| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BKA-Trojaner - AuswertungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.08.2011, 21:14
| #1 |
 |  BKA-Trojaner - Auswertung Hallo liebe Leute. Ich hatte auch vor ein paar Tagen den lästigen BKA-Trojaner. Ich habe mir zunächst provisorisch damit beholfen über den abgesicherten Modus eine Systemwiederherstellung zu machen aber hier im Forum durchs Stöbern gesehen, dass das das Problem nicht unbedingt löst. Ich habe alle in einem anderen Post beschrieben Schritte erledigt: 1. Mal Otl Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-2.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-3.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.gif not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.src not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM not found.
File C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File X:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
File F:\LaunchU3.exe -a not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
File C:\Users\dube\Documents\Yvi.mcf not found.
File C:\Users\dube\Documents\Yvi.mcf~ not found.
Folder C:\ProgramData\SweetIM\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: asasas
->Temp folder emptied: 406157 bytes
->Temporary Internet Files folder emptied: 62442 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Fabian
->Temp folder emptied: 171486774 bytes
->Temporary Internet Files folder emptied: 5977585 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64206707 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 17283 bytes
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 7693347 bytes
->FireFox cache emptied: 12349165 bytes
->Flash cache emptied: 495 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 384522 bytes
%systemroot%\System32 .tmp files removed: 4384 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1898178 bytes
RecycleBin emptied: 374123 bytes
Total Files Cleaned = 253,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192512
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Datenbank Version: 7536
Windows 6.0.6000
Internet Explorer 7.0.6000.16809
25.08.2011 21:49:10
mbam-log-2011-08-25 (21-49-10).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|Z:\|)
Durchsuchte Objekte: 460483
Laufzeit: 2 Stunde(n), 16 Minute(n), 41 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter AC3Filter (remove only) 03.05.2010 1,43MB
Activation Assistant for the 2007 Microsoft Office suites Microsoft Corporation 01.11.2007 14,0MB
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 14.03.2010 10.0.45.2
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 18.07.2011 10.3.181.34
Adobe Photoshop CS4 Adobe Systems Incorporated 30.04.2010 11.0
Adobe Photoshop Elements 6.0 Adobe Systems, Inc. 24.02.2010 375MB 6.0
Adobe Reader 8.1.1 - Deutsch Adobe Systems Incorporated 29.12.2007 105,7MB 8.1.1
AGEIA PhysX v7.09.13 AGEIA Technologies, Inc. 21.06.2008 99,5MB 7.09.13
Amazon Kindle Amazon 05.08.2011 55,2MB
AnyToISO CrystalIdea Software, Inc. 04.04.2010 12,7MB 2.6.2
Apple Application Support Apple Inc. 05.09.2010 42,8MB 1.3.2
Apple Mobile Device Support Apple Inc. 05.09.2010 20,1MB 3.2.0.47
Apple Software Update Apple Inc. 29.11.2009 2,16MB 2.1.1.116
Audacity 1.2.6 17.01.2008 8,43MB
Avira AntiVir Personal - Free Antivirus Avira GmbH 20.07.2008 30,3MB
Bananarama 18.07.2009 1,55MB
Bonjour Apple Inc. 04.10.2010 1,12MB 2.0.3.0
Borland Delphi 5 31.08.2008
Borland Delphi 7 Borland Software Corporation 20.11.2008 141,2MB 7.0
CCleaner Piriform 24.08.2011 2,95MB 3.10
Cheat Engine 5.6.1 Dark Byte 23.09.2010 23,3MB
Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University 02.11.2007 698MB 2.0 (beta)
Compact&Easy 21.12.2007 9,07MB
Compatibility Pack für 2007 Office System Microsoft Corporation 31.12.2006 56,2MB 12.0.4518.1014
Crazy Machines FAKT Software GmbH 11.06.2011 41,7MB 1.0
Crysis® 2 Demo Electronic Arts 27.03.2011 1.760MB 1.0.0.0
Die Sims 2: Family Fun - Accessoires 12.11.2007 282MB
Die Sims 2: Nightlife 11.11.2007 1.287MB
Die Sims 2: Open For Business 11.11.2007 698MB
Die Sims 2: Wilde Campus-Jahre 01.11.2007 925MB
Die Sims™ 2 Apartment-Leben Electronic Arts 29.08.2008 1.307MB
Die Sims™ 2 Freizeit-Spaß Electronic Arts 02.08.2008 1.179MB
Die Sims™ 2 Gute Reise Electronic Arts 11.11.2007 947MB
Die Sims™ 2 H&M®-Fashion-Accessoires 12.11.2007 498MB
Die Sims™ 2 Haustiere 01.11.2007 801MB
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires Electronic Arts 01.08.2008 473MB
Die Sims™ 2 Party-Accessoires 12.11.2007 367MB
Die Sims™ 2 Vier Jahreszeiten 11.11.2007 869MB
Die Sims™ 2: Glamour-Accessoires 12.11.2007 356MB
DivX Converter DivX, Inc. 15.04.2010 37,1MB 7.0.0
DivX Plus DirectShow Filters DivX, Inc. 15.04.2010 1,22MB
DivX-Setup DivX, Inc. 03.05.2010 2,06MB 1.0.1.5
Dungeon Keeper 2 22.07.2010 491MB
DVDVideoSoftTB Toolbar 30.05.2010 2,61MB
Efficient WMA MP3 Converter v0.99.2 11.09.2008 26,9MB
Elecard MPEG-2 Decoder&Streaming Plug-in for WMP Elecard 03.05.2010 0,66MB 3.7.90209
Electronic Arts Product Registration Electronic Arts 19.07.2009 1,64MB 1.01.0000
FirstSteps Diagnostics Fujitsu Siemens Computers 31.12.2006 4,67MB 1.00
Folder Access 2.1 Free Version 16.01.2010 0,94MB
foobar2000 v1.0.3 Peter Pawlowski 09.08.2010 8,17MB 1.0.3
Forte Free 2.0 04.10.2010 27,8MB
Fraps 05.02.2009 4,61MB
Free Audio CD Burner version 1.4 DVDVideoSoft Limited. 11.09.2010 3,12MB
Free Audio Converter version 2.0 DVDVideoSoft Limited. 05.09.2010 5,77MB
Free YouTube Download 2.9 DVDVideoSoft Limited. 13.11.2010 3,27MB
Free YouTube Download 3 version 3.0.3.622 DVDVideoSoft Limited. 30.06.2011 4,27MB
Free YouTube to MP3 Converter version 3.9.40.602 DVDVideoSoft Limited. 09.06.2011 12,5MB
FreeMind 04.09.2010 10,3MB 0.8.1
Freez FLV to MP3 Converter www.smallvideosoft.com 01.11.2009 9,21MB 1.5
FSCLounge Fujitsu Siemens Computers 01.01.2007 8,47MB 1.0.0
GameWiz32 Nico Ebert 02.01.2011 1,64MB 1.43
GeoGebra GeoGebra Inc. 28.08.2008 55,9MB 3.0.0.0
Google Chrome Google Inc. 28.06.2011 46,6MB 13.0.782.215
Google Earth Google 31.05.2011 84,7MB 6.0.3.2197
Grand Theft Auto San Andreas Rockstar Games 24.12.2007 4.795MB 1.00.00001
GTA2 25.03.2010 72,0MB
Hama Double Action Air Grip GASIA 06.04.2010 1,09MB 1.00.0000
HP Smart Web Printing Ihr Firmenname 13.09.2008 6,33MB 2.15.7.0
HP Update Hewlett-Packard 13.09.2008 3,71MB 4.000.006.003
HPSSupply Ihr Firmenname 13.09.2008 0,96MB 2.2.0.0000
