| |
| |||||||
Log-Analyse und Auswertung: OTLPE.txt wie geht es nun weiter?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
26.02.2012, 23:46
| #1 |
| |  OTLPE.txt wie geht es nun weiter? Hi, habe gerade per reatogo einen otlpe-scan meines System gemacht. Leider weiß ich jetzt nicht, wie es weiter geht. ich habe gelesen, dass ich das entstandene txt.file hier posten soll. Der Laptop fährt nicht mehr hoch und zeigt einen weißen Bildschirm an.... Helft mir!!! BitteOTL Logfile: Code:
ATTFilter OTL logfile created on: 2/26/2012 11:03:09 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE 64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86) Drive C: | 92.80 Mb Total Space | 68.63 Mb Free Space | 73.95% Space Free | Partition Type: NTFS Drive D: | 105.91 Gb Total Space | 19.85 Gb Free Space | 18.74% Space Free | Partition Type: NTFS Drive E: | 346.75 Gb Total Space | 226.86 Gb Free Space | 65.42% Space Free | Partition Type: NTFS Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010/06/11 07:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc) SRV:64bit: - [2010/03/30 04:02:08 | 000,189,304 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\nwtsrv.exe -- (nwtsrv) SRV:64bit: - [2010/03/30 04:01:06 | 000,143,224 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\certsrv.exe -- (certsrv) SRV:64bit: - [2010/03/30 03:59:54 | 000,335,224 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\avmike.exe -- (avmike) SRV:64bit: - [2010/01/28 18:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009/06/06 12:54:34 | 001,054,960 | ---- | M] ( ) [Auto] -- D:\Windows\System32\DKabcoms.exe -- (dkab_device) SRV - [2012/02/23 02:28:45 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand] -- D:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012/02/16 08:27:25 | 000,024,576 | ---- | M] (Realtek Semiconductor.) [Auto] -- D:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe -- (SetupARService) SRV - [2012/01/13 08:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011/10/15 03:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011/09/12 02:58:19 | 000,688,648 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files (x86)\StarMoney Business 5.0 Deutsche Bank Edition\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney Business 5.0 OnlineUpdate) SRV - [2011/07/17 06:22:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/05/10 03:50:16 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011/02/18 11:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- D:\Windows\SysWOW64\ZoneLabs\vsmon.exe -- (vsmon) SRV - [2011/02/02 05:00:32 | 000,052,288 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- D:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R) SRV - [2010/07/16 11:23:30 | 006,638,080 | ---- | M] () [On_Demand] -- D:\Program Files (x86)\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe -- (AllShare) SRV - [2010/07/13 06:59:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand] -- D:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010/06/28 08:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2010/06/22 01:34:48 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2010/05/26 21:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand] -- D:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService) SRV - [2010/04/13 11:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010/03/17 23:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R) SRV - [2010/03/17 23:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R) SRV - [2010/01/08 08:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2009/09/23 14:59:36 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto] -- D:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/06/06 12:54:36 | 000,603,376 | ---- | M] ( ) [Auto] -- D:\Windows\SysWow64\DKabcoms.exe -- (dkab_device) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011/12/10 09:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011/08/02 10:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011/07/17 06:22:27 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011/07/17 06:22:27 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011/07/07 18:21:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011/02/16 11:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb) DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010/06/17 04:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2010/05/15 10:30:52 | 000,458,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- D:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant) DRV:64bit: - [2010/05/15 07:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM) DRV:64bit: - [2010/05/11 05:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr) DRV:64bit: - [2010/03/30 04:00:16 | 000,412,024 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- D:\Windows\System32\drivers\avmnwim.sys -- (NWIM) DRV:64bit: - [2009/09/17 00:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009/08/21 03:52:09 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009/07/13 19:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM) DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/02 21:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009/06/02 21:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009/06/02 21:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009/01/09 08:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RimSerial_AMD64.sys -- (RimVSerPort) DRV:64bit: - [2008/09/26 11:06:24 | 000,045,320 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System] -- D:\Windows\System32\drivers\uimx64.sys -- (UimBus) DRV:64bit: - [2008/09/26 11:06:24 | 000,037,392 | ---- | M] (Paragon Software Group) [Kernel | Boot] -- D:\Windows\System32\drivers\hotcore3.sys -- (hotcore3) DRV - [2010/05/15 10:30:52 | 000,458,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- D:\Windows\SysWOW64\drivers\vsdatant.sys -- (Vsdatant) DRV - [2006/07/24 09:05:00 | 000,005,632 | ---- | M] () [File_System | System] -- D:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\christoph.utess_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\christoph.utess_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\christoph.utess_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\christoph.utess_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\Gast_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\Gast_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\Gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962 IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: support@lastpass.com:1.72.0 FF - prefs.js..extensions.enabledItems: verify-u@cybits.de:1.2 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4 FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3 FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@checkpoint.com/FFApi: File not found FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: D:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: E:\Programme\Firefox\components [2012/02/20 13:26:58 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: E:\Programme\Firefox\plugins [2011/12/20 13:23:15 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: E:\Programme\Firefox\components [2012/02/20 13:26:58 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: E:\Programme\Firefox\plugins [2011/12/20 13:23:15 | 000,000,000 | ---D | M] [2010/10/16 09:07:36 | 000,000,000 | ---D | M] (No name found) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Extensions [2012/02/15 09:24:49 | 000,000,000 | ---D | M] (No name found) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions [2011/12/20 13:24:10 | 000,000,000 | ---D | M] (Garmin Communicator) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2012/02/15 09:24:49 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011/07/31 11:31:00 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/01/30 16:16:00 | 000,000,000 | ---D | M] (LastPass) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\support@lastpass.com [2011/12/27 16:26:28 | 000,000,000 | ---D | M] ([verify-U]-Add-on) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\verify-u_2@cybits.de File not found (No name found) -- () (No name found) -- D:\USERS\CHRISTOPH.UTESS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\W335BMXI.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3:64bit: - HKU\christoph.utess_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\christoph.utess_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3:64bit: - HKU\Gast_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\Gast_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3:64bit: - HKU\UpdatusUser_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\UpdatusUser_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [Acer ePower Management] D:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [mwlDaemon] D:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [PLFSetI] D:\Windows\PLFSetI.exe () O4:64bit: - HKLM..\Run: [XboxStat] D:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [APSDaemon] D:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BackupManagerTray] D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [EgisTecPMMUpdate] D:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] D:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAStorIcon] D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [LexwareInfoService] D:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG) O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [PDFPrint] E:\Programme\pdf24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] D:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [SMB50StarMoneyRunEntry] D:\Program Files (x86)\StarMoney Business 5.0 Deutsche Bank Edition\app\oflagent.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) O4 - HKLM..\Run: [SuiteTray] D:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKLM..\Run: [ZoneAlarm Client] D:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKU\christoph.utess_ON_D..\Run: [m29dAlvRev1yx2E] D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.) O4 - HKU\christoph.utess_ON_D..