| |
| |||||||
Log-Analyse und Auswertung: "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
06.02.2012, 21:28
| #1 |
 |  "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" Hallo, bin neu im Forum hier, brauche dringend hilfe. Habe folgendes problem, undzwar war ich auf einer Stream seite wo man Filme gucken kann, und bekam plötzlich eine Meldung ("Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" "Besuchen von Seiten mit infiziertem und pornographischen Inhalt", Wie werde ich ihn wieder los?? Um eine schnelle hilfe wär ich dankbar  Mein System ist Windows Vista und 32bit |
|
06.02.2012, 21:42
| #2 |
| /// Malware-holic   | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" hi,
__________________neustarten, f8 drücken, abgesicherter modus mit netzwerk wählen. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
07.02.2012, 22:00
| #3 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" OTL.TxtOTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 07.02.2012 21:45:11 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Richard\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 70,01% Memory free 4,23 Gb Paging File | 3,81 Gb Available in Paging File | 89,99% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 458,64 Gb Total Space | 104,08 Gb Free Space | 22,69% Space Free | Partition Type: NTFS Drive D: | 7,12 Gb Total Space | 0,95 Gb Free Space | 13,34% Space Free | Partition Type: NTFS Computer Name: RICHARD-PC | User Name: Richard | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Richard\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Programme\WinRAR\RarExt.dll () ========== Win32 Services (SafeList) ========== SRV - (NVCScheduler) -- File not found SRV - (nvcoas) -- File not found SRV - (Norman NJeeves) -- File not found SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation) SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation) SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation) SRV - (PnkBstrA) -- C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe () SRV - (HPBtnSrv) -- c:\hp\HPEZBTN\HPBtnSrv.exe () SRV - (Remote UI Service) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel(R) Corporation) SRV - (MCLServiceATL) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel(R) Corporation) SRV - (ISSM) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel(R) Corporation) SRV - (AlertService) Intel(R) -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel(R) Corporation) SRV - (DQLWinService) -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe () SRV - (M1 Server) Intel(R) Viiv(TM) -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe () SRV - (IntelDHSvcConf) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe (Intel(R) Corporation) ========== Driver Services (SafeList) ========== DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software) DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software) DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software) DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software) DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software) DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.) DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.) DRV - ({22D78859-9CE9-4B77-BF18-AC83E81A9263}) -- C:\Programme\HP\DVDPlay\000.fcl (CyberLink Corp.) DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.) DRV - (hwusbfake) -- C:\Windows\System32\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation) DRV - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation) DRV - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation) DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation) DRV - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation) DRV - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation) DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation) DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce)) DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.) DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation) DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation) DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation) DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation) DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation) DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation) DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (HCW85BDA) -- C:\Windows\System32\drivers\HCW85BDA.sys (Hauppauge Computer Works) DRV - (NvcMFlt) -- C:\Windows\System32\drivers\nvcv32mf.sys (Norman ASA) DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Corp.) DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology) DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology) DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology) DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology) DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology) DRV - (sfsync01) -- C:\Windows\System32\drivers\sfsync01.sys (StarForce Technologies, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 AF 90 EF 1F 88 CA 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Programme\Mail.Ru\Agent\Mra\dll\newmrasearch.dll () IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=14672" FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.8 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.4.3 FF - prefs.js..extensions.enabledItems: {37964A3C-4EE8-47b1-8321-34DE2C39BA4D}:2.5.2.20 FF - prefs.js..extensions.enabledItems: downloader@finalvideotools.com:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: DefaultManager@Microsoft:2.1 FF - prefs.js..extensions.enabledItems: support@predictad.com:1.11 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.9.