HyperCam 2 10.02.2009 1,28MB
ICQ Toolbar ICQ 31.10.2010 0,13MB 3.0.0
ICQ7.5 ICQ 04.08.2011 54,0MB 7.5
ISO Commander 1.6 (remove only) TurtleBlast Software 02.04.2010 1,18MB 1.6
iTunes Apple Inc. 04.10.2010 138,7MB 10.0.1.22
Java DB 10.2.2.0 Sun Microsystems, Inc 28.12.2007 24,4MB 10.2.2.0
Java(TM) 6 Update 19 Sun Microsystems, Inc. 02.04.2010 94,5MB 6.0.190
Java(TM) 6 Update 3 Sun Microsystems, Inc. 29.12.2007 168,1MB 1.6.0.30
Java(TM) SE Development Kit 6 Update 3 Sun Microsystems, Inc. 29.12.2007 342MB 1.6.0.30
JDownloader AppWork UG (haftungsbeschränkt) 07.09.2010 56,2MB 0.89
Last.fm 1.5.4.27091 Last.fm 31.10.2010 33,0MB
Lazarus 0.9.22 05.11.2010 374MB 0.9.22
LEGO Star Wars Ihr Firmenname 13.12.2007 1.873MB 1.00.0000
LEGO Star Wars 2 DEMO LucasArts 01.11.2007 245MB 1.00.0000
LEGO Star Wars Demo Disc Ihr Firmenname 12.11.2009 245MB 1.00.0000
Lern-o-Mat 22.06.2009 2,17MB
LiveUpdate 3.2 (Symantec Corporation) Symantec Corporation 03.11.2007 19,4MB 3.2.0.68
LiveUpdate Notice (Symantec Corporation) Symantec Corporation 11.08.2008 7,59MB 1.4.5
Luxor Amun Rising (remove only) 01.11.2007 18,1MB
Macro Express 3 Insight Software Solutions, Inc. 30.06.2008 15,8MB 3.0
Magic FLAC to MP3 Converter 3.72 Magic Video 09.08.2010 3,71MB
Mahjong Towers Eternity EU (remove only) 01.11.2007 15,7MB
Malwarebytes' Anti-Malware Version 1.51.1.1800 Malwarebytes Corporation 21.08.2011 3,91MB 1.51.1.1800
Master 2.3 Freeware Theo Heinze 19.11.2009 2,15MB
Mein Gutscheincode Finder 1.0.0.0 Conversion One GmbH 05.08.2011 1,91MB 1.0.0.0
Microsoft .NET Framework 1.1 15.08.2008
Microsoft .NET Framework 1.1 Hotfix (KB929729) 22.08.2008
Microsoft .NET Framework 3.5 Microsoft Corporation 06.07.2008 33,6MB
Microsoft .NET Framework 3.5 Language Pack - DEU Microsoft Corporation 06.07.2008 33,6MB
Microsoft .NET Framework SDK (German) 1.1 Microsoft 01.09.2008 332MB 1.1.4322
Microsoft Age of Empires II 26.09.2008 344MB
Microsoft Office Enterprise 2007 Microsoft Corporation 18.03.2010 731MB 12.0.6425.1000
Microsoft Office Home and Student 2007 Microsoft Corporation 18.03.2010 297MB 12.0.6425.1000
Microsoft Office PowerPoint Viewer 2007 (German) Microsoft Corporation 31.12.2006 51,0MB 12.0.4518.1014
Microsoft Silverlight Microsoft Corporation 23.07.2010 34,5MB 4.0.50524.0
Microsoft SQL Server Compact 3.5 Design Tools DEU Microsoft Corporation 04.04.2009 8,54MB 3.5.5386.0
Microsoft SQL Server Compact 3.5 DEU Microsoft Corporation 04.04.2009 2,25MB 3.5.5386.0
Microsoft Virtual PC 2007 Microsoft Corporation 05.04.2010 36,8MB 6.0.156.0
Microsoft Visual Basic 2005 Express Edition - DEU Microsoft Corporation 11.05.2008 166,3MB
Microsoft Visual Basic 2008 Express Edition - DEU Microsoft Corporation 03.04.2009 157,0MB
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 12.07.2010 0,41MB 8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 23.07.2010 0,58MB 9.0.30729
Microsoft Visual J# 2.0 Redistributable Package Microsoft Corporation 28.08.2008 133,1MB
Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework Microsoft 04.04.2009 5,62MB 3.5.21022
Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32 Microsoft Corporation 04.04.2009 2,61MB 6.1.5288.17011
Microsoft Works Microsoft Corporation 01.01.2007 377MB 9.7.0621
Microsoft WSE 3.0 Runtime Microsoft Corp. 11.07.2010 0,92MB 3.0.5305.0
MobileMe Control Panel Apple Inc. 04.10.2010 11,8MB 3.1.3.0
Movavi VideoSuite 5 MOVAVI 17.10.2008 68,4MB 5.07.004
Mozilla Firefox (3.6.20) Mozilla 17.08.2011 31,5MB 3.6.20 (de)
MSXML 4.0 SP2 (KB941833) Microsoft Corporation 01.01.2007 1,27MB 4.20.9849.0
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 22.11.2008 1,28MB 4.20.9870.0
Muziic Player & Encoder 01.11.2009 57,0MB
Mystery Case Files - Prime Suspects (remove only) 01.11.2007 39,3MB
Nero 7 Essentials Nero AG 31.12.2006 377MB 7.02.5851
Netscape Navigator (9.0.0.6) Netscape 27.03.2008 20,7MB 9.0.0.6 (en-US)
Norton Security Scan Symantec Corporation 03.05.2010 12,4MB 2.7.3.34
NVIDIA Drivers 14.07.2008
OJOsoft Audio Converter OJOsoft 05.09.2010 16,3MB 2.7.5.0412
OpenAL 11.02.2010 0,77MB
OpenOffice.org 2.4 OpenOffice.org 01.08.2008 328MB 2.4.9310
Opera 9.26 Opera Software ASA 11.03.2008 11,8MB 9.26
Pando Media Booster Pando Networks Inc. 02.11.2009 6,69MB 2.3.2.8
Pcsx2 0.9.6 Pcsx2 Team 06.04.2010 19,3MB 1.0.0
Poker Superstars II (remove only) 01.11.2007 30,3MB
PowerISO PowerISO Computing, Inc. 24.02.2010 3,76MB 4.6
QuickTime Apple Inc. 04.10.2010 73,7MB 7.68.75.0
RealPlayer RealNetworks 17.01.2008 46,8MB
Realtek High Definition Audio Driver 31.12.2006
Safari Apple Inc. 27.03.2008 60,8MB 3.525.13.0
SimCity 3000 28.12.2010 225MB
SimCity 4 30.12.2010 920MB
Softonic Toolbar Ask.com 28.05.2011 3,33MB 1.12.2.0
Softonic_Deutsch Toolbar 23.03.2011 3,91MB
Spesoft Audio Converter 2.30 Spesoft 09.08.2010 18,0MB
Streamripper (Remove only) 06.11.2009 6,30MB
Super nude patch II 2.8 31.07.2008
Theme Park World 28.12.2010 157,5MB
TIPP10 Version 2.0.3 (c) 2006-2008, Tom Thielicke 22.02.2010 12,2MB
Uninstall 1.0.0.1 13.11.2010 19,4MB
Unity Web Player Unity Technologies ApS 10.02.2011 0,20MB
VideoLAN VLC media player 0.8.6h VideoLAN Team 20.06.2008 32,4MB 0.8.6h
VoiceOver Kit Apple Inc. 26.07.2010 35,7MB 1.30.128.0
Vokabel Trainer 5 Manuel Wäschle 05.08.2011 4,98MB
WAV to MP3 06.08.2009 0,66MB
Winamp Nullsoft, Inc 08.01.2008 27,0MB 5.51
Windows Live Anmelde-Assistent Microsoft Corporation 21.12.2010 1,93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 21.12.2010 43,9MB 14.0.8117.0416
Windows Live-Uploadtool Microsoft Corporation 21.12.2010 0,22MB 14.0.8014.1029
Winload Toolbar Winload 05.08.2011 4,36MB 6.3.3.3
WinRAR 25.12.2007 3,66MB
Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY KONAMI 02.04.2010 229MB 1.00.0000
OTL 2. Mal Code:
ATTFilter OTL logfile created on: 25.08.2011 21:56:25 - Run 2 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\Fabian\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.16809) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free 6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe PRC - [2011.05.17 13:29:46 | 000,395,144 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe PRC - [2010.10.27 22:21:54 | 001,155,072 | ---- | M] (Last.fm) -- C:\Programme\Last.fm\LastFM.exe PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe PRC - [2007.09.26 11:53:56 | 000,623,984 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AUPDATE.EXE PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe ========== Modules (No Company Name) ========== MOD - [2010.10.27 22:23:04 | 000,106,496 | ---- | M] () -- C:\Programme\Last.fm\srv_rtaudioplayback.dll MOD - [2010.10.27 22:22:52 | 000,057,344 | ---- | M] () -- C:\Programme\Last.fm\ext_messengernotify.dll MOD - [2010.10.27 22:22:42 | 000,058,880 | ---- | M] () -- C:\Programme\Last.fm\ext_skypenotify.dll MOD - [2010.10.27 22:22:08 | 000,147,456 | ---- | M] () -- C:\Programme\Last.fm\srv_madtranscode.dll MOD - [2010.10.27 22:22:00 | 000,028,160 | ---- | M] () -- C:\Programme\Last.fm\srv_httpinput.dll MOD - [2010.10.27 22:19:28 | 000,372,736 | ---- | M] () -- C:\Programme\Last.fm\LastFmFingerprint1.dll MOD - [2010.10.27 22:19:06 | 000,025,088 | ---- | M] () -- C:\Programme\Last.fm\breakpad.dll MOD - [2010.10.27 22:18:50 | 000,180,224 | ---- | M] () -- C:\Programme\Last.fm\Moose1.dll MOD - [2010.10.27 22:18:34 | 000,540,672 | ---- | M] () -- C:\Programme\Last.fm\LastFmTools1.dll MOD - [2010.10.27 22:13:52 | 001,382,507 | ---- | M] () -- C:\Programme\Last.fm\libfftw3f-3.dll MOD - [2010.10.27 22:13:52 | 000,074,240 | ---- | M] () -- C:\Programme\Last.fm\zlibwapi.dll MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2008.04.16 18:42:30 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtNetwork4.dll MOD - [2008.04.16 18:42:16 | 000,524,288 | ---- | M] () -- C:\Programme\Last.fm\QtSql4.dll MOD - [2008.04.16 18:42:02 | 006,701,056 | ---- | M] () -- C:\Programme\Last.fm\QtGui4.dll MOD - [2008.04.16 18:36:38 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtXml4.dll MOD - [2008.04.16 18:36:34 | 001,654,784 | ---- | M] () -- C:\Programme\Last.fm\QtCore4.dll MOD - [2008.04.02 15:26:50 | 000,233,472 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qmng4.dll MOD - [2008.04.02 15:26:34 | 000,021,504 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qgif4.dll MOD - [2008.04.02 15:26:28 | 000,135,168 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qjpeg4.dll MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (sdCoreService) SRV - File not found [Auto | Stopped] -- -- (sdAuxService) SRV - File not found [On_Demand | Stopped] -- -- (osagent) SRV - File not found [On_Demand | Stopped] -- -- (oad) SRV - File not found [Auto | Stopped] -- -- (LiveUpdate Notice Ex) SRV - File not found [Auto | Stopped] -- -- (LckFldService) SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService) SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler) SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService) SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service) SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate) SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler) SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) ========== Driver Services (SafeList) ========== DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp) DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu) DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt) DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD) DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec) DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt) DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec) DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32) DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32) DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID) DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio) DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm) DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA) DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM) DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2) DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO) DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl) DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl) DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/" FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.100006 FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12 FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.2 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team) FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Fabian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.18 19:08:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.18 19:08:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Components: C:\Program Files\Netscape\Navigator 9\components [2010.10.04 20:43:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Plugins: C:\Program Files\Netscape\Navigator 9\plugins [2010.10.04 20:43:45 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.08.06 02:58:52 | 000,000,000 | ---D | M] [2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions [2011.08.25 14:05:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions [2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f} [2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} [2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} [2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} [2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard [2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis [2011.08.01 14:07:05 | 000,000,000 | ---D | M] ("Softonic Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\toolbar@ask.com [2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml [2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml [2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml [2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml [2011.08.24 14:23:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml [2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml [2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml [2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml [2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml [2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml [2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml [2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml [2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml [2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml [2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml [2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml [2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml [2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml [2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml [2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml [2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml [2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml [2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml [2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif [2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src [2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml [2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com [2011.08.06 02:58:52 | 000,000,000 | ---D | M] (preisspion.de) -- C:\PROGRAM FILES\MEIN GUTSCHEINCODE FINDER\FIREFOX [2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll [2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll [2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found. O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [EA Core] File not found O4 - HKCU..