\Run: [Steam] E:\Programme\Steam\Steam.exe (Valve Corporation) O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\UpdatusUser_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found O4 - HKU\UpdatusUser_ON_D..\RunOnce: [mctadmin] File not found O4 - HKU\UpdatusUser_ON_D..\RunOnce: [ScrSav] D:\Program Files (x86)\Acer\Screensaver\run_Acer.exe () O4 - Startup: D:\Users\christoph.utess\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\christoph.utess\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: An vorhandenes PDF anfügen - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\christoph.utess\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13:64bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\haufereader - No CLSID value found O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKU\christoph.utess_ON_D Winlogon: Shell - (C:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe) - D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell - "" = AutoRun O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell - "" = AutoRun O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell - "" = AutoRun O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell - "" = AutoRun O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\Autorun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/02/26 15:22:45 | 000,302,592 | ---- | C] (Cutting Edge Software Inc.) -- D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe [2012/02/20 13:44:31 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\CAPCOM [2012/02/20 13:41:39 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\CAPCOM [2012/02/17 07:33:34 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sega [2012/02/17 05:54:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Roaming\DAEMON Tools Lite [2012/02/17 05:54:04 | 000,000,000 | ---D | C] -- D:\ProgramData\DAEMON Tools Lite [2012/02/17 05:46:52 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Games for Windows - LIVE Demos [2012/02/17 05:45:27 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace [2012/02/16 15:55:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Rockstar Games [2012/02/16 15:19:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\Rockstar Games [2012/02/16 15:17:04 | 000,000,000 | -HSD | C] -- D:\ProgramData\SecuROM [2012/02/16 15:13:19 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Microsoft Games for Windows - LIVE [2012/02/16 14:30:54 | 000,634,880 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msvcrt.dll [2012/02/16 14:30:40 | 000,702,464 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll [2012/02/16 14:30:40 | 000,599,552 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\msfeeds.dll [2012/02/16 14:30:39 | 000,247,808 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll [2012/02/16 14:30:38 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ieui.dll [2012/02/16 14:30:38 | 000,097,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtmled.dll [2012/02/16 14:30:38 | 000,067,072 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\mshtmled.dll [2012/02/16 14:30:36 | 000,134,144 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\url.dll [2012/02/16 14:30:36 | 000,132,096 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\url.dll [2012/02/16 09:05:20 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\76561198058820333 [2012/02/16 08:48:34 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Common Files\Steam [2012/02/16 08:48:32 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Verlauf [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Temporary Internet Files [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Videos [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Musik [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Bilder [2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Anwendungsdaten [2012/02/16 07:53:24 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\LocalLow [2012/02/16 07:53:23 | 000,000,000 | --SD | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft [2012/02/16 07:53:23 | 000,000,000 | R--D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012/02/16 07:53:23 | 000,000,000 | R--D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Temp [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Roaming [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Microsoft Help [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Microsoft [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Media Center Programs [2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local [2012/02/16 07:53:15 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\NVIDIA Corporation [2012/02/16 07:52:24 | 000,539,456 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhotkey.dll [2012/02/16 07:52:24 | 000,137,536 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvshext.dll [2012/02/16 07:52:23 | 005,067,584 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvsvc64.dll [2012/02/16 07:52:22 | 003,074,368 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvsvcr.dll [2012/02/16 07:52:20 | 010,406,208 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcpl.dll [2012/02/16 07:52:20 | 000,837,952 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\easyupdatusapiu64.dll [2012/02/16 07:52:20 | 000,222,528 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvmctray.dll [2012/02/16 07:46:49 | 001,452,648 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhdagenco6420102.dll [2012/02/16 07:46:49 | 000,174,184 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\drivers\nvhda64v.sys [2012/02/16 07:46:49 | 000,029,288 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhdap64.dll [2012/02/16 07:46:44 | 008,791,360 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvwgf2umx.dll [2012/02/16 07:46:44 | 007,041,856 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvwgf2um.dll [2012/02/16 07:46:44 | 000,068,928 | ---- | C] (Khronos Group) -- D:\Windows\System32\OpenCL.dll [2012/02/16 07:46:44 | 000,061,248 | ---- | C] (Khronos Group) -- D:\Windows\SysWow64\OpenCL.dll [2012/02/16 07:46:43 | 024,796,992 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcompiler.dll [2012/02/16 07:46:43 | 024,742,720 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvoglv64.dll [2012/02/16 07:46:43 | 018,871,616 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvoglv32.dll [2012/02/16 07:46:43 | 017,248,576 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcompiler.dll [2012/02/16 07:46:43 | 015,693,120 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvd3dumx.dll [2012/02/16 07:46:43 | 013,205,312 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvd3dum.dll [2012/02/16 07:46:43 | 007,581,504 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuda.dll [2012/02/16 07:46:43 | 005,578,560 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuda.dll [2012/02/16 07:46:43 | 002,808,128 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvapi64.dll [2012/02/16 07:46:43 | 002,542,912 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuvid.dll [2012/02/16 07:46:43 | 002,458,432 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvapi.dll [2012/02/16 07:46:43 | 002,401,088 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuvid.dll [2012/02/16 07:46:43 | 002,232,128 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuvenc.dll [2012/02/16 07:46:43 | 002,099,520 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuvenc.dll [2012/02/16 07:46:43 | 001,533,248 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvdispco64.dll [2012/02/16 07:46:43 | 001,454,400 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvgenco64.dll [2012/02/15 15:08:58 | 000,000,000 | ---D | C] -- D:\Program Files\Windows XP Mode [2012/02/15 14:54:25 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\kaneandlynch [2012/02/15 14:16:02 | 000,000,000 | ---D | C] -- D:\Windows\SysWow64\xlive [2012/02/13 13:26:43 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warmux [2012/02/13 13:26:23 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Warmux [2012/02/13 13:26:23 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Warmux [2012/02/13 09:56:29 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAMSUNG [2012/02/09 17:05:59 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Roaming\Malwarebytes [2012/02/09 17:05:55 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- D:\Windows\System32\drivers\mbam.sys [2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware [2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\ProgramData\Malwarebytes [2010/10/18 02:16:22 | 001,056,768 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabserv.dll [2010/10/18 02:16:22 | 000,802,816 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcomc.dll [2010/10/18 02:16:22 | 000,446,464 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabhcp.dll [2010/10/18 02:16:22 | 000,376,832 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcomm.dll [2010/10/18 02:16:21 | 000,603,376 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcoms.exe [2010/08/25 14:32:59 | 000,051,712 | ---- | C] ( ) -- D:\Windows\AutosetFrequency.exe [4 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ] [1 D:\Windows\System32\drivers\*.tmp files -> D:\Windows\System32\drivers\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/02/26 15:34:03 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat [2012/02/26 15:28:21 | 3113,254,912 | -HS- | M] () -- D:\hiberfil.sys [2012/02/26 15:25:29 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/02/26 15:22:45 | 000,302,592 | ---- | M] (Cutting Edge Software Inc.) -- D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe [2012/02/26 14:42:09 | 000,009,920 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/02/26 14:42:09 | 000,009,920 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/02/26 07:29:00 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/02/25 16:22:36 | 000,017,408 | ---- | M] () -- D:\Users\christoph.utess\AppData\Local\WebpageIcons.db [2012/02/22 14:30:10 | 000,657,676 | ---- | M] () -- D:\Windows\System32\perfh007.dat [2012/02/22 14:30:10 | 000,618,912 | ---- | M] () -- D:\Windows\System32\perfh009.dat [2012/02/22 14:30:10 | 000,131,016 | ---- | M] () -- D:\Windows\System32\perfc007.dat [2012/02/22 14:30:10 | 000,107,232 | ---- | M] () -- D:\Windows\System32\perfc009.dat [2012/02/21 04:12:42 | 000,147,608 | ---- | M] () -- D:\Users\christoph.utess\Desktop\72C2A6331B.pdf [2012/02/20 13:41:00 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games [2012/02/17 07:33:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sega [2012/02/17 05:45:27 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace [2012/02/17 05:45:08 | 000,001,342 | ---- | M] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk [2012/02/17 04:52:37 | 000,486,472 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT [2012/02/16 18:34:09 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012/02/16 09:05:09 | 000,466,456 | ---- | M] (Creative Labs) -- D:\Windows\System32\wrap_oal.dll [2012/02/16 09:05:09 | 000,444,952 | ---- | M] (Creative Labs) -- D:\Windows\SysWow64\wrap_oal.dll [2012/02/16 09:05:09 | 000,122,904 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\System32\OpenAL32.dll [2012/02/16 09:05:09 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\SysWow64\OpenAL32.dll [2012/02/16 08:48:36 | 000,000,656 | ---- | M] () -- D:\Users\Public\Desktop\Steam.lnk [2012/02/16 08:48:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012/02/15 14:55:48 | 000,001,024 | RH-- | M] () -- D:\Users\Public\Documents\NTIMMV9Acer.dll [2012/02/15 14:55:07 | 000,001,024 | RH-- | M] () -- D:\Users\Public\Documents\NTILiveUpdateV9.dll [2012/02/15 14:47:51 | 000,000,000 | RH-- | M] () -- D:\Windows\SysWow64\NTIMMV9Acer.dll [2012/02/15 14:47:49 | 000,000,000 | RH-- | M] () -- D:\Windows\SysWow64\NTILiveUpdateV9.dll [2012/02/13 13:26:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warmux [2012/02/13 09:56:47 | 000,002,046 | ---- | M] () -- D:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk [2012/02/13 09:56:29 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAMSUNG [2012/02/13 05:48:54 | 000,060,018 | ---- | M] () -- D:\Users\christoph.utess\Documents\11_Excel BWA Jahresübersicht per 31 12 2011_540.pdf [2012/02/11 05:46:06 | 000,002,675 | ---- | M] () -- D:\Users\Public\Desktop\QuickSteuer 2012.lnk [2012/02/11 05:46:06 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware [2012/02/11 05:39:02 | 000,080,787 | ---- | M] () -- D:\Users\christoph.utess\Documents\QuickSteuer_2012_Dasi.zip [2012/02/10 13:21:35 | 000,351,542 | ---- | M] () -- D:\Users\christoph.utess\Desktop\20120208_DISQ-n-tv_Shopping-Clubs_Dokumentation.pdf [2012/02/09 17:10:46 | 000,002,054 | ---- | M] () -- D:\Users\christoph.utess\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012/02/09 17:10:46 | 000,001,983 | ---- | M] () -- D:\Users\christoph.utess\Desktop\Avira DE-Cleaner.lnk [2012/02/09 17:05:55 | 000,001,117 | ---- | M] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/02/09 17:05:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/02/08 17:52:49 | 000,465,795 | ---- | M] () -- D:\Users\christoph.utess\Desktop\FLT_1BEYGA1072_0.pdf [4 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ] [1 D:\Windows\System32\drivers\*.tmp files -> D:\Windows\System32\drivers\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/02/21 04:12:42 | 000,147,608 | ---- | C] () -- D:\Users\christoph.utess\Desktop\72C2A6331B.pdf [2012/02/17 05:45:08 | 000,001,342 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk [2012/02/16 08:48:36 | 000,000,656 | ---- | C] () -- D:\Users\Public\Desktop\Steam.lnk [2012/02/16 07:53:23 | 000,000,290 | ---- | C] () -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk [2012/02/16 07:53:23 | 000,000,272 | ---- | C] () -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk [2012/02/15 14:47:51 | 000,000,000 | RH-- | C] () -- D:\Windows\SysWow64\NTIMMV9Acer.dll [2012/02/15 14:47:49 | 000,000,000 | RH-- | C] () -- D:\Windows\SysWow64\NTILiveUpdateV9.dll [2012/02/13 09:56:47 | 000,002,046 | ---- | C] () -- D:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk [2012/02/13 05:48:53 | 000,060,018 | ---- | C] () -- D:\Users\christoph.utess\Documents\11_Excel BWA Jahresübersicht per 31 12 2011_540.pdf [2012/02/11 05:39:00 | 000,080,787 | ---- | C] () -- D:\Users\christoph.utess\Documents\QuickSteuer_2012_Dasi.zip [2012/02/10 13:21:34 | 000,351,542 | ---- | C] () -- D:\Users\christoph.utess\Desktop\20120208_DISQ-n-tv_Shopping-Clubs_Dokumentation.pdf [2012/02/09 17:10:46 | 000,002,054 | ---- | C] () -- D:\Users\christoph.utess\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012/02/09 17:10:46 | 000,001,983 | ---- | C] () -- D:\Users\christoph.utess\Desktop\Avira DE-Cleaner.lnk [2012/02/09 17:05:55 | 000,001,117 | ---- | C] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/02/08 17:52:49 | 000,465,795 | ---- | C] () -- D:\Users\christoph.utess\Desktop\FLT_1BEYGA1072_0.pdf [2012/01/22 05:26:34 | 000,003,584 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011/11/06 18:57:09 | 000,000,000 