Trojaner-Board - Pc zwischendurch sehr langsam - Pc wird auf einmal aktiv

Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Pc zwischendurch sehr langsam - Pc wird auf einmal aktiv (https://www.trojaner-board.de/87516-pc-zwischendurch-sehr-langsam-pc-einmal-aktiv.html)

Schaaf

23.06.2010 19:18

Pc zwischendurch sehr langsam - Pc wird auf einmal aktiv

Hallo Leute, seit einigen Tagen, wenn ich den Computer gesperrt habe, wird der Bildschirm schwarz ( Bildschirmschoner) und dann auf einmal geht der Bildschirm einfach wieder an, bzw. der PC fängt an zu "gurgeln" ist das normal ?

mein 2. problem ist, dass mein Pc zwischendurch seeeehr langsam wird. Warum weiß ich auch nicht.

mein 3. problem ist, dass sich nach dem Systemstart ein Fenster öffnet, wo drin steht, dass die Datei "RamMemChck2" nicht gestartet werden konnte. Das Fenster ist gleich 5 oder 6 mal offen.

BS ist Win7

Weiter Informationen kann ich gerne angeben, wenn gebraucht wird.

Hier Hijack File:

HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:08:29, on 23.06.2010

Platform: Windows 7  (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

D:\Programme\AVG\avgtray.exe

D:\Programme\iTunes\iTunesHelper.exe

D:\Programme\Steam\Steam.exe

D:\Programme\Skype\Phone\Skype.exe

D:\Programme\ICQ7.0\ICQ.exe

D:\Programme\Skype\Plugin Manager\skypePM.exe

D:\Programme\Mozilla Firefox\firefox.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\SearchFilterHost.exe

D:\Programme\HJ\Trend Micro\HiJackThis\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ht**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Programme\AVG\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\JavaEditor\JDK\jr6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] D:\PROGRA~1\AVG\avgtray.exe

O4 - HKLM\..\Run: [iTunesHelper] "D:\Programme\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Steam] "d:\programme\steam\steam.exe" -silent

O4 - HKCU\..\Run: [Skype] "D:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ICQ] "D:\Programme\ICQ7.0\ICQ.exe" silent loginmode=4

O4 - HKLM\..\Policies\Explorer\Run: [RamMemory Check Updater] C:\Program Files\RamMemory CheckV2\RamMemChck2

O4 - HKCU\..\Policies\Explorer\Run: [RamMemory Check Updater] C:\Program Files\RamMemory CheckV2\RamMemChck2

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - D:\Programme\ICQ7.0\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - D:\Programme\ICQ7.0\ICQ.exe

O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - h**p://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Programme\AVG\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - D:\Programme\AVG\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - D:\Programme\AVG\avgwdsvc.exe

O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
 

--

End of file - 5601 bytes

--- --- ---

cosinus

24.06.2010 09:08

Hallo und :hallo:

bitte nen Vollscan mit malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Schaaf

24.06.2010 18:02

Einmal MB:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Datenbank Version: 4233

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

24.06.2010 18:48:07

mbam-log-2010-06-24 (18-48-07).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\

Durchsuchte Objekte: 462185

Laufzeit: 1 Stunde(n), 0 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 1

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 4

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3h2v04j1-lu75-4sy8-72cj-2xar1g28i8u2} (Generic.Bot.H) -> No action taken.

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)

Infizierte Dateien:

C:\Users\XXXX\AppData\Roaming\cglogs.dat (Malware.Trace) -> No action taken.

C:\Users\XXXX\AppData\Local\Temp\MSN.abc (Malware.Trace) -> No action taken.

C:\Users\XXXX\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> No action taken.

C:\Users\XXXX\AppData\Local\Temp\xxxyyyzzz.dat (Malware.Trace) -> No action taken.