\Run: [ICQ] File not found O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: Free YouTube Download - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL [2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe [2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder [2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder [2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin [2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin [2011.08.21 15:10:30 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\Geäusche für Musik [2011.08.19 14:52:01 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\teeworlds-b122-r50edfd37-win32 [2011.08.12 20:43:14 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\bio-referat [2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content [2011.08.06 17:55:52 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon [2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon [2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer [2011.08.06 02:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vokabel Trainer [2011.08.06 02:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Vokabel Trainer [2011.08.06 02:59:00 | 000,000,000 | ---D | C] -- C:\Program Files\Winload [2011.08.06 02:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mein Gutscheincode Finder [2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5 [2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5 ========== Files - Modified Within 30 Days ========== [2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job [2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.08.25 21:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job [2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.08.25 21:20:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.08.25 19:27:07 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.08.25 19:26:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.08.25 19:26:50 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys [2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts [2011.08.24 00:10:46 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.08.24 00:10:46 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.08.24 00:10:46 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.08.24 00:10:46 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.08.23 20:50:48 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe [2011.08.23 15:15:58 | 000,010,054 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt [2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat [2011.08.11 19:55:43 | 009,527,411 | ---- | M] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3 [2011.08.06 02:59:37 | 000,000,904 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job [2011.07.27 05:02:13 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== Files Created - No Company Name ========== [2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys [2011.08.11 19:55:18 | 009,527,411 | ---- | C] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3 [2011.08.06 02:59:37 | 000,000,904 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE [2010.09.24 19:12:00 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll [2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2009.11.02 19:48:01 | 008,676,883 | ---- | C] () -- C:\Windows\System32\mp3Media2.dll [2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll [2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll [2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate [2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne [2008.10.18 16:40:35 | 000,000,060 | ---- | C] () -- C:\Windows\IniFile1.ini [2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll [2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat [2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE [2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini [2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll [2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI [2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll [2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI [2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll [2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png [2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI [2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll [2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll [2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat [2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll [2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll [2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys [2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys [2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat [2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe [2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat [2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat [2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini [2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll [2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll [2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll [1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll ========== LOP Check ========== [2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft [2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data [2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari [2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus [2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design [2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player [2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite [2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner [2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft [2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers [2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla [2010.08.10 14:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\foobar2000 [2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0 [2011.08.25 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ [2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar [2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite [2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software [2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer [2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin [2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat [2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2 [2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape [2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera [2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web [2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation [2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC [2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking [2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder [2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity [2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter [2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper [2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds [2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template [2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter [2011.08.25 19:26:01 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > |
|
25.08.2011, 21:16
| #2 |
| | BKA-Trojaner - Auswertung Extras
__________________Code:
ATTFilter OTL Extras logfile created on: 25.08.2011 21:56:25 - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free
6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036AD46C-F133-4870-9973-43F8F1749C05}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0827B1ED-7C0E-46DE-9B68-FE4507996B1B}" = lport=138 | protocol=17 | dir=in | app=system |
"{0D776123-0177-4A44-8CE8-5394DCBCE19F}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{0DFF39ED-609F-4F70-A312-977BB4EA4C95}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0E3EE5EF-F522-4387-80AB-719C4D2C9999}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{0E9B2B55-907D-4914-B06F-8E5B79D158C2}" = rport=138 | protocol=17 | dir=out | app=system |
"{1759072B-13B7-499D-9B61-612CCC1B3D2D}" = lport=27000 | protocol=6 | dir=in | name=d |
"{1EBEA911-67BE-419C-874F-E1581C565E9A}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{2A278909-A1EA-402A-93CE-300F9EFB6D73}" = rport=137 | protocol=17 | dir=out | app=system |
"{2F7144FB-161C-4466-AFC0-D29C1B7C1454}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=datei- und druckerfreigabe (spoolerdienst - rpc-epmap) |
"{3150F03F-4F16-4A48-8203-A940A6031EFF}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{35D8F183-3920-4557-B596-19870DB6DE51}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{36011B8E-B147-4963-A6D2-826484F3082B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{435A64E7-0986-45B9-B8E5-94966C533E52}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{439BF87C-C7A6-4CE2-935F-6AD809675F30}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{4D6A5E9F-143B-44EB-BC4B-FFF9516BE53E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{52AEC027-3A2F-4BF1-BF67-BD24A029AE1A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{65999647-1C74-4D35-99C1-36CC42D060E0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{67334780-E818-47DA-827B-1A5B43202C2C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{6B567DA0-527B-4EF3-8EC9-0211B47F59BF}" = lport=139 | protocol=6 | dir=in | app=system |
"{6FA4AB99-4DB6-4C10-89D9-C88972EA2583}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{813B975C-3260-4B28-9F16-9F07AEC40D30}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{944D6ECB-DD63-4DE7-84CB-F3959E0E195A}" = rport=139 | protocol=6 | dir=out | app=system |
"{99D470F2-0066-4F55-A9C8-881ACD582D56}" = rport=2178 | protocol=6 | dir=out | app=system |
"{9BEEA4BF-ADBC-43B9-8FCA-FEA9145EE6B7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AB4B898A-879E-4AFC-9AE5-876285DA4D9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AD7FE4B7-98AF-4BFB-AE5D-A90063314809}" = lport=445 | protocol=6 | dir=in | app=system |
"{AEB42302-8669-4D9C-8398-49CF2494882A}" = lport=6884 | protocol=17 | dir=in | name=6884 |
"{B0B4E08D-F005-440A-B8BD-5DB578B6DC5C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BC0C8E39-60D1-40F1-AF7F-343E32F4475C}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{C6BC8FC2-94D7-44ED-924B-F8E405BE3B68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{C92A54A0-15A1-4E64-AA9F-AF034FBD95D0}" = rport=445 | protocol=6 | dir=out | app=system |
"{C9FBF73F-656A-4369-AE29-1EF0253D3253}" = lport=2178 | protocol=6 | dir=in | app=system |
"{E84AFAE9-1D9C-45C9-9E56-C06E07C385FF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{EEF4DA8D-99F4-4E27-80F7-0F1B83C67635}" = lport=137 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15B7DACE-B63D-4B00-BDE7-38EBE09CD8B8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{1906B78A-1159-499A-9E4D-2453B77F4950}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D561E35-6EBC-45E2-83CE-2A0C2EDEBD93}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{232CF333-A59B-4C26-A399-E4254B8F9C6D}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{23D860D8-52FC-4732-84F6-E3BBA890E6F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{27D5C767-A8DE-49D0-A43F-FADB8815438D}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{2CA149DF-F520-4730-BCE3-46D689750ECF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{30D0F232-C116-4A20-A2DE-9B5BC04E7C3B}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) |
"{37FFD9AE-FE98-469F-85B3-55F9F4F35E46}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe |
"{3C45477E-95C6-408B-B992-7E22911994C6}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{433D1D5A-F129-4D74-8BE6-5A8D33700882}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{435E5788-3302-4210-B920-5255232777BD}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) |
