Pc wird sehr sehr langsam, Virenscanner schlägt ständig Alarm Hallo,
Mein pc wird in letzter Zeit im Windows Betrieb gelegentlich extrem langsam. Dann dauert es teilweise 30 Sekunden nur um einen neuen Ordner zu öffnen. Nach einem Neustart geht dann erstmal wieder alles normal.
Zudem passiert es gelegentlich, dass mein Firefox mein normalen Surfen einfach so ein leeres Tab öffnet. Da steht oben ne URL drin, aber es öffnet sich nichts.
Zudem schlägt in letzter Zeit mein Comodo Virenscanner häufig Alarm: Code:
2012-05-29 16:56:55 C:\Users\Mark\AppData\Local\{2c561cce-aa8a-d3bb-3165-383925423d32}\n Malware@rsd62n2vh5h6 Erkennen Erfolgreich
2012-05-29 16:56:56 C:\Users\Mark\AppData\Local\{2c561cce-aa8a-d3bb-3165-383925423d32}\n Malware@#rsd62n2vh5h6 Quarantäne Erfolgreich
2012-05-30 02:01:43 c:\users\mark\appdata\local\temp\tempfiles.exe .UnclassifiedMalware@1 Erkennen Erfolgreich
2012-05-30 02:01:44 c:\Users\Mark\AppData\Local\Temp\tempfiles.exe .UnclassifiedMalware@1 Quarantäne Erfolgreich
2012-05-31 21:42:25 C:\Users\Mark\AppData\Local\Temp\mor.exe CloudBehavior.Suspicious@1 Erkennen Erfolgreich
2012-05-31 21:42:27 C:\Users\Mark\AppData\Local\Temp\mor.exe CloudBehavior.Suspicious@1 Quarantäne Erfolgreich
2012-06-01 12:54:08 c:\users\mark\appdata\local\microsoft\windows\temporary internet files\content.ie5\ehgs0rh3\7[1].exe .UnclassifiedMalware@1 Erkennen Erfolgreich
2012-06-01 12:54:09 c:\users\mark\929scamllx.exe .UnclassifiedMalware@1 Erkennen Erfolgreich
2012-06-01 12:54:10 c:\Users\Mark\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\EHGS0RH3\7[1].exe .UnclassifiedMalware@1 Quarantäne Erfolgreich
2012-06-01 12:54:11 c:\Users\Mark\929scamllx.exe .UnclassifiedMalware@1 Quarantäne Erfolgreich OTL: Code:
OTL logfile created on: 01.06.2012 13:15:25 - Run 7
OTL by OldTimer - Version 3.2.44.0 Folder = C:\Users\Mark\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,83 Gb Available Physical Memory | 70,75% Memory free
7,99 Gb Paging File | 6,54 Gb Available in Paging File | 81,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 6,77 Gb Free Space | 13,86% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 40,26 Gb Free Space | 27,48% Space Free | Partition Type: NTFS
Drive E: | 166,02 Gb Total Space | 24,93 Gb Free Space | 15,02% Space Free | Partition Type: NTFS
Drive F: | 104,43 Gb Total Space | 44,83 Gb Free Space | 42,93% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: MARK-PC | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Mark\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrB.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
========== Modules (No Company Name) ==========
========== Win32 Services (SafeList) ==========
SRV:64bit: - (Mcx2Svc) -- C:\Windows\SysNative\Mcx2Svc.dll (Microsoft Corporation)
SRV:64bit: - (RemoteAccess) -- C:\Windows\SysNative\mprdim.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (cmdAgent) -- C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (PnkBstrB) -- C:\Windows\SysWOW64\PnkBstrB.exe ()
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (CLPSLS) -- C:\Programme\COMODO\COMODO GeekBuddy\CLPSLS.exe (COMODO)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (postgresql-8.4) -- F:\poker\PostgreSQL\8.4\bin\pg_ctl.exe (PostgreSQL Global Development Group)
SRV - (RemoteAccess) -- C:\Windows\SysWOW64\mprdim.dll (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (cmderd) -- C:\Windows\SysNative\drivers\cmderd.sys (COMODO)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (udfs) -- C:\Windows\SysNative\drivers\udfs.sys (Microsoft Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (XENfiltv) -- C:\Windows\SysNative\drivers\XENfiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (crcdisk) -- C:\Windows\SysNative\drivers\crcdisk.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (smserial) -- C:\Windows\SysNative\drivers\SmSerl64.sys (Motorola Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (netw5v64) Intel(R) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {95289393-33EA-4F8D-B952-483415B9C955}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{95289393-33EA-4F8D-B952-483415B9C955}: "URL" = hxxp://search.qip.ru/?query={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arccosine.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 45 8B 12 10 59 D1 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=PV&apn_dtid=&apn_uid=075E2621-641D-477B-BDD4-ED7DDA2B1FBD&apn_sauid=6C4D9A78-46E6-4562-AA58-961154F5BC05
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{95289393-33EA-4F8D-B952-483415B9C955}: "URL" = hxxp://search.qip.ru/?query={searchTerms}
IE - HKCU\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:62141
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.6
FF - prefs.js..extensions.enabledItems: handfire@thehandconverter.com:0.1.5
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.9.1.14019
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: bug489729@alice0775:1.3
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..keyword.URL: "hxxp://www.arccosine.com/search.php?q="