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: mail@gutscheinrausch.de:2.6 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1367 FF - prefs.js..keyword.URL: "hxxp://go.mail.ru/search?utf8in=1&fr=fftbUFix&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ßþøÑÂÂÂú@mail.ru" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ßþøÑÂÂÂú@mail.ru" FF - prefs.js..browser.startup.homepage: "hxxp://www.mail.ru" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files\SpeedBit Video Downloader\SPFireFox FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\downloader@finalvideotools.com: C:\Program Files\FinalVideoDownloader\Firefox [2010.04.27 14:10:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2010.09.08 20:15:15 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.01.25 19:26:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.23 14:45:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.23 14:45:21 | 000,000,000 | ---D | M] [2009.04.10 15:31:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Richard\AppData\Roaming\mozilla\Extensions [2012.01.30 13:24:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions [2010.04.27 14:17:25 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.01.26 22:05:47 | 000,000,000 | ---D | M] (Спутник @Mail.Ru) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2012.01.11 23:20:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.01.11 23:20:33 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.12.19 17:12:25 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.01.11 23:20:31 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.07.20 21:24:54 | 000,000,000 | ---D | M] (Microsoft Default Manager) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\DefaultManager@Microsoft [2011.04.06 22:49:05 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\engine@conduit.com [2010.12.22 20:38:19 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\mail@gutscheinrausch.de [2010.07.31 23:39:05 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\support@predictad.com [2012.01.30 13:21:26 | 000,002,401 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\askcom.xml [2009.12.29 01:31:41 | 000,002,163 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\bing.xml [2010.12.19 18:13:27 | 000,000,873 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\conduit.xml [2012.02.01 20:11:54 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-1.xml [2010.03.24 15:32:50 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-10.xml [2010.04.02 12:24:44 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-11.xml [2010.04.27 14:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-12.xml [2010.06.28 00:20:32 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-13.xml [2010.07.09 23:39:47 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-14.xml [2010.07.24 02:07:12 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-15.xml [2010.07.30 00:58:57 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-16.xml [2010.09.10 14:49:03 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-17.xml [2010.09.17 14:06:33 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-18.xml [2010.10.27 13:49:54 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-19.xml [2009.07.26 16:55:11 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-2.xml [2010.10.31 19:22:02 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-20.xml [2010.12.16 23:09:24 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-21.xml [2011.04.01 14:38:33 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-22.xml [2011.05.17 15:02:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-23.xml [2011.06.27 12:12:37 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-24.xml [2011.08.17 00:02:31 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-25.xml [2011.08.19 17:36:59 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-26.xml [2011.09.18 17:53:00 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-27.xml [2011.09.30 00:15:00 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-28.xml [2011.10.24 21:26:41 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-29.xml [2009.09.11 15:48:39 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-3.xml [2012.01.11 12:56:28 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-30.xml [2012.01.23 14:45:55 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-31.xml [2012.01.30 13:21:24 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-32.xml [2009.10.06 21:42:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-4.xml [2009.11.08 15:34:41 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-5.xml [2010.01.10 13:52:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-6.xml [2010.01.24 19:10:29 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-7.xml [2010.02.15 16:18:34 | 000,000,961 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-8.xml [2010.03.12 16:32:39 