10:53:59 - Run 8

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,18 Gb Available Physical Memory | 89,77% Memory free

12,50 Gb Paging File | 11,67 Gb Available in Paging File | 93,35% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,32 Gb Free Space | 56,13% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- Reg Error: Key error.

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0C818871-6337-17AC-CA8C-A3942F15D92A}" = AMD Accelerated Video Transcoding

"{353D1262-B2D2-AD87-EB5E-6B1395AF9FAE}" = AMD Catalyst Install Manager

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{54FFD5AC-7350-52B9-FB8F-1A8A6CF1FB5B}" = AMD Media Foundation Decoders

"{551F4187-F029-4240-DEF9-836B5E43CB29}" = AMD Fuel

"{5F92DAD2-FD95-DD12-50DF-A6F66C7E67C8}" = AMD Drag and Drop Transcoding

"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant

"{D6DDB606-CD15-98C7-AA65-6B617EE8CDA5}" = ccc-utility64

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"UDK-c9ba1dda-55c3-4842-b263-4e79d8d3928a" = My Game Long Name

"WinRAR archiver" = WinRAR 4.01 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02446EBD-7E93-8DB2-662A-20A8BE5630E0}" = Catalyst Control Center InstallProxy

"{025381B0-29B2-4935-88DE-96E320DB9E0B}_is1" = Defense Grid - Gold version 1.0

"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish

"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding

"{375B0ACB-49BA-463E-96D0-E95F994DF594}" = AMD OverDrive Beta

"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension

"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German

"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish

"{4113C4B5-AF36-4984-8F57-F21F334B807D}_is1" = Metro 2033

"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace

"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek

"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian

"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech

"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional

"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard

"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7

"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish

"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian

"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish

"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian

"{B531E735-8ED5-4270-ACCE-3809086FBD02}_is1" = Batman Arkham City version 1.0

"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center

"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo

"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish

"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian

"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese

"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All

"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy

"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English

"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch

"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common

"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable

"DAEMON Tools Lite" = DAEMON Tools Lite

"Fraps" = Fraps

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"JDownloader" = JDownloader

"KLiteCodecPack_is1" = K-Lite Codec Pack 7.9.0 (Standard)

"Lan Lights" = Lan Lights

"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)

"mv61xxDriver" = marvell 61xx

"SpeedFan" = SpeedFan (remove only)

"StarCraft II" = StarCraft II

"Steam App 10" = Counter-Strike

"VLC media player" = VLC media player 2.0.1

"Winamp" = Winamp

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 23.02.2012 19:32:48 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl.exe, Version: 1.1.1.1, Zeitstempel:

 0x48feaf5a  Name des fehlerhaften Moduls: steam.dll, Version: 2.0.1320.120, Zeitstempel:

 0x4f442e99  Ausnahmecode: 0xc0000409  Fehleroffset: 0x001f3783  ID des fehlerhaften Prozesses:

 0x768  Startzeit der fehlerhaften Anwendung: 0x01ccf27504dc4068  Pfad der fehlerhaften

 Anwendung: c:\program files (x86)\steam\steamapps\procs27374\counter-strike\hl.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files (x86)\Steam\steam.dll  Berichtskennung:

 b1b6ad45-5e76-11e1-9b1a-e0cb4ec5ca56

 

Error - 01.03.2012 16:39:49 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: chrome.exe, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b76  Name des fehlerhaften Moduls: chrome.dll, Version: 16.0.912.75,

 Zeitstempel: 0x4f054b25  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001439b3  ID des fehlerhaften

 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01ccf7eb713657ac  Pfad der

 fehlerhaften Anwendung: C:\Users\scorp\AppData\Local\Google\Chrome\Application\chrome.exe

Pfad

 des fehlerhaften Moduls: C:\Users\scorp\AppData\Local\Google\Chrome\Application\16.0.912.75\chrome.dll

Berichtskennung:

 b0222cf5-63de-11e1-a03e-e0cb4ec5ca56

 

Error - 21.03.2012 18:41:07 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: setup.exe_Microsoft IntelliType Pro

 / IntelliPoint, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Name des fehlerhaften

 Moduls: setup.exe, Version: 8.0.225.0, Zeitstempel: 0x4c2db99b  Ausnahmecode: 0xc0000005

Fehleroffset:

 0x00031bf1  ID des fehlerhaften Prozesses: 0x614  Startzeit der fehlerhaften Anwendung:

 0x01cd07b3a9c78154  Pfad der fehlerhaften Anwendung: d:\eddd80f683e5e60828d51720733a\setup.exe