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@hanbiton.com/HbsMozillaLauncher: C:\ProgramData\hanbitsoft\nphlauncher.dll (hanbitsoft)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.23 15:45:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.01.09 17:04:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.25 18:18:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.29 22:34:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.01.29 22:34:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.01.29 22:34:17 | 000,000,000 | ---D | M]
[2010.04.01 07:58:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mark\AppData\Roaming\mozilla\Extensions
[2010.04.01 07:58:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mark\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.05.18 11:58:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions
[2011.06.12 15:27:55 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.04.25 21:54:40 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\battlefieldplay4free@ea.com
[2011.04.21 02:55:55 | 000,000,000 | ---D | M] ("bug489729") -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\bug489729@alice0775
[2010.04.07 20:16:34 | 000,000,000 | ---D | M] ("Handfire") -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\handfire@thehandconverter.com
[2012.05.18 11:58:49 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\ich@maltegoetz.de
[2012.03.28 00:08:13 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\mfzfdpv8.default\extensions\vshare@toolbar
[2012.01.01 19:36:36 | 000,002,391 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\askcom.xml
[2012.05.26 01:14:25 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-1.xml
[2010.11.27 01:00:16 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-10.xml
[2010.12.13 02:29:21 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-11.xml
[2011.03.03 23:07:03 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-12.xml
[2011.03.06 16:34:28 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-13.xml
[2011.03.25 17:02:54 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-14.xml
[2011.04.07 02:45:18 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-15.xml
[2011.06.21 22:15:09 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-16.xml
[2011.08.17 20:01:20 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-17.xml
[2011.09.01 12:55:32 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-18.xml
[2011.09.07 18:37:18 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-19.xml
[2010.06.24 19:05:13 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-2.xml
[2011.09.11 19:32:34 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-20.xml
[2011.10.01 15:39:17 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-21.xml
[2011.10.06 16:14:07 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-22.xml
[2011.11.08 20:39:13 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-23.xml
[2012.01.01 19:39:32 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-24.xml
[2012.01.07 20:02:16 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-25.xml
[2012.01.11 02:30:15 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-26.xml
[2012.02.12 04:15:30 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-27.xml
[2012.02.18 15:29:11 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-28.xml
[2012.03.17 20:30:26 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-29.xml
[2010.07.21 16:11:32 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-3.xml
[2010.07.24 16:16:13 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-4.xml
[2010.09.08 23:12:23 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-5.xml
[2010.09.17 11:51:16 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-6.xml
[2010.10.20 15:19:19 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-7.xml
[2010.10.28 20:20:11 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-8.xml
[2010.10.30 12:11:41 | 000,000,950 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin-9.xml
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\icqplugin.xml
[2011.06.13 13:32:41 | 000,002,062 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\qip-search.xml
[2011.10.15 19:46:15 | 000,003,915 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\mfzfdpv8.default\searchplugins\sweetim.xml
[2012.01.11 02:30:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.01.10 21:39:25 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\MARK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MFZFDPV8.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.08.20 15:45:13 | 000,090,116 | ---- | M] () (No name found) -- C:\USERS\MARK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MFZFDPV8.DEFAULT\EXTENSIONS\{DD05FD3D-18DF-4CE4-AE53-E795339C5F01}.XPI
[2012.03.16 19:00:41 | 000,029,003 | ---- | M] () (No name found) -- C:\USERS\MARK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MFZFDPV8.DEFAULT\EXTENSIONS\GROOVESHARKUNLOCKER@OVERLORD1337.XPI
[2012.05.03 02:05:58 | 000,009,961 | ---- | M] () (No name found) -- C:\USERS\MARK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MFZFDPV8.DEFAULT\EXTENSIONS\YOUTUBEQUALITY@RZLL.XPI