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-9.xml [2010.06.21 16:35:24 | 000,001,042 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin.xml [2012.01.26 22:05:51 | 000,001,533 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\mailru---.xml [2009.12.07 14:12:08 | 000,003,915 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\sweetim.xml [2012.01.23 14:45:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2009.07.14 17:07:09 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.01.25 19:26:43 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF () (No name found) -- C:\USERS\RICHARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\I7Z0G9L0.DEFAULT\EXTENSIONS\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}.XPI [2012.01.23 14:45:19 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.01.23 14:45:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.24 20:22:50 | 000,002,227 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012.01.23 14:45:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.01.23 14:45:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2010.09.28 17:14:06 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrchstonicde.xml [2012.01.23 14:45:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.02 20:48:25 | 000,001,431 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\mailru.xml [2012.01.23 14:45:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.23 14:45:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2008.12.28 02:23:23 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll (SimplyGen) O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {09900DE8-1DCA-443F-9243-26FF581438AF} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found. O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe (Mail.Ru) O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Firefox helper] C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe () O4 - HKCU..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe (PC Tools) O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKCU..\Run: [Userinit] C:\Users\Richard\AppData\Roaming\appconf32.exe () O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks) O8 - Extra context menu item: Free YouTube Download - C:\Users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Download Video - {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Programme\FinalVideoDownloader\fvdRunner.html () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Mail.Ru Agent - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Programme\Mail.Ru\Agent\magent.exe (Mail.Ru) O9 - Extra 'Tools' menuitem : Mail.Ru Agent - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Programme\Mail.Ru\Agent\magent.exe (Mail.Ru) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found O13 - gopher Prefix: missing O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3B5CDD45-01AC-4ECC-8809-5C90E63E326C}: DhcpNameServer = 139.7.30.126 139.7.30.125 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{743D1FE6-E8C7-48E8-9E89-33E50509FED2}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{89D04780-B12E-4143-A6E2-732BCDF0B68D}: DhcpNameServer = 139.7.30.126 139.7.30.125 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96807F5F-54E5-406D-927A-829EEB2055A6}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Programme\Stardock\Fences\FencesMenu.dll (Stardock) O24 - Desktop WallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.10.11 19:46:48 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL L:\SYsteM.Exe O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\explOre\CoMmand - "" = L:\SYSTEM.EXE O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\opEN\commAnD - "" = L:\SYSTEM.EXE O33 - MountPoints2\{60632e55-ab50-11dd-b0f7-001d60e0644a}\Shell - "" = AutoRun O33 - MountPoints2\{60632e55-ab50-11dd-b0f7-001d60e0644a}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a O33 - MountPoints2\{80ae6f41-d2d8-11df-802f-001e101f21c1}\Shell - "" = AutoRun O33 - MountPoints2\{80ae6f41-d2d8-11df-802f-001e101f21c1}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{974696a8-bb71-11df-baf1-001d60e0644a}\Shell - "" = AutoRun O33 - MountPoints2\{974696a8-bb71-11df-baf1-001d60e0644a}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{974696af-bb71-11df-baf1-001e101f21c1}\Shell - "" = AutoRun O33 - MountPoints2\{974696af-bb71-11df-baf1-001e101f21c1}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{a50ecd36-9b75-11dd-922b-001d60e0644a}\Shell\AutoRun\command - "" = L:\setupSNK.exe O33 - MountPoints2\{f24c8bb2-3e45-11df-a4ca-001d60e0644a}\Shell - "" = AutoRun O33 - MountPoints2\{f24c8bb2-3e45-11df-a4ca-001d60e0644a}\Shell\AutoRun\command - "" = L:\Startme.exe O33 - MountPoints2\{f75dac93-bcdf-11df-a7a1-001e101f36d9}\Shell - "" = AutoRun O33 - MountPoints2\{f75dac93-bcdf-11df-a7a1-001e101f36d9}\Shell\AutoRun\command - "" = N:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2012.02.06 20:57:13 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Richard\Desktop\OTL.exe [2012.02.06 20:48:43 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\UAs [2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\xmldm [2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\kock [2012.02.02 23:16:20 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Bad To The Bonehead [2012.02.02 19:12:27 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\NS