OTL Logfile:

Code:

OTL logfile created on: 24.06.2010 18:49:29 - Run 1

OTL by OldTimer - Version 3.2.7.0     Folder = C:\Users\XXXX\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free

4,00 Gb Paging File | 2,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,65 Gb Total Space | 65,15 Gb Free Space | 66,71% Space Free | Partition Type: NTFS

Drive D: | 833,85 Gb Total Space | 565,84 Gb Free Space | 67,86% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: XXXX

Current User Name: XXXX

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\XXXX\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

PRC - D:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)

PRC - D:\Programme\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\AVG\avgrsx.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\AVG\avgnsx.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\AVG\avgchsvx.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\AVG\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\Steam\Steam.exe (Valve Corporation)

PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

PRC - D:\Programme\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\XXXX\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)

MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)

MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)

MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)

MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)

MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)

MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)

MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)

MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)

MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)

MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (Akamai) -- c:\Programme\Common Files\Akamai\rswin_3725.dll ()

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)

SRV - (avg9emc) -- D:\Programme\AVG\avgemc.exe (AVG Technologies CZ, s.r.o.)

SRV - (avg9wd) -- D:\Programme\AVG\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (getPlusHelper) getPlus(R) -- C:\Programme\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)

SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)

SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)

SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)

SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)

SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)

SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)

SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)

SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)

SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)

SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)

SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)

SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)

SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (AvgTdiX) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgMfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)

DRV - (AvgLdx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)

DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)

DRV - (AtcL001) -- C:\Windows\System32\drivers\l160x86.sys (Atheros Communications, Inc.)

DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)

DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)

DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)

DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)

DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)

DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)

DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)

DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)

DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)

DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)

DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)

DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)

DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)

DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)

DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)

DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)

DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)

DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)

DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)

DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)

DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)

DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)

DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)

DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)

DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)

DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)

DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)

DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)

DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)

DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)

DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)

DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)

DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)

DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)

DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)

DRV - (Brserid) Brother MFC-Seriellschnittstellentreiber (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)

DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)

DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)

DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)

DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)

DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)

DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)

DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)

DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)

DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)

DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)

DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)

DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)

DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)

DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)

DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)

DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)

DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)

DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (BrUsbMdm) Brother MFC-nur-Fax-Modem (USB) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) Brother MFC-WDM-Treiber (USB,seriell) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)

DRV - (BrSerWdm) Brother WDM-Treiber (seriell) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)

DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)

DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)

DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)

DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = h**p://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 38 A2 7B 51 BD BF CA 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "h**p://www.wieistmeineip.de/start/"

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: D:\Programme\AVG\Firefox [2010.06.03 13:28:19 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: D:\Programme\Mozilla Firefox\components [2010.05.01 11:35:05 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2010.05.03 19:46:57 | 000,000,000 | ---D | M]

 

[2010.03.09 21:26:16 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\mozilla\Extensions

[2010.05.04 17:42:58 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\mozilla\Firefox\Profiles\v9q1qdrl.default\extensions

[2010.05.04 17:42:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXX\AppData\Roaming\mozilla\Firefox\Profiles\v9q1qdrl.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

 

O1 HOSTS File: ([2010.04.15 20:01:49 | 000,001,306 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O1 - Hosts: 127.0.0.1 ereg.adobe.com

O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1 wip3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com

O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1 activate-sea.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Programme\AVG\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\JavaEditor\JDK\jr6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [AVG9_TRAY] D:\Programme\AVG\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKCU..\Run: [ICQ] D:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)

O4 - HKCU..\Run: [Steam] d:\programme\steam\steam.exe (Valve Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - D:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - D:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} h**p://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Programme\AVG\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.06.24 17:12:52 | 000,000,000 | ---D | C] -- C:\Users\XXXXXX\AppData\Roaming\Malwarebytes

[2010.06.24 17:12:43 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.06.24 17:12:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010.06.24 17:12:41 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.06.24 17:12:41 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.06.24 17:11:49 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\XXXX\Desktop\OTL.exe