[2012.04.25 18:18:31 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.07.11 23:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.02.20 02:55:18 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.20 18:41:34 | 000,005,142 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\arccosine.xml
[2012.02.20 02:55:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.20 02:55:18 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.02.28 21:00:31 | 000,002,046 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2012.02.20 02:55:18 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.20 02:55:18 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.20 02:55:18 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - Extension: No name found = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: No name found = C:\Users\Mark\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
O1 HOSTS File: ([2012.01.27 02:51:58 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [COMODO] C:\Programme\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Programme\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - e:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - f:\poker\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - f:\poker\PartyGaming\PartyPoker\RunApp.exe ()
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A25F6BA-D8E7-4EA0-9407-9F8E5E0EA8CA}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A25F6BA-D8E7-4EA0-9407-9F8E5E0EA8CA}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BFBC0C73-8713-4369-8AD9-1C5E85151453}: DhcpNameServer = 134.76.10.46 134.76.33.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BFBC0C73-8713-4369-8AD9-1C5E85151453}: NameServer = 8.26.56.26,156.154.70.22
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.05.31 22:22:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Scanneu
[2012.05.31 22:20:52 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Mark\Desktop\OTL.exe
[2012.05.31 22:16:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.05.31 22:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle
[2012.05.20 18:41:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google Books Downloader
[2012.05.20 15:51:02 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\DVDVideoSoft
[2012.05.20 15:50:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.05.20 15:50:45 | 002,557,952 | ---- | C] (Nokia Corporation and/or its subsidiary(-ies)) -- C:\Windows\SysWow64\QtCore4.dll
[2012.05.20 15:50:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2012.05.20 15:50:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2012.05.20 15:50:01 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\DVDVideoSoft
[2012.05.15 19:53:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.05.15 19:52:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.05.15 19:50:10 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.05.15 19:50:10 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.05.15 19:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.05.15 19:38:57 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.05.15 18:27:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.15 18:26:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.06.01 13:19:01 | 001,474,832 | ---- | M] () -- C:\Windows\SysNative\drivers\sfi.dat
[2012.06.01 13:14:55 | 000,000,000 | ---- | M] () -- C:\Users\Mark\defogger_reenable
[2012.06.01 13:10:58 | 000,007,108 | ---- | M] () -- C:\Users\Mark\Desktop\comodo virenliste.htm
[2012.06.01 12:59:16 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.01 12:59:16 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.01 12:49:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.01 12:49:05 | 3217,195,008 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.31 22:20:52 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Mark\Desktop\OTL.exe
[2012.05.31 22:20:46 | 000,050,477 | ---- | M] () -- C:\Users\Mark\Desktop\Defogger(1).exe
[2012.05.31 22:13:33 | 001,644,414 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.31 22:13:33 | 000,708,168 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.05.31 22:13:33 | 000,661,724 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.31 22:13:33 | 000,153,622 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.05.31 22:13:33 | 000,125,810 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.26 02:35:51 | 000,022,997 | ---- | M] () -- C:\Users\Mark\Desktop\Star_Sheriffs_Saber_Rider-1_article.jpg
[2012.05.22 13:58:32 | 000,011,031 | ---- | M] () -- C:\Users\Mark\Desktop\typiskveckadaniel.odt
[2012.05.20 19:23:19 | 004,026,945 | ---- | M] () -- C:\Users\Mark\Desktop\5yBNGDTwywwC.pdf
[2012.05.20 15:50:46 | 000,001,409 | ---- | M] () -- C:\Users\Mark\Desktop\Free Audio CD to MP3 Converter.lnk
[2012.05.15 18:57:54 | 000,000,718 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.09 18:54:01 | 000,301,768 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.06.01 13:14:55 | 000,000,000 | ---- | C] () -- C:\Users\Mark\defogger_reenable
[2012.06.01 13:10:58 | 000,007,108 | ---- | C] () -- C:\Users\Mark\Desktop\comodo virenliste.htm
[2012.05.31 22:20:45 | 000,050,477 | ---- | C] () -- C:\Users\Mark\Desktop\Defogger(1).exe