"{4754B88C-2B44-438D-8FF7-FCFF22B00F68}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{4A0942E6-2365-44DD-BA0E-77D346AE430D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{51504434-7621-456C-9571-14825D5F4ABA}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{61C7C6D5-891B-4708-A525-0965793F9FDE}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{771AAC88-87B4-4A32-9A08-EC21885B4603}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{82FBAC0C-7A7E-4A98-8DA6-3B6319EF14BE}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{8E8B846C-446E-4DEB-8C0D-D7ECF303529E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{93B56A5A-7FA5-446A-BF6F-140D7A04D42C}" = protocol=6 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe |
"{9562B05F-1968-478E-9FAA-BB70B3439EDD}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{96A48BB4-BB84-4D82-8117-8E82664C88C7}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{98E66267-3FBC-4BF7-A82E-8747C9DC9AE0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{9B6D63F1-5909-4231-9198-EB4A1E2E9A33}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{A24F9136-82F0-4B84-9696-690EEA537AD8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A28EC850-3092-4143-9B94-88A1D2FD3461}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{A3B82801-0D1E-4C35-8A2F-69C76DCC8154}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A681499F-FFC5-406F-BBF6-4C0C5761C370}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A9B112C1-8DC6-4119-A805-88E380BEB530}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe |
"{AB9F5538-F00F-4C8A-BD02-3FC401046CA1}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{B2BDA0AB-BEEC-4BA4-A559-083978D7A417}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BFF1FE41-2B7D-43F4-ABB0-E3096347F65A}" = protocol=17 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe |
"{CA8FB01D-F1E9-4584-82C6-1F899AF18E04}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D2C859FB-6AE9-4B51-8047-6D854C1FD5CC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{D396557A-B10D-433D-8EAF-7F3B0E6ABA09}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{E96972C8-6FBC-4693-868D-25DD48A7FB03}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{F62E7995-EC73-4D64-BD39-301199818FC9}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{FCD20E1D-696D-41D7-9BE8-02774CF95EBC}" = protocol=58 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv6 ausgehend) |
"{FEE82F35-479B-4856-95D0-21CEFA9FB224}" = protocol=1 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv4 ausgehend) |
"TCP Query User{257E13E3-4875-4248-B254-0B20E8379C49}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=6 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe |
"TCP Query User{3DF5626D-F4A2-43B8-BC7F-9D4116F33FD0}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{5C31B729-1B71-4381-BE09-1A9900197AFA}C:\program files\pando networks\media booster\pmb.exe" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"TCP Query User{640A83A8-A2B6-472B-9BE5-31F7B07295FD}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{9BC5B727-73F0-4BEE-A7B1-97AD6040F044}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe |
"TCP Query User{AF729254-2EC2-4F2E-A3EE-D650B643879C}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{B9B2ED80-1CB0-47FA-9F39-D7E425EDD390}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=6 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe |
"TCP Query User{BC6169AD-2DBE-494D-94F5-AB5916DCD08A}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"TCP Query User{CEAE6599-A07C-4596-A36D-2F42F63C65CE}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{FB1981AE-E5BB-4345-BED9-E4608B86F654}C:\program files\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe |
"UDP Query User{08B0AA2C-D956-4203-8012-C2B45786FD33}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{100D2469-6D57-43A3-AC65-EE8FF117650A}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{81608F9D-B034-46B2-9DC8-065455D966A7}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe |
"UDP Query User{9A68E0A5-F49F-4D2C-B8C7-146B8E8E2AF3}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"UDP Query User{B0E92103-B06D-4CB1-A9AB-A4E6861C8FF0}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{D27B843C-F33C-4B8F-95E6-63DFFB652B7A}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{DCD3D474-03C1-4A03-9514-EB76E06C534A}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=17 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe |
"UDP Query User{EAB1E2FD-8538-4E65-B3A0-8C352C0AF04F}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=17 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe |
"UDP Query User{EF3FA45A-AB22-41F7-B93D-BAF2EB906ECA}C:\program files\pando networks\media booster\pmb.exe" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"UDP Query User{EFF85BBF-A16D-4633-9E2C-41F4B19B5D66}C:\program files\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0AFC9710-5DD6-4C6A-BA52-91AE992B2C9D}" = Safari
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}" = Java DB 10.2.2.0
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BF4CB15-6055-452A-8487-021AE2D91208}" = Crysis® 2 Demo
"{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1" = Mein Gutscheincode Finder 1.0.0.0
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{28F11027-A8BC-44D3-A59A-CA018ED73E8C}" = Compact&Easy
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{32A3A4F4-B792-11D6-A78A-00B0D0160030}" = Java(TM) SE Development Kit 6 Update 3
"{3571656A-575D-4CED-809D-5547587121FF}" = Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E074808-1B86-4230-A9EB-0904942EC4AE}" = LEGO Star Wars II
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56403FFF-145E-35C5-A090-96598BE57FB8}" = Microsoft Visual Basic 2008 Express Edition - DEU
"{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1" = Vokabel Trainer 5
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{63E921D9-799A-44F9-A742-DE3DC968AFEF}" = Microsoft .NET Framework SDK (German) 1.1
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7BE667F1-6643-4469-A830-6C360B1A036F}" = Movavi VideoSuite 5
"{81CD6232-10F5-4832-B3DA-1B88B1571031}" = Nero 7 Essentials
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = Die Sims™ 2 H&M®-Fashion-Accessoires
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8E6A3B40-DCE3-47D9-835B-FE1AD9C083D0}" = Crazy Machines
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{975E4CAE-D408-48DA-9346-65D7DB72B7DE}" = Hama Double Action Air Grip