Pfad

 des fehlerhaften Moduls: d:\eddd80f683e5e60828d51720733a\setup.exe  Berichtskennung:

 f20688ca-73a6-11e1-8c4b-e0cb4ec5ca56

 

Error - 26.03.2012 19:01:13 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:14 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 26.03.2012 19:01:17 | Computer Name = scorp-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\scorp\Desktop\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 27.03.2012 09:47:47 | Computer Name = scorp-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d672ee4  Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.17755,

 Zeitstempel: 0x4f042c80  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a819

ID

 des fehlerhaften Prozesses: 0x8c0  Startzeit der fehlerhaften Anwendung: 0x01cd0c1faf441cf3

Pfad

 der fehlerhaften Anwendung: C:\Windows\Explorer.EXE  Pfad des fehlerhaften Moduls:

 C:\Windows\system32\SHELL32.dll  Berichtskennung: 6f8df070-7813-11e1-987e-e0cb4ec5ca56

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfFsMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfNetMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

Error - 28.03.2012 03:30:59 | Computer Name = scorp-PC | Source = Microsoft-Windows-CAPI2 | ID = 513

Description = Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts

 "System Writer".  Details: AddLegacyDriverFiles: Unable to back up image of binary

 TfSysMon.  System Error: Das System kann die angegebene Datei nicht finden.  .

 

[ System Events ]

Error - 29.03.2012 04:49:24 | Computer Name = scorp-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{8B7BE62C-886B-434A-AEE5-095EFA060844} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 29.03.2012 04:49:23 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%183

 

Error - 29.03.2012 04:49:24 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 29.03.2012 04:50:04 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:   %%2

 

Error - 29.03.2012 04:50:24 | Computer Name = scorp-PC | Source = DCOM | ID = 10016

Description = 

 

Error - 29.03.2012 04:53:42 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :0" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 29.03.2012 04:53:44 | Computer Name = scorp-PC | Source = Server | ID = 2505

Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht

 \Device\NetBT_Tcpip_{8B7BE62C-886B-434A-AEE5-095EFA060844} vom Serverdienst nicht

 gebunden werden. Der Serverdienst konnte nicht gestartet werden.

 

Error - 29.03.2012 04:53:43 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%183

 

Error - 29.03.2012 04:53:44 | Computer Name = scorp-PC | Source = NetBT | ID = 4321

Description = Der Name "SCORP-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.42  registriert werden. Der Computer mit IP-Adresse 192.168.178.24

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 29.03.2012 04:54:24 | Computer Name = scorp-PC | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:   %%2

 

 

< End of report >

OTL TXT

Code:

OTL logfile created on: 29.03.2012 10:53:59 - Run 8

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\scorp\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 7,18 Gb Available Physical Memory | 89,77% Memory free

12,50 Gb Paging File | 11,67 Gb Available in Paging File | 93,35% Paging File free

Paging file location(s): c:\pagefile.sys 4608 4608 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 55,80 Gb Total Space | 31,32 Gb Free Space | 56,13% Space Free | Partition Type: NTFS

Drive D: | 298,08 Gb Total Space | 146,60 Gb Free Space | 49,18% Space Free | Partition Type: NTFS

 

Computer Name: SCORP-PC | User Name: scorp | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

PRC - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) -- C:\Program Files (x86)\Skype\Updater\Updater.exe

PRC - [2012.02.14 23:49:08 | 000,636,032 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

PRC - [2012.01.03 15:10:46 | 000,035,736 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.12.15 00:28:16 | 000,507,904 | ---- | M] (Paul Mather) -- C:\Program Files (x86)\LanLights\LanLights.exe

PRC - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe

PRC - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2012.02.14 23:16:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.03.20 23:43:00 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Running] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.12.09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2011.10.14 00:52:36 | 000,136,616 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.28 22:33:00 | 000,096,896 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV:64bit: - [2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidusbf.sys -- (hidusbf)

DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.01.18 16:56:08 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)

DRV:64bit: - [2012.01.18 16:56:06 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)

DRV:64bit: - [2012.01.03 23:22:54 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)

DRV:64bit: - [2011.12.14 02:03:37 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.07.21 17:58:50 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2010.05.15 20:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV:64bit: - [2010.02.18 10:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)

DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)

DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.05.12 00:49:10 | 000,178,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv61xx.sys -- (mv61xx)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver4.1)

DRV - [2011.10.14 00:50:52 | 000,055,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys -- (AODDriver2)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C 04 D5 61 BC A7 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.26 20:31:21 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.28 19:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Extensions

[2012.03.28 21:04:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\extensions

[2012.03.26 03:00:35 | 000,002,112 | ---- | M] () -- C:\Users\scorp\AppData\Roaming\Mozilla\Firefox\Profiles\r9rhazz4.default\searchplugins\wot-safe-search.xml