[2010.06.23 22:25:38 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe

[2010.06.23 22:25:38 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll

[2010.06.23 22:25:38 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll

[2010.06.23 18:02:42 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll

[2010.06.23 18:02:42 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll

[2010.06.23 18:02:42 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax

[2010.06.23 18:02:42 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax

[2010.06.20 21:59:36 | 000,000,000 | ---D | C] -- C:\Programme\QS

[2010.06.20 12:05:05 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt

[2010.06.19 21:37:59 | 000,000,000 | ---D | C] -- C:\Programme\iPod

[2010.06.19 21:35:11 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour

[2010.06.19 12:06:15 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\LolClient

[2010.06.17 16:32:02 | 000,000,000 | -HSD | C] -- C:\found.000

[2010.06.12 22:22:28 | 000,000,000 | -H-D | C] -- C:\$AVG

[2010.06.11 22:20:16 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\PunkBuster

[2010.06.11 15:24:04 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Desktop\Counter-Strike Source NEU

[2010.06.10 13:24:02 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[2010.06.10 13:24:02 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2010.06.10 13:24:01 | 002,326,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2010.06.10 13:24:00 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll

[2010.06.10 13:23:53 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2010.06.10 13:23:52 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2010.06.10 13:23:52 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2010.06.10 13:23:52 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2010.06.07 17:28:06 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\BayWatcher Pro

[2010.06.06 18:27:37 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Desktop\Neuer Ordner (3)

[2010.06.03 14:57:21 | 000,000,000 | ---D | C] -- C:\ProgramData\TmForever

[2010.06.03 14:57:20 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Documents\TmForever

[2010.06.03 14:30:44 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\FOG Downloader

[2010.05.30 01:26:48 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DivX Shared

[2010.05.30 01:26:23 | 000,000,000 | ---D | C] -- C:\Programme\DivX

[2010.05.30 01:26:08 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX

[2010.05.29 18:26:19 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Desktop\Neuer Ordner

[2010.05.29 16:24:42 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\Atari

[2010.05.29 16:22:04 | 000,098,304 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll

[2010.05.29 15:47:37 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Documents\RCT3

[2010.05.29 15:47:37 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Documents\My Pictures

[2010.05.29 15:47:37 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Documents\My Music

[2010.05.29 15:47:20 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PocketSoft

[2010.05.26 17:58:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2010.05.25 19:14:05 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Synchronization Services

[2010.05.25 19:14:05 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server Compact Edition

[2010.05.25 19:12:56 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Documents\Visual Studio 2008

[2010.05.25 19:12:35 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\Microsoft Help

[2010.05.25 19:11:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help

[2010.05.25 19:10:56 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SDKs

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.06.24 18:49:17 | 002,359,296 | -HS- | M] () -- C:\Users\XXXX\ntuser.dat

[2010.06.24 18:17:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010.06.24 17:15:53 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2010.06.24 17:15:53 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2010.06.24 17:13:18 | 061,375,936 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm

[2010.06.24 17:12:45 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.06.24 17:11:52 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\XXXX\Desktop\OTL.exe

[2010.06.24 17:07:37 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010.06.24 17:07:28 | 1609,965,568 | -HS- | M] () -- C:\hiberfil.sys

[2010.06.23 22:24:43 | 001,050,628 | -H-- | M] () -- C:\Users\XXXX\AppData\Local\IconCache.db

[2010.06.23 20:07:58 | 000,002,967 | ---- | M] () -- C:\Users\XXXX\Desktop\HiJackThis.lnk

[2010.06.21 17:26:34 | 000,001,690 | ---- | M] () -- C:\Users\XXXX\Desktop\launcher_config.xml

[2010.06.19 21:38:43 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.06.19 11:54:13 | 000,001,125 | ---- | M] () -- C:\Users\XXXX\Desktop\lol.launcher - Verknüpfung.lnk

[2010.06.16 22:27:57 | 000,001,265 | -H-- | M] () -- C:\Users\XXXX\AppData\Roaming\cglogs.dat