Music Sampler I (2010) [2012.02.01 22:45:39 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Soldatenlieder Der Wehrmacht [2012.02.01 22:10:54 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Tribute To R.O.A [2012.02.01 20:13:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows [2012.01.30 12:43:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher [2012.01.30 12:42:30 | 000,000,000 | ---D | C] -- C:\Program Files\DsNET Corp [2012.01.30 12:40:48 | 013,758,448 | ---- | C] (DsNET Corp) -- C:\Users\Richard\Desktop\aTube_Catcher_Setup2.6.769.exe [2012.01.25 19:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus [2012.01.25 19:03:27 | 000,020,568 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys [2012.01.25 19:03:26 | 000,314,456 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys [2012.01.25 19:03:18 | 000,034,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys [2012.01.25 19:03:13 | 000,052,952 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys [2012.01.25 19:03:11 | 000,435,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys [2012.01.25 19:03:10 | 000,055,128 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys [2012.01.25 19:02:39 | 000,199,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe [2012.01.25 19:02:39 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr [2012.01.22 14:28:45 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Doom 3 [2012.01.22 13:53:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOOM 3 Resurrection of Evil [2012.01.22 13:44:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Doom 3 [2012.01.22 13:16:05 | 000,000,000 | ---D | C] -- C:\Program Files\Doom 3 [2012.01.18 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Bilder [2012.01.12 17:32:45 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam [2009.06.16 13:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\Richard\AppData\Roaming\*.tmp files -> C:\Users\Richard\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.02.07 21:41:21 | 000,001,356 | ---- | M] () -- C:\Users\Richard\AppData\Local\d3d9caps.dat [2012.02.07 21:21:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.07 21:18:37 | 000,289,888 | ---- | M] () -- C:\ProgramData\nvModes.001 [2012.02.07 21:18:37 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.07 21:18:37 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.06 21:48:31 | 000,030,208 | ---- | M] () -- C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.06 20:57:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Richard\Desktop\OTL.exe [2012.02.06 20:41:23 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.02.06 19:03:42 | 000,289,888 | ---- | M] () -- C:\ProgramData\nvModes.dat [2012.02.06 19:03:34 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.02.06 16:24:13 | 000,032,428 | ---- | M] () -- C:\Users\Richard\Desktop\Patrick_Star_Gone_Bad_by_KirbyOfStars[1].jpg [2012.02.05 21:11:51 | 007,536,640 | ---- | M] () -- C:\Users\Richard\Desktop\El Chupacabra.mp3 [2012.02.04 12:40:40 | 006,179,466 | ---- | M] () -- C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3 [2012.02.04 12:23:45 | 000,766,391 | ---- | M] () -- C:\Users\Richard\Desktop\Unbenannt.jpg [2012.02.04 12:14:38 | 084,155,271 | ---- | M] () -- C:\Users\Richard\Desktop\Resident Evil (Games).wmv [2012.02.04 04:12:03 | 000,539,136 | ---- | M] () -- C:\Users\Richard\Desktop\Mein Resident Evil Projekt.MSWMM [2012.02.04 03:01:11 | 807,898,963 | ---- | M] () -- C:\Users\Richard\Desktop\Resident_Evil_4_HD_Biohazard_4_HD_para_PS3_primeros_30_minutos_de_juego_Parte_1_2.wmv [2012.02.04 02:41:17 | 078,283,195 | ---- | M] () -- C:\Users\Richard\Desktop\Trailer 2.wmv [2012.02.02 18:23:08 | 000,072,319 | ---- | M] () -- C:\Users\Richard\Desktop\Bad+To+The+Bonehead+bttb+whac[1].jpg [2012.02.01 23:01:26 | 029,112,069 | ---- | M] () -- C:\Users\Richard\Desktop\Metro_2033_-_Nazi_Megaphone_Music.wmv [2012.02.01 22:41:42 | 004,406,567 | ---- | M] () -- C:\Users\Richard\Desktop\09-kalinka-russisch.mp3 [2012.02.01 22:20:41 | 002,389,465 | ---- | M] () -- C:\Users\Richard\Desktop\Katusha.mp3 [2012.02.01 15:15:11 | 029,699,186 | ---- | M] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.flv [2012.02.01 14:36:25 | 007,408,402 | ---- | M] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.mp3 [2012.01.31 10:59:48 | 063,035,150 | ---- | M] () -- C:\Users\Richard\Desktop\.wmv [2012.01.31 08:56:25 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForRichard.job [2012.01.30 19:55:14 | 073,269,329 | ---- | M] () -- C:\Users\Richard\Desktop\Hatecore.wmv [2012.01.30 19:01:03 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.01.30 19:01:03 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.01.30 19:01:03 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.01.30 19:01:03 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.01.30 13:27:36 | 028,715,189 | ---- | M] () -- C:\Users\Richard\Desktop\Iron Sky Teaser 2.wmv [2012.01.30 12:43:58 | 000,001,915 | ---- | M] () -- C:\Users\Public\Desktop\MP3 Downloader.lnk [2012.01.30 12:43:58 | 000,001,911 | ---- | M] () -- C:\Users\Public\Desktop\Video Search.lnk [2012.01.30 12:43:52 | 000,000,981 | ---- | M] () -- C:\Users\Public\Desktop\aTube Catcher.lnk [2012.01.30 12:40:58 | 013,758,448 | ---- | M] (DsNET Corp) -- C:\Users\Richard\Desktop\aTube_Catcher_Setup2.6.769.exe [2012.01.25 19:26:43 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2012.01.25 19:03:28 | 000,001,831 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2012.01.22 14:28:46 | 000,000,771 | ---- | M] () -- C:\Users\Richard\Desktop\Doom3.lnk [2012.01.22 14:26:48 | 019,653,399 | ---- | M] () -- C:\Users\Richard\Desktop\DOOM3-1.3.1.exe [2012.01.22 13:53:20 | 000,001,461 | ---- | M] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk [2012.01.22 13:53:16 | 000,000,338 | ---- | M] () -- C:\Windows\d3xp.ini [2012.01.22 13:44:29 | 000,001,415 | ---- | M] () -- C:\Users\Public\Desktop\Doom 3.lnk [2012.01.22 13:44:24 | 000,000,331 | ---- | M] () -- C:\Windows\doom3.ini [2012.01.20 17:26:07 | 033,520,769 | ---- | M] () -- C:\Users\Richard\Desktop\DeeEmGY_-_Unfinished_War.flv [2012.01.18 00:01:44 | 000,000,375 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2012.01.16 15:21:16 | 000,001,889 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2012.01.16 00:16:42 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI [2012.01.12 17:32:45 | 000,000,215 | ---- | M] () -- C:\Users\Richard\Desktop\Metro 2033.url [2012.01.12 09:14:11 | 000,410,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.01.11 15:27:40 | 025,374,587 | ---- | M] () -- C:\Users\Richard\Desktop\Nordglanz_-_Als_die_Alten_jung_noch_waren.wmv [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\Richard\AppData\Roaming\*.tmp files -> C:\Users\Richard\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.02.06 16:24:20 | 000,032,428 | ---- | C] () -- C:\Users\Richard\Desktop\Patrick_Star_Gone_Bad_by_KirbyOfStars[1].jpg [2012.02.05 21:10:36 | 007,536,640 | ---- | C] () -- C:\Users\Richard\Desktop\El Chupacabra.mp3 [2012.02.04 12:23:42 | 000,766,391 | ---- | C] () -- C:\Users\Richard\Desktop\Unbenannt.jpg [2012.02.04 12:12:27 | 084,155,271 | ---- | C] () -- C:\Users\Richard\Desktop\Resident Evil (Games).wmv [2012.02.04 04:12:02 | 000,539,136 | ---- | C] () -- C:\Users\Richard\Desktop\Mein Resident Evil Projekt.MSWMM [2012.02.04 02:47:45 | 807,898,963 | ---- | C] () -- C:\Users\Richard\Desktop\Resident_Evil_4_HD_Biohazard_4_HD_para_PS3_primeros_30_minutos_de_juego_Parte_1_2.wmv [2012.02.04 02:39:48 | 078,283,195 | ---- | C] () -- C:\Users\Richard\Desktop\Trailer 2.wmv [2012.02.02 18:23:28 | 000,072,319 | ---- | C] () -- C:\Users\Richard\Desktop\Bad+To+The+Bonehead+bttb+whac[1].jpg [2012.02.01 23:01:12 | 029,112,069 | ---- | C] () -- C:\Users\Richard\Desktop\Metro_2033_-_Nazi_Megaphone_Music.wmv [2012.02.01 22:41:26 | 004,406,567 | ---- | C] () -- C:\Users\Richard\Desktop\09-kalinka-russisch.mp3 [2012.02.01 22:20:35 | 002,389,465 | ---- | C] () -- C:\Users\Richard\Desktop\Katusha.mp3 [2012.02.01 15:13:17 | 029,699,186 | ---- | C] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.flv [2012.02.01 14:36:11 | 007,408,402 | ---- | C] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.mp3 [2012.01.31 10:56:54 | 063,035,150 | ---- | C] () -- C:\Users\Richard\Desktop\.wmv [2012.01.30 19:54:23 | 073,269,329 | ---- | C] () -- C:\Users\Richard\Desktop\Hatecore.wmv [2012.01.30 13:37:27 | 006,179,466 | ---- | C] () -- C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3 [2012.01.30 13:26:48 | 028,715,189 | ---- | C] () -- C:\Users\Richard\Desktop\Iron Sky Teaser 2.wmv [2012.01.30 12:43:58 | 000,001,915 | ---- | C] () -- C:\Users\Public\Desktop\MP3 Downloader.lnk [2012.01.30 12:43:58 | 000,001,911 | ---- | C] () -- C:\Users\Public\Desktop\Video Search.lnk [2012.01.30 12:43:52 | 000,000,981 | ---- | C] () -- C:\Users\Public\Desktop\aTube Catcher.lnk [2012.01.25 19:03:28 | 000,001,831 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk [2012.01.23 14:45:23 | 000,000,860 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.01.22 14:28:46 | 000,000,771 | ---- | C] () -- C:\Users\Richard\Desktop\Doom3.lnk [2012.01.22 14:26:32 | 019,653,399 | ---- | C] () -- C:\Users\Richard\Desktop\DOOM3-1.3.1.exe [2012.01.22 13:53:20 | 000,001,461 | ---- | C] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk [2012.01.22 13:53:16 | 000,000,338 | ---- | C] () -- C:\Windows\d3xp.ini [2012.01.22 13:44:29 | 000,001,415 | ---- | C] () -- C:\Users\Public\Desktop\Doom 3.lnk [2012.01.22 13:44:24 | 000,000,331 | ---- | C] () -- C:\Windows\doom3.ini [2012.01.20 17:24:00 | 033,520,769 | ---- | C] () -- C:\Users\Richard\Desktop\DeeEmGY_-_Unfinished_War.flv [2012.01.16 15:21:16 | 000,001,889 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2012.01.16 15:21:16 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk [2012.01.12 17:32:45 | 000,000,215 | ---- | C] () -- C:\Users\Richard\Desktop\Metro 2033.url [2012.01.11 15:26:47 | 025,374,587 | ---- | C] () -- C:\Users\Richard\Desktop\Nordglanz_-_Als_die_Alten_jung_noch_waren.wmv [2011.10.24 20:23:39 | 000,107,520 | -HS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2010.12.22 20:38:07 | 000,444,283 | ---- | C] () -- C:\Program Files\Common Files\WinPcapNmap.exe [2010.06.23 11:35:52 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2010.06.23 11:35:52 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2010.06.04 19:31:56 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini [2010.05.26 14:01:15 | 000,000,745 | ---- | C] () -- C:\Windows\CoD.INI [2010.05.18 00:47:52 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2010.05.11 