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = Die Sims™ 2: Glamour-Accessoires
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.1 - Deutsch
"{AC816492-1A38-47FA-975E-D5BDAD8ADCAB}" = Lern-o-Mat
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B639110D-747F-40DC-9682-95D94EF73790}" = dj_sf_software
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = Die Sims™ 2 Apartment-Leben
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C07B8BC4-AFD9-3AA4-BDF5-330A07591FDE}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBA2E782-C278-4B81-008D-4703FCBC1A2E}" = SimCity 4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"{EAA38532-7AD0-4f78-918A-4F4F02096ECE}" = Die Sims™ 2 Party-Accessoires
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = Die Sims™ 2 Gute Reise
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"{FB706A00-C234-4716-AB1F-27DCB192C664}" = Opera 9.26
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"AC3Filter" = AC3Filter (remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Age of Empires 2.0" = Microsoft Age of Empires II
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"AnyToISO_is1" = AnyToISO
"Audacity_is1" = Audacity 1.2.6
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Bananarama" = Bananarama
"CCleaner" = CCleaner
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Delphi5" = Borland Delphi 5
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Dungeon Keeper 2" = Dungeon Keeper 2
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Efficient WMA MP3 Converter_is1" = Efficient WMA MP3 Converter v0.99.2
"Elecard MPEG-2 Decoder&Streaming Plug-in for WMP 3.7.90209" = Elecard MPEG-2 Decoder&Streaming Plug-in for WMP
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Folder Access 2.1 Free Version" = Folder Access 2.1 Free Version
"foobar2000" = foobar2000 v1.0.3
"Forte Free" = Forte Free 2.0
"Fraps" = Fraps
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Audio Converter_is1" = Free Audio Converter version 2.0
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.3.622
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"Freez FLV to MP3 Converter v1.5_is1" = Freez FLV to MP3 Converter
"GameWiz32" = GameWiz32
"GeoGebra" = GeoGebra
"GTA2" = GTA2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HyperCam 2" = HyperCam 2
"ICQToolbar" = ICQ Toolbar
"InstallShield_{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"InstallShield_{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"InstallShield_{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"ISO Commander" = ISO Commander 1.6 (remove only)
"JDownloader" = JDownloader
"LastFM_is1" = Last.fm 1.5.4.27091
"Lazarus_is1" = Lazarus 0.9.22
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Luxor Amun Rising" = Luxor Amun Rising (remove only)
"Macro Express 3" = Macro Express 3
"Magic FLAC to MP3 Converter_is1" = Magic FLAC to MP3 Converter 3.72
"Mahjong Towers Eternity EU" = Mahjong Towers Eternity EU (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.1.1800
"Master_is1" = Master 2.3 Freeware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft Visual Basic 2005 Express Edition - DEU" = Microsoft Visual Basic 2005 Express Edition - DEU
"Microsoft Visual Basic 2008 Express Edition - DEU" = Microsoft Visual Basic 2008 Express Edition - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox (3.6.20)" = Mozilla Firefox (3.6.20)
"MTS2_ColourOptions_is1" = Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"Netscape Navigator (9.0.0.6)" = Netscape Navigator (9.0.0.6)
"NSS" = Norton Security Scan
"NVIDIA Drivers" = NVIDIA Drivers
"OJOsoft Audio Converter_is1" = OJOsoft Audio Converter
"OpenAL" = OpenAL
"Poker Superstars II" = Poker Superstars II (remove only)
"PowerISO" = PowerISO
"RealPlayer 6.0" = RealPlayer
"SimCity 3000" = SimCity 3000
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"Spesoft Audio Converter_is1" = Spesoft Audio Converter 2.30
"Streamripper" = Streamripper (Remove only)
"Super_nude_patch_II_1.0" = Super nude patch II 2.8
"Theme Park World" = Theme Park World
"TIPP10_is1" = TIPP10 Version 2.0.3
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WAV to MP3" = WAV to MP3
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"Winload Toolbar" = Winload Toolbar
"WinRAR archiver" = WinRAR
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Google Chrome" = Google Chrome
"Muziic Player & Encoder" = Muziic Player & Encoder
"UnityWebPlayer" = Unity Web Player
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 24.08.2011 14:04:15 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 25.08.2011 08:26:17 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
Error - 25.08.2011 12:49:40 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 384: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 388: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 376: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 25.08.2011 13:32:42 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 25.08.2011 13:32:44 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 25.08.2011 14:26:58 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
[ Media Center Events ]
Error - 13.12.2010 17:33:55 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 25.12.2010 10:00:53 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 04.02.2011 10:01:44 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 34
Description = Ereignisinformationen: Ermittlungsdienst: Unerwarteter Fehler. Der
TV-Programmlistendienst ist zurzeit nicht verfügbar. Wiederholen Sie den Vorgang
später. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 24.02.2011 11:35:52 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 04.03.2011 07:31:20 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
Error - 22.03.2011 10:00:17 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
GetLastError returned 10000105 Prozess: DefaultDomain Objektname: Media Center Guide
Error - 14.04.2011 11:32:31 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
GetLastError returned 10000105 Prozess: DefaultDomain Objektname: Media Center Guide
Error - 07.07.2011 09:49:00 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
GetLastError returned 10000105 Prozess: DefaultDomain Objektname: Media Center Guide
[ System Events ]
Error - 25.08.2011 07:25:51 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
7, Funktion 0. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
zu erhalten.