[2010.06.16 22:16:44 | 000,511,622 | ---- | M] () -- C:\Users\XXXX\Desktop\49ad61177636a,ELECTRO.jpg

[2010.06.13 19:36:33 | 005,680,622 | ---- | M] () -- C:\Users\XXXX\Desktop\12.-david-meshow---unfinished-dream.mp3

[2010.06.13 18:52:41 | 000,022,328 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2010.06.13 16:35:25 | 001,472,002 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010.06.13 16:35:25 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2010.06.13 16:35:25 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010.06.13 16:35:25 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2010.06.13 16:35:25 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010.06.12 22:02:12 | 000,000,017 | ---- | M] () -- C:\Users\XXXX\AppData\Local\resmon.resmoncfg

[2010.06.10 19:06:38 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010.06.03 14:57:20 | 000,000,000 | ---- | M] () -- C:\Windows\System32\Nadeo.ini

[2010.06.02 18:55:12 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys

[2010.06.02 18:55:11 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys

[2010.05.29 16:22:04 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll

[2010.05.27 09:24:13 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll

[2010.05.27 05:49:37 | 000,293,888 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.06.24 17:12:45 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.06.23 20:07:58 | 000,002,967 | ---- | C] () -- C:\Users\XXXX\Desktop\HiJackThis.lnk

[2010.06.21 17:32:30 | 000,001,690 | ---- | C] () -- C:\Users\XXXX\Desktop\launcher_config.xml

[2010.06.19 21:38:43 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.06.19 11:54:13 | 000,001,125 | ---- | C] () -- C:\Users\XXXX\Desktop\lol.launcher - Verknüpfung.lnk

[2010.06.16 22:16:40 | 000,511,622 | ---- | C] () -- C:\Users\XXXX\Desktop\49ad61177636a,ELECTRO.jpg

[2010.06.13 19:35:54 | 005,680,622 | ---- | C] () -- C:\Users\XXXX\Desktop\12.-david-meshow---unfinished-dream.mp3

[2010.06.12 22:02:12 | 000,000,017 | ---- | C] () -- C:\Users\XXXX\AppData\Local\resmon.resmoncfg

[2010.06.12 06:15:42 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2010.06.11 22:21:04 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2010.06.11 22:20:28 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2010.06.03 14:57:20 | 000,000,000 | ---- | C] () -- C:\Windows\System32\Nadeo.ini

[2010.05.29 15:47:20 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll

[2010.05.24 17:10:51 | 000,000,051 | ---- | C] () -- C:\Windows\turnier.ini

[2010.03.13 23:35:06 | 000,722,416 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys

[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2004.08.13 10:56:20 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys

[2002.10.06 20:42:57 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll

[2002.10.05 01:04:25 | 000,921,600 | ---- | C] () -- C:\Windows\System32\vorbisenc.dll

[2002.10.05 01:04:24 | 000,188,416 | ---- | C] () -- C:\Windows\System32\vorbis.dll

[2002.10.05 01:04:17 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ogg.dll

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 24.06.2010 18:49:29 - Run 1

OTL by OldTimer - Version 3.2.7.0     Folder = C:\Users\XXXX\Desktop

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free

4,00 Gb Paging File | 2,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,65 Gb Total Space | 65,15 Gb Free Space | 66,71% Space Free | Partition Type: NTFS

Drive D: | 833,85 Gb Total Space | 565,84 Gb Free Space | 67,86% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: XXXX

Current User Name: XXXX

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32

"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler

"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4

"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour

"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4

"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup

"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4

"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4

"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{32A3A4F4-B792-11D6-A78A-00B0D0160200}" = Java(TM) SE Development Kit 6 Update 20

"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4

"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4

"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4

"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll

"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin

"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call

"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4

"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support

"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 9.14n, 2010.04.15

"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{77E11F30-D659-4542-A567-0F993C1C19D3}" = Command and Conquer - Tiberian Sun

"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes

"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4

"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4

"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3

"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2

"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4

"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect

"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support

"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4

"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module

"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT

"{C07B8BC4-AFD9-3AA4-BDF5-330A07591FDE}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework

"{C2E5BF6B-2DB2-4D18-BB27-75C20CC35A96}" = Die Siedler 7 DEMO

"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4

"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™

"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{D3492D9E-7FBB-1DF6-F759-2A37FA231031}" = Nero 7 Demo

"{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}" = NVIDIA PhysX

"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager

"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU

"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4

"{EA926717-CE5A-4CB4-AB21-9E6E9565A458}" = RCT3 Soaked

"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help

"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT: SOVIET ASSAULT

"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials

"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4

"Akamai" = Akamai NetSession Interface

"AVG9Uninstall" = AVG Free 9.0

"BayWatcher Pro_is1" = BayWatcher Pro - Deinstallation

"Bejeweled Twist" = Bejeweled Twist

"Coffee Rush" = Coffee Rush

"Diamantenfee 2" = Diamantenfee 2

"DivX Setup.divx.com" = DivX-Setup

"DSGPlayer" = DEUTSCHLAND SPIELT GAME CENTER

"Duel Masters_is1" = Duel Masters Civilizations

"Geheime Fälle: Auf den Spuren von Casanova" = Geheime Fälle: Auf den Spuren von Casanova

"League of Legends_is1" = League of Legends

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)

"Notepad++" = Notepad++

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"NVIDIA Drivers" = NVIDIA Drivers

"OggDS" = Direct Show Ogg Vorbis Filter (remove only)

"PokerStars" = PokerStars

"PokerStars.net" = PokerStars.net

"ST6UNST #1" = NFS Underground 2 Mega Trainer

"Steam App 10" = Counter-Strike

"Steam App 205" = Source Dedicated Server

"Steam App 211" = Source SDK

"Steam App 215" = Source SDK Base

"Steam App 240" = Counter-Strike: Source

"Steam App 300" = Day of Defeat: Source

"Steam App 400" = Portal

"Stonechecker 3_is1" = Stonechecker 3 L

"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"TmUnited_is1" = TrackMania United 0.2.0.8

"TmUnitedForever_is1" = TmUnitedForever Update 2010-03-15

"Warcraft III" = Warcraft III

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

"WMTurnier_is1" = WMTurnier 1.0.0

"World of Warcraft" = World of Warcraft

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

"Octoshape Streaming Services" = Octoshape Streaming Services

"Warcraft III" = Warcraft III: All Products

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 18.06.2010 09:19:57 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 2527

 

Error - 18.06.2010 09:19:57 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 2527

 

Error - 18.06.2010 09:19:58 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 18.06.2010 09:19:58 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 3525

 

Error - 18.06.2010 09:19:58 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 3525

 

Error - 18.06.2010 09:19:59 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 18.06.2010 09:19:59 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 4524

 

Error - 18.06.2010 09:19:59 | Computer Name = XXXX | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 4524

 

Error - 19.06.2010 11:52:51 | Computer Name = XXXX | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: hl2.exe, Version: 0.0.0.0, Zeitstempel:

 0x4445c334  Name des fehlerhaften Moduls: datacache.dll, Version: 0.0.0.0, Zeitstempel:

 0x46439c7b  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000b423  ID des fehlerhaften Prozesses:

 0x1470  Startzeit der fehlerhaften Anwendung: 0x01cb0fc49598a46d  Pfad der fehlerhaften

 Anwendung: d:\programme\steam\steamapps\XXXXX\counter-strike source\hl2.exe

Pfad

 des fehlerhaften Moduls: d:\programme\steam\steamapps\XXXXX\counter-strike

 source\bin\datacache.dll  Berichtskennung: b6db7c27-7bba-11df-86f8-001a92b111d6

 

Error - 19.06.2010 12:54:01 | Computer Name = XXXX | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files\Common

 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei

 "c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.