19:08:30 | 000,000,620 | ---- | C] () -- C:\Windows\eReg.dat [2010.04.27 20:22:14 | 000,000,600 | ---- | C] () -- C:\Windows\Rtcw.INI [2010.04.17 20:30:41 | 000,289,888 | ---- | C] () -- C:\ProgramData\nvModes.dat [2010.04.17 20:30:41 | 000,289,888 | ---- | C] () -- C:\ProgramData\nvModes.001 [2010.04.13 17:49:45 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2010.03.10 19:56:41 | 000,000,416 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\burnaware.ini [2010.02.24 00:06:04 | 000,031,007 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\UserTile.png [2010.01.27 03:09:02 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll [2009.08.16 09:08:36 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009.07.23 15:15:27 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2009.07.23 11:17:28 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.07.23 11:17:27 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.06.16 13:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll [2009.06.16 12:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2009.06.09 08:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll [2009.03.08 21:39:00 | 000,000,095 | ---- | C] () -- C:\Users\Richard\AppData\Local\fusioncache.dat [2009.03.08 20:44:40 | 000,022,328 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\PnkBstrK.sys [2009.03.08 20:44:19 | 000,669,184 | ---- | C] () -- C:\Windows\System32\pbsvc.exe [2009.02.01 15:43:56 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2009.02.01 15:43:52 | 000,136,888 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.02.01 15:43:40 | 000,111,928 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2008.12.09 16:23:13 | 000,052,216 | RHS- | C] () -- C:\Users\Richard\AppData\Roaming\appconf32.exe [2008.10.12 21:13:55 | 000,000,604 | ---- | C] () -- C:\Windows\Sof2.INI [2008.07.03 16:04:27 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2008.07.03 16:04:27 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2008.07.03 16:04:27 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2008.04.18 20:29:11 | 000,000,583 | ---- | C] () -- C:\Windows\QIII.INI [2008.04.17 20:04:42 | 000,008,653 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate [2008.03.28 12:15:10 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.01.29 21:12:36 | 000,001,356 | ---- | C] () -- C:\Users\Richard\AppData\Local\d3d9caps.dat [2007.12.26 03:10:10 | 000,000,202 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\wklnhst.dat [2007.12.24 01:34:53 | 000,030,208 | ---- | C] () -- C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.10.12 04:54:08 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2007.10.12 04:54:08 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2007.10.12 04:54:08 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2007.10.12 04:54:08 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2007.10.11 19:43:36 | 000,114,973 | ---- | C] () -- C:\Windows\hpqins13.dat [2007.10.11 19:39:06 | 000,003,758 | ---- | C] () -- C:\Windows\HCWPNP.INI [2007.10.11 19:38:47 | 000,066,048 | ---- | C] () -- C:\Windows\System32\hcwxds.dll [2007.10.11 19:31:42 | 000,061,440 | ---- | C] () -- C:\Windows\System32\OsdRemove.exe [2007.10.11 19:29:23 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll [2007.10.11 19:29:23 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll [2007.02.05 19:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI [2007.01.26 00:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\System32\mase32.dll [2007.01.26 00:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\System32\ma32.dll [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,410,016 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.06.23 09:09:34 | 000,019,968 | R--- | C] () -- C:\Windows\System32\cpuinf32.dll ========== LOP Check ========== [2009.12.27 01:54:47 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Apowersoft [2011.12.30 20:19:00 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bioshock [2010.04.17 21:22:18 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bioshock2 [2010.09.08 20:16:45 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bytemobile [2011.10.24 19:53:32 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Cocoon Software [2008.12.22 17:10:57 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Codemasters [2008.10.12 19:51:26 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\DAEMON Tools [2011.05.30 18:19:49 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Desktopicon [2010.12.19 17:12:25 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers [2010.04.27 14:11:31 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\FinalVideoDownloader [2010.02.02 16:01:58 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Gearbox Software [2012.02.06 18:56:27 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\ICQ [2012.02.06 18:56:18 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\kock [2008.12.29 17:21:08 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Leadertech [2008.10.29 16:44:11 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Mail.Ru [2010.03.13 14:18:13 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\MetaProducts [2010.02.18 21:09:10 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Mra [2010.02.24 00:06:04 