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.03.27 00:50:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\SCORP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R9RHAZZ4.DEFAULT\EXTENSIONS\AUTOCOPY2@TEO.PL.XPI

[2012.03.26 20:31:21 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

 

O1 HOSTS File: ([2012.03.28 11:24:32 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [LanLight] C:\Program Files (x86)\LanLights\LanLights.exe (Paul Mather)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7BE62C-886B-434A-AEE5-095EFA060844}: DhcpNameServer = 192.168.178.1

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.28 21:14:31 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Skype

[2012.03.28 21:14:27 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012.03.28 21:14:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.03.28 21:14:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012.03.28 21:14:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2012.03.28 21:13:50 | 000,944,264 | ---- | C] (Skype Technologies S.A.) -- C:\Users\scorp\Desktop\SkypeSetup.exe

[2012.03.28 21:04:11 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.03.28 11:43:10 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.03.28 09:30:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.03.28 09:30:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.03.28 09:30:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.03.28 09:29:11 | 000,000,000 | ---D | C] -- C:\aSFYT

[2012.03.27 15:56:31 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.03.27 15:51:00 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.03.27 15:47:01 | 004,447,641 | R--- | C] (Swearware) -- C:\Users\scorp\Desktop\aSFYT.exe

[2012.03.27 01:22:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\scorp\Desktop\aswMBR.exe

[2012.03.27 00:50:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.03.27 00:50:03 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:50:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 20:41:53 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2012.03.26 20:41:53 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2012.03.26 20:41:53 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2012.03.26 20:38:36 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll

[2012.03.26 20:38:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2012.03.26 20:38:31 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2012.03.26 20:38:28 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2012.03.26 20:38:28 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll

[2012.03.26 20:38:28 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll

[2012.03.26 20:38:28 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2012.03.26 20:38:28 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2012.03.26 20:38:28 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2012.03.26 20:38:27 | 001,731,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2012.03.26 20:38:27 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll

[2012.03.26 20:38:27 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll

[2012.03.26 20:38:27 | 000,918,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2012.03.26 20:38:27 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll

[2012.03.26 20:38:27 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2012.03.26 20:38:26 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll

[2012.03.26 20:38:26 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll

[2012.03.26 20:38:26 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll

[2012.03.26 20:38:26 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll

[2012.03.26 20:38:26 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll

[2012.03.26 20:38:25 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl

[2012.03.26 20:38:25 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl

[2012.03.26 20:38:25 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll

[2012.03.26 20:38:25 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll

[2012.03.26 20:38:25 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe

[2012.03.26 20:38:09 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll

[2012.03.26 20:38:09 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll

[2012.03.26 20:38:08 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll

[2012.03.26 20:38:08 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll

[2012.03.26 09:02:26 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.26 00:56:50 | 002,066,480 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.26 00:22:53 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.26 00:01:50 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Malwarebytes

[2012.03.26 00:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2012.03.25 23:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.03.25 23:31:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2012.03.25 23:28:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.03.25 23:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.03.22 00:57:01 | 000,008,064 | ---- | C] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 00:03:20 | 000,119,808 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\opnetext.dll

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\Okidata

[2012.03.22 00:03:20 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\InstallShield

[2012.03.22 00:02:54 | 000,027,648 | ---- | C] (Oki Data Corporation) -- C:\Windows\SysNative\OKLMON64.DLL

[2012.03.14 21:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.03.14 21:16:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.03.14 21:16:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.03.07 07:44:57 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\Ugly Duckling - Moving At Breakneck Speed (2011)

[2012.03.03 03:57:56 | 001,081,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomctl.ocx

[2012.03.03 03:57:56 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Msinet.ocx

[2012.03.03 03:57:56 | 000,124,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mswinsck.ocx

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LanLights

[2012.03.03 03:57:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LanLights

[2012.02.28 22:07:05 | 000,000,000 | ---D | C] -- C:\Users\scorp\Desktop\The Way I See It [2oo8]

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Roaming\Mozilla

[2012.02.28 19:15:13 | 000,000,000 | ---D | C] -- C:\Users\scorp\AppData\Local\Mozilla

[2012.02.28 19:15:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.29 10:53:42 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2012.03.29 10:52:42 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.29 10:52:42 | 000,022,512 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.29 10:52:02 | 000,029,938 | ---- | M] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.29 10:47:53 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.03.29 10:47:53 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.03.29 10:47:53 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.03.29 10:47:53 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.03.29 10:47:53 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.03.28 21:14:27 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.03.28 21:13:50 | 000,944,264 | ---- | M] (Skype Technologies S.A.) -- C:\Users\scorp\Desktop\SkypeSetup.exe