Der

 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

[ Media Center Events ]

Error - 08.06.2010 14:11:12 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 20:11:12 - Fehler beim Herstellen der Internetverbindung.  20:11:12 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 08.06.2010 14:11:21 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 20:11:19 - Fehler beim Herstellen der Internetverbindung.  20:11:19 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 13:03:27 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 19:03:27 - Fehler beim Herstellen der Internetverbindung.  19:03:27 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 13:03:40 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 19:03:36 - Fehler beim Herstellen der Internetverbindung.  19:03:36 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 14:04:27 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 20:04:27 - Fehler beim Herstellen der Internetverbindung.  20:04:27 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 14:04:41 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 20:04:37 - Fehler beim Herstellen der Internetverbindung.  20:04:37 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 15:04:55 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 21:04:55 - Fehler beim Herstellen der Internetverbindung.  21:04:55 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 15:05:08 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 21:05:04 - Fehler beim Herstellen der Internetverbindung.  21:05:04 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 16:06:06 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 22:06:04 - Fehler beim Herstellen der Internetverbindung.  22:06:05 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 12.06.2010 16:07:32 | Computer Name = XXXX | Source = MCUpdate | ID = 0

Description = 22:06:19 - Fehler beim Herstellen der Internetverbindung.  22:06:19 

-     Serververbindung konnte nicht hergestellt werden..  

 

[ System Events ]

Error - 22.06.2010 04:49:10 | Computer Name = XXXX | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = PNRPSvc | ID = 102

Description = 

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = PNRPSvc | ID = 102

Description = 

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 22.06.2010 04:49:25 | Computer Name = XXXX | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

Error - 22.06.2010 05:54:34 | Computer Name = XXXX | Source = PNRPSvc | ID = 102

Description = 

 

Error - 22.06.2010 05:54:34 | Computer Name = XXXX | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler

 beendet:   %%-2140993535

 

Error - 22.06.2010 05:54:34 | Computer Name = XXXX | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name

 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 

wurde:   %%-2140993535

 

 

< End of report >

--- --- ---

cosinus

24.06.2010 20:16

Hast Du Laufwerk D: nicht gescannt?

Schaaf

24.06.2010 20:58

Eigentlich schon.

#edit: Habe ich

"Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)"

Das Laufwerk D:\ sollte da eig. stehen.

cosinus

24.06.2010 21:25

Sieht man im Log nicht. Poste Logs bitte nur mit Code- und nie mit TABLE-Tags!!

Zitat:

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

Was für ein Adobe hast Du da drauf? Hast Du diese Einträge selbst gemacht?

Schaaf

24.06.2010 21:28

achso sorry..
Ich habe Photoshop CS 4
hab ich nicht selber gemacht.

cosinus

24.06.2010 21:30

Woher stammt das CS4?

Schaaf

24.06.2010 21:31

kommt vom kumpel, der hat mir das mal draufgespielt,
ist ne gecrackte version..

cosinus

24.06.2010 21:35

Zitat:

ist ne gecrackte version..

Sry, genau das hab ich mir schon gedacht, als ich die Hinweise zu den Host-Einträgen sah und auch die hier

Zitat:

C:\Users\XXXX\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> No action taken.
C:\Users\XXXX\AppData\Local\Temp\xxxyyyzzz.dat (Malware.Trace) -> No action taken.

Ist nun wirklich kein Geheimnis, dass Cracks, Keygens und Co in fast allen Fällen gefährliche Schädlinge enthalten. Außerdem gilt:

Die (Be)nutzung von Cracks, Serials und Keygens ist illegal, somit gibt es im Trojaner-Board keinen weiteren Support mehr.

Für Dich geht es hier weiter => Neuaufsetzen des Systems
Bitte auch alle Passwörter abändern (für E-Mail-Konten, StudiVZ, Ebay...einfach alles!) da nicht selten in dieser dubiosen Software auch Keylogger und Backdoorfunktionen stecken.

Danach nie wieder sowas anrühren!

Alle Zeitangaben in WEZ +1. Es ist jetzt 20:16 Uhr.

Copyright ©2000-2025, Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131