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\PeerNetworking [2010.09.25 12:01:01 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\PhotoScape [2010.04.02 14:09:09 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Sony [2010.04.02 13:58:52 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Sony Setup [2010.07.16 22:23:59 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Stardock [2007.12.26 03:10:36 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Template [2011.04.17 10:44:12 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\thriXXX [2008.12.29 22:11:10 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Touchstone [2010.08.03 03:03:50 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\TuneUp Software [2012.02.06 20:48:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\UAs [2008.12.29 19:05:47 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Ubisoft [2010.01.16 15:26:01 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\UltraGet [2011.04.11 21:30:02 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\VDownloader [2010.07.19 14:27:22 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\VistaCodecs [2010.09.08 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Vodafone [2010.09.08 20:18:30 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Vodafone Mobile Connect [2008.04.11 14:21:21 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\WinBatch [2010.07.31 23:26:28 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Xilisoft [2012.02.06 20:48:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\xmldm [2012.01.16 17:55:31 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Youtube Downloader HD [2012.02.07 21:18:53 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2007.12.19 20:46:07 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2009.10.31 16:43:06 | 000,000,000 | -HSD | M] -- C:\Boot [2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2007.12.19 20:36:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2009.12.26 12:50:45 | 000,000,000 | -H-D | M] -- C:\hp [2010.12.05 16:45:16 | 000,000,000 | RH-D | M] -- C:\MSOCache [2010.07.21 19:02:11 | 000,000,000 | ---D | M] -- C:\MyAudio [2009.09.05 21:08:24 | 000,000,000 | ---D | M] -- C:\NVIDIA [2012.01.30 13:24:31 | 000,000,000 | R--D | M] -- C:\Program Files [2012.02.01 20:13:00 | 000,000,000 | -H-D | M] -- C:\ProgramData [2007.12.19 20:36:42 | 000,000,000 | -HSD | M] -- C:\Programme [2012.02.04 20:28:36 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.03.13 14:18:28 | 000,000,000 | R--D | M] -- C:\Users [2012.01.31 08:56:16 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.03.29 03:09:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2008.03.29 03:09:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008.03.29 03:09:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EXPLORER.EXE > [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2008.03.29 03:15:24 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe [2008.03.29 03:15:23 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2009.02.01 15:19:44 | 000,004,608 | ---- | M] () MD5=F737B39DC1264F170DD0F43249866D6A -- C:\Users\Richard\AppData\Local\Xenocode\ApplianceCaches\GameCamV2.exe_v70A6B3A1\Native\STUBEXE\@WINDIR@\explorer.exe [2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe [2008.01.19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTORV.SYS > [2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2007.10.12 05:02:17 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2007.10.12 05:02:17 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll [2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys [2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > [2011.05.20 18:57:08 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll [2011.05.20 18:57:08 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < %USERPROFILE%\*.* > [2012.02.07 21:56:07 | 006,029,312 | -HS- | M] () -- C:\Users\Richard\ntuser.dat [2012.02.07 21:56:07 | 000,262,144 | -H-- | M] () -- C:\Users\Richard\ntuser.dat.LOG1 [2007.12.19 20:40:07 | 000,000,000 | -H-- | M] () -- C:\Users\Richard\ntuser.dat.LOG2 [2010.07.21 02:29:04 | 000,065,536 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.07.21 02:29:04 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2007.12.19 23:10:27 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2012.02.06 21:52:17 | 000,065,536 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TM.blf [2012.02.06 21:52:17 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TMContainer00000000000000000001.regtrans-ms [2010.07.21 15:36:07 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TMContainer00000000000000000002.regtrans-ms [2007.12.19 20:40:07 | 000,000,020 | -HS- | M] () -- C:\Users\Richard\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < > ========== Files - Unicode (All) ========== [2012.02.03 14:57:43 | 005,452,948 | ---- | M] ()(C:\Users\Richard\Desktop\????? - ????.mp3) -- C:\Users\Richard\Desktop\Мечта - Один.mp3 [2012.02.03 01:11:19 | 005,452,948 | ---- | C] ()(C:\Users\Richard\Desktop\????? - ????.mp3) -- C:\Users\Richard\Desktop\Мечта - Один.mp3 [2012.02.01 19:47:48 | 000,000,000 | ---D | M](C:\Users\Richard\Desktop\??????) -- C:\Users\Richard\Desktop\Киборг [2012.01.29 21:28:51 | 000,000,000 | ---D | M](C:\Users\Richard\Desktop\????????) -- C:\Users\Richard\Desktop\Коловрат [2012.01.23 16:23:39 | 000,000,000 | ---D | C](C:\Users\Richard\Desktop\????????) -- C:\Users\Richard\Desktop\Коловрат [2012.01.20 18:46:34 | 016,308,921 | ---- | M] ()(C:\Users\Richard\Desktop\???????? ???????.wmv) -- C:\Users\Richard\Desktop\Кавказцы звереют.wmv [2012.01.20 18:46:11 | 016,308,921 | ---- | C] ()(C:\Users\Richard\Desktop\???????? ???????.wmv) -- C:\Users\Richard\Desktop\Кавказцы звереют.wmv [2012.01.18 22:49:36 | 000,000,000 | ---D | C](C:\Users\Richard\Desktop\??????) -- C:\Users\Richard\Desktop\Киборг ========== Alternate Data Streams ========== @Alternate Data Stream - 64 bytes -> C:\Users\Richard\Desktop\El Chupacabra.mp3:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3:TOC.WMV @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:8CE646EE @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D1B5B4F1 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:010ADD2C < End of report > |
|
07.02.2012, 22:03
| #4 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" Habe in einem anderen Forum dieselben Beiträge gelesen ist es normal das bei mir Extra Txt.Logfile mir nicht anzeigt? nur OTL Tx.T |
|
08.02.2012, 11:52
| #5 |
| /// Malware-holic | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" hi dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [Userinit] C:\Users\Richard\AppData\Roaming\appconf32.exe ()
O4 - HKCU..\Run: [Firefox helper] C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe ()
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\xmldm
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\kock
:Files
C:\Users\Richard\AppData\Roaming\appconf32.exe
C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Drücke bitte die  + E Taste.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.02.2012, 12:55
| #6 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully. C:\Users\Richard\AppData\Roaming\appconf32.exe moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Firefox helper deleted successfully. C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully. C:\Users\Richard\AppData\Roaming\xmldm folder moved successfully. C:\Users\Richard\AppData\Roaming\kock folder moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 41620 bytes User: Default User ->Flash cache emptied: 0 bytes User: IUSR_NMPR User: Public User: Richard ->Flash cache emptied: 43173 bytes Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: IUSR_NMPR ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Richard ->Temp folder emptied: 140557920 bytes ->Temporary Internet Files folder emptied: 435782565 bytes ->Java cache emptied: 50222685 bytes ->FireFox cache emptied: 188612851 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 466944 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4209441 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3826584 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 13690539 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 799,00 mb OTL by OldTimer - Version 3.2.31.0 log created on 02082012_124509 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
08.02.2012, 12:56
| #7 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" ist der Virus weg? weil bekomme jetzt keine warn meldung mehr. ))) |
|
08.02.2012, 13:30
| #8 |
| /// Malware-holic | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" wo ist der upload? ich warte noch auf den.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.02.2012, 14:55
| #9 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" ok habe die MovedFile hochgeladen...)) |
|
08.02.2012, 15:17
| #10 |
| /// Malware-holic | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" danke. nutzt du das system für onlinebanking, einkäufe, sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie zb berufliches?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.02.2012, 17:21
| #11 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" nein eigentlich nicht,))) nur Pirvat.)) |
|
08.02.2012, 17:22
| #12 |
| /// Malware-holic | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" per was? Pirvat kenne ich nicht.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.02.2012, 17:25
| #13 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" also quasi. alles möglcihe Filme gucken oder musik hören halt, kaum ging ich auf eine Stream seite iLoad.to bekam ich diese Meldung. habe übrigens Avast als Antiviren programm. |
|
08.02.2012, 17:34
| #14 |
| /// Malware-holic | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" ja, selbst schuld, wer sich illegale inhalte im netz anguckt hatts nicht besser verdient. die leute machen richtig geld mit euch, investiere es lieber in filme.... Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.02.2012, 17:36
| #15 |
| | "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" Sorry, wollte fragen, muss ich mein PC fomartieren? ist der Virus noch da ? oder ist der weg? sorry ,kenn mich überhaupt nicht damit aus  |
|
| Themen zu "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert" |
| 32bit, achtung, achtung!, blockiert, brauche, dankbar, dringend, filme, folge, folgendes, forum, gucken, infiziertem, inhalt, meldung, neu, plötzlich, problem, schnelle, schnelle hilfe, seite, seiten, sicherheitsgründen, stream, vista, windows vista, windowssystem blockiert, wurde ihr |
Linear-Darstellung