[2012.05.26 02:35:47 | 000,022,997 | ---- | C] () -- C:\Users\Mark\Desktop\Star_Sheriffs_Saber_Rider-1_article.jpg
[2012.05.22 13:35:48 | 000,011,031 | ---- | C] () -- C:\Users\Mark\Desktop\typiskveckadaniel.odt
[2012.05.20 19:23:18 | 004,026,945 | ---- | C] () -- C:\Users\Mark\Desktop\5yBNGDTwywwC.pdf
[2012.05.20 15:50:46 | 000,001,409 | ---- | C] () -- C:\Users\Mark\Desktop\Free Audio CD to MP3 Converter.lnk
[2012.05.15 18:27:53 | 000,000,718 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.02.29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.02.03 02:23:20 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.02.02 01:03:03 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2012.01.27 02:42:32 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.01.27 02:42:32 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.01.27 02:42:32 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.01.27 02:42:32 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.01.27 02:42:32 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.11.04 02:06:36 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.11.04 02:06:36 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.08.10 02:55:50 | 000,001,801 | ---- | C] () -- C:\Windows\XENcfg.ini
[2011.08.10 02:55:48 | 000,182,272 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.08.10 02:55:48 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.08.04 13:52:26 | 000,000,000 | ---- | C] () -- C:\Users\Mark\AppData\Local\{CF698085-65E6-4531-95B8-E936CDB73A9A}
[2011.06.13 02:04:32 | 000,000,092 | ---- | C] () -- C:\Users\Mark\AppData\Local\fusioncache.dat
[2011.05.25 01:09:57 | 001,622,308 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.11.15 01:36:43 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.11.15 01:36:42 | 002,373,712 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.08.03 15:28:00 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
========== LOP Check ==========
[2011.03.24 21:28:38 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\.minecraft
[2011.03.21 04:56:41 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\.minecraft server
[2011.11.05 15:10:59 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\29FB9
[2011.11.08 19:56:17 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\34B99
[2011.11.07 02:19:59 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\9976C
[2011.05.05 17:09:41 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Canneverbe Limited
[2012.05.20 15:51:03 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\DVDVideoSoft
[2011.01.08 05:11:50 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\EBookSys
[2011.06.17 16:59:35 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\HLSW
[2012.06.01 13:13:49 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\ICQ
[2012.02.18 15:25:45 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\ICQ Search
[2011.07.21 00:12:31 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Intermedia Software
[2011.07.24 14:19:52 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Leadertech
[2011.05.23 01:30:55 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\LolClient
[2010.07.27 11:24:52 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\OpenOffice.org
[2011.06.12 15:28:16 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\QIP
[2011.06.12 15:28:07 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\QipGuard
[2012.01.11 02:36:24 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\RayV
[2010.04.01 08:05:25 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Thunderbird
[2012.04.24 00:47:32 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\TS3Client
[2011.07.20 01:54:53 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\ts3overlay
[2011.07.04 18:55:26 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Unity
[2012.04.12 13:10:27 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:6378B6B8
< End of report > Der Defrogger hat mir folgendes gesagt: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:14 on 01/06/2012 (Mark)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=- Der letzte Malewarebytes Scan hat folgendes ergeben: Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.05.29.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Mark :: MARK-PC [Administrator]
Schutz: Aktiviert
29.05.2012 18:34:48
mbam-log-2012-05-29 (18-34-48).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 419277
Laufzeit: 1 Stunde(n), 13 Minute(n), 51 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 6
C:\Users\Mark\AppData\Local\hcfdredx.exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CO6ZA8P7\soft3[1].exe (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KTI9HA1V\soft4[1].exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Mark\AppData\Local\Temp\msimg32.dll (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Mark\Desktop\Downloads\SoftonicDownloader_fuer_dark-agility-visual-style.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Mark\Desktop\Downloads\SoftonicDownloader_fuer_openal.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende) Vielen Dank schonmal für die Hilfe :) |