[2012.03.28 11:24:32 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.03.27 15:47:16 | 004,447,641 | R--- | M] (Swearware) -- C:\Users\scorp\Desktop\aSFYT.exe

[2012.03.27 01:22:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\scorp\Desktop\aswMBR.exe

[2012.03.27 00:49:53 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2012.03.27 00:49:53 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.03.27 00:49:53 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.03.26 21:04:16 | 000,267,440 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.03.26 18:34:33 | 000,302,592 | ---- | M] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:32:13 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.26 00:22:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\scorp\Desktop\OTL.exe

[2012.03.25 23:28:18 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.24 04:12:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.03.22 01:22:27 | 000,008,064 | ---- | M] (SweetLow) -- C:\Windows\SysNative\drivers\hidusbf.sys

[2012.03.22 01:07:05 | 000,000,543 | ---- | M] () -- C:\Windows\NGO.cer

[2012.03.22 00:40:58 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.21 17:42:08 | 002,066,480 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\scorp\Desktop\TDSSKiller.exe

[2012.03.12 22:20:58 | 734,130,177 | ---- | M] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:35:55 | 1488,550,308 | ---- | M] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

 
 ========== Files Created - No Company Name ==========

 

[2012.03.28 21:14:27 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.03.28 09:30:25 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.03.28 09:30:25 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.03.28 09:30:25 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.03.28 09:30:25 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.03.28 09:30:25 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.03.27 00:56:14 | 000,029,938 | ---- | C] () -- C:\Users\scorp\Desktop\cc_20120327_005610.reg

[2012.03.26 18:34:39 | 000,302,592 | ---- | C] () -- C:\Users\scorp\Desktop\vi0to8rc.exe

[2012.03.26 02:32:13 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.03.26 02:32:13 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.03.25 23:28:18 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.03.25 01:17:27 | 000,024,576 | ---- | C] () -- C:\Users\scorp\Desktop\memtest.exe

[2012.03.22 01:07:05 | 000,000,543 | ---- | C] () -- C:\Windows\NGO.cer

[2012.03.22 00:40:58 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf

[2012.03.22 00:03:20 | 000,003,252 | ---- | C] () -- C:\Windows\SysNative\opnedef.str

[2012.03.22 00:03:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysNative\opnetext.ver

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\opnetext.gid

[2012.03.22 00:03:20 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\opnetext.gid

[2012.03.12 20:20:02 | 734,130,177 | ---- | C] () -- C:\Users\scorp\Desktop\toothfairy2-document.avi

[2012.03.12 19:07:23 | 1488,550,308 | ---- | C] () -- C:\Users\scorp\Desktop\top_gear.18x07.720p_hdtv_x264-fov.mkv

[2012.02.28 18:18:05 | 001,013,320 | ---- | C] () -- C:\Windows\SysNative\pwNative.exe

[2012.02.28 18:18:05 | 000,019,936 | ---- | C] () -- C:\Windows\SysNative\pwdrvio.sys

[2012.02.28 18:18:05 | 000,013,280 | ---- | C] () -- C:\Windows\SysNative\pwdspio.sys

[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2011.12.13 21:23:17 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll

[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.11.30 13:07:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll

[2011.11.24 00:05:15 | 000,000,606 | ---- | C] () -- C:\ProgramData\ntuser.pol

[2011.11.22 19:55:38 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll

[2011.11.21 13:37:48 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2011.11.21 13:37:48 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2011.11.21 13:36:55 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.11.20 22:22:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.11.20 22:18:10 | 000,007,606 | ---- | C] () -- C:\Users\scorp\AppData\Local\Resmon.ResmonCfg

[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

 
 ========== LOP Check ==========

 

[2012.02.02 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Auslogics

[2011.12.14 02:04:35 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\DAEMON Tools Lite

[2012.03.07 22:42:06 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\ICQ

[2011.11.23 00:01:44 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\SteelSeries Xai

[2011.11.30 18:34:07 | 000,000,000 | ---D | M] -- C:\Users\scorp\AppData\Roaming\Ubisoft

[2009.07.14 07:08:49 | 000,009,954 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

TDsskiller und das Avast Ding gehen immer noch nicht :(

Die *.exe mit dem komischen Namen ist Gmer, das hatte ich vorsichtshalber schonmal runtergeladen.

Zitat:

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
 

:Files

C:\sh4ldr

C:\Program Files\Enigma Software Group
 

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

2.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

3.
Lade dir von hier -> TrendMicro™ HijackThis™/Version 2.0.4 herunter

Zitat:

Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen" (musst du im Forum eingeloggt sein!)