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
2, Funktion 0. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
zu erhalten.
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
7, Funktion 0. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
zu erhalten.
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.08.2011 13:25:15 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7034
Description =
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
So. Hoffe, dass das hilfreich war und ihr mir helfen könnt. Wäre super. Liebe Grüße Fabian  |
|
28.08.2011, 10:04
| #3 |
| | BKA-Trojaner - Auswertung Hi nochmal. Ich will ja wirklich nicht nerven aber der Thread war ja schon auf Seite 3. Aber könnt ihr mir denn nicht helfen oder so?
__________________ Ich kann ja verstehen, dass das schwer ist aufgrund der Menge von Zuschriften hier aber trotzdem |
|
29.08.2011, 12:42
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | BKA-Trojaner - Auswertung Es steht hier überall, dass du den Thread nicht pushen oder dir selbst antworten sollst. Tust es doch, wird er als "in Arbeit" gesehen und nicht weiter beachtet, er erscheint dann auch nciht mehr in der Liste der unbeantworteten Themen. Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.08.2011, 22:10
| #5 |
| | BKA-Trojaner - Auswertung Da hat jemand einfach was total vages gepostet von wegen "hab bka-trojaner" und die anweisung bekommen, die im übrigen auch paar weitere genau so bekommen haben... was ist daran individuell zugeschnitten? aber tut mir leid, wenn es falsch war... |
|
30.08.2011, 10:06
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BKA-Trojaner - Auswertung Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________ --> BKA-Trojaner - Auswertung |
|
30.08.2011, 12:38
| #7 |
| | BKA-Trojaner - Auswertung Ja. Es gibt noch ca. 15 weitere. Aber die sind alle nicht von 2011. Trotzdem posten? |
|
30.08.2011, 15:24
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BKA-Trojaner - Auswertung Nee lass mal  Führe auch bitte ESET aus, danach sehen wir weiter. ESET Online Scanner
n.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.09.2011, 20:59
| #9 |
| | BKA-Trojaner - Auswertung So. Das sagt die log-datei: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7a48f6434ad31d4989117994f2c86a79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 07:57:14
# local_time=2011-09-01 09:57:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 31376586 31376586 0 0
# compatibility_mode=1792 16777195 100 0 119130417 119130417 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 76735078 152425969 0 0
# compatibility_mode=8192 67108863 100 0 152 152 0 0
# scanned=324290
# found=11
# cleaned=0
# scan_time=13793
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\1dd6a40c-617b9dca multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-44b4cfd1 probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\140bd1ef-2391d66f a variant of Java/Exploit.Agent.NAL trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2fd1f8ec Java/TrojanDownloader.Agent.NBL trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-20060773 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-4c33b3ea multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-155183ac Java/Exploit.Agent.NAJ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-3767c220 Java/Exploit.Agent.NAJ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\e668b8-3fab79d9 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe probably a variant of Win32/Agent.MXEKFBP trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2b70da77-27c687e4 multiple threats (unable to clean) 00000000000000000000000000000000 I
|
|
01.09.2011, 21:06
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BKA-Trojaner - AuswertungZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.09.2011, 21:59
| #11 |
| | BKA-Trojaner - Auswertung Hab ich gerade gelöscht. Aber das ist locker mal 2,5 Jahre alt |
|
01.09.2011, 22:25
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BKA-Trojaner - Auswertung Was das ist, wird damit aber nicht gerade erklärt 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.09.2011, 07:48
| #13 |
| | BKA-Trojaner - Auswertung Weiß nicht mehr, was das ist. Aber finde es reichlich seltsam, dass das jetzt als ne Art Malware angezeigt wird  Und was ist mit dem Rest? |
|
02.09.2011, 10:04
| #14 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BKA-Trojaner - AuswertungZitat:
Warum vermüllst du dir das System mit diesen nutzlosen Toolbars? Am besten alle nutzlosen Toolbars deinstallieren. Dabei helfen können dir Ask Toolbar Remover und Multi Toolbar Remover: http://www.chip.de/downloads/ASK-Too..._43117721.html http://www.chip.de/downloads/Multi-T..._43155841.html Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.09.2011, 13:02
| #15 |
| | BKA-Trojaner - Auswertung Glaube die Toolbars sind noch fast alle da und wurden nich wirklich gelöscht o.O Aber hab insgesamt locker mal 50 Dinger bei Systemsteuerung -> Programme und Funktionen gelöscht^^ Was nun? Neuer Eset check? |
|
| Themen zu BKA-Trojaner - Auswertung |
| adblock, alternate, antivir, bho, browser, conduit, error, excel.exe, firefox, flash player, format, google, google chrome, helper, home, internet, internet explorer, logfile, mozilla, mp3, nodrives, nvlddmkm.sys, plug-in, problem, security, senden, server, softonic deutsch toolbar, software, start menu, studio, sweetim, symantec, usb, version=1.0, vista, visual studio, windows, wma |
Linear-Darstellung