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\{4768C36A-57F7-4532-BA64-9D51C13EB6F0} [2011/10/15 06:09:21 | 001,500,444 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI [2011/10/15 06:08:03 | 000,000,000 | ---- | C] () -- D:\ProgramData\LauncherAccess.dt [2011/10/15 06:05:02 | 000,005,632 | ---- | C] () -- D:\Windows\SysWow64\drivers\StarOpen.sys [2011/09/28 11:44:14 | 000,179,271 | ---- | C] () -- D:\Windows\SysWow64\xlive.dll.cat [2011/06/23 05:11:00 | 000,252,928 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll [2011/03/17 05:48:57 | 000,002,560 | ---- | C] () -- D:\Windows\_MSRSTRT.EXE [2011/02/27 05:18:04 | 000,017,408 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\WebpageIcons.db [2011/02/13 04:23:12 | 000,000,432 | ---- | C] () -- D:\Windows\BRWMARK.INI [2011/02/13 04:23:12 | 000,000,034 | ---- | C] () -- D:\Windows\SysWow64\BD2030.DAT [2010/10/23 02:14:35 | 000,000,034 | ---- | C] () -- D:\Windows\cdplayer.ini [2010/10/18 02:33:19 | 000,266,152 | ---- | C] () -- D:\Windows\hpwins23.dat [2010/10/17 02:27:29 | 000,004,096 | ---- | C] () -- D:\Windows\d3dx.dat [2010/10/16 09:07:32 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat [2010/08/25 14:32:59 | 000,206,208 | ---- | C] () -- D:\Windows\PLFSetI.exe [2010/08/25 14:32:59 | 000,000,637 | ---- | C] () -- D:\Windows\AutoSetFrequency.ini [2010/08/25 14:32:59 | 000,000,378 | ---- | C] () -- D:\Windows\PidList.ini [2010/07/13 06:45:37 | 000,131,984 | ---- | C] () -- D:\ProgramData\FullRemove.exe [2010/07/13 06:16:01 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.dll [2010/07/13 06:15:32 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.exe [2009/11/06 04:17:18 | 000,001,843 | ---- | C] () -- D:\Windows\hpwmdl23.dat [2009/09/30 05:05:48 | 000,290,816 | ---- | C] () -- D:\Windows\SysWow64\nsldap32v60.dll [2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat [2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT [2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat [2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin [2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll [2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll [2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat [2008/10/30 11:00:22 | 000,048,640 | ---- | C] () -- D:\Windows\SysWow64\nsldapssl32v60.dll [2008/10/30 10:59:24 | 000,025,088 | ---- | C] () -- D:\Windows\SysWow64\nsldappr32v60.dll [2006/04/21 04:08:22 | 000,253,952 | ---- | C] () -- D:\Windows\SysWow64\HtmlHelp.dll [2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldapssl32v50.dll [2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldappr32v50.dll [2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldap32v50.dll ========== LOP Check ========== [2010/07/13 06:55:11 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer [2010/10/17 02:28:23 | 000,000,000 | ---D | M] -- D:\ProgramData\AirportMania [2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data [2011/07/31 04:54:58 | 000,000,000 | ---D | M] -- D:\ProgramData\AVM [2010/07/13 07:02:48 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager [2012/02/09 17:34:38 | 000,000,000 | ---D | M] -- D:\ProgramData\boost_interprocess [2011/02/04 17:07:33 | 000,000,000 | ---D | M] -- D:\ProgramData\CheckPoint [2010/12/11 11:52:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Codemasters [2012/02/17 05:54:14 | 000,000,000 | ---D | M] -- D:\ProgramData\DAEMON Tools Lite [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents [2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente [2011/10/12 16:41:49 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core [2010/08/25 14:23:17 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS [2011/10/12 16:41:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts [2010/07/13 06:44:08 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi [2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites [2011/05/21 06:07:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Garmin [2012/01/22 16:04:43 | 000,000,000 | ---D | M] -- D:\ProgramData\Haufe [2012/01/23 05:47:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Lexware [2011/09/09 07:11:40 | 000,000,000 | ---D | M] -- D:\ProgramData\MSScanAppDataDir [2010/10/16 04:34:33 | 000,000,000 | ---D | M] -- D:\ProgramData\oem [2012/02/09 16:50:19 | 000,000,000 | ---D | M] -- D:\ProgramData\Origin [2011/03/12 23:15:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Partner [2011/10/23 07:16:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Research In Motion [2011/05/26 10:34:51 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney Business 5.0 [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu [2010/10/16 04:31:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü [2010/10/17 02:28:25 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates [2010/10/16 04:31:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen [2011/04/04 04:13:35 | 000,000,000 | ---D | M] -- D:\ProgramData\ZoneFiveSoftware [2011/10/16 04:35:39 | 000,000,000 | ---D | M] -- D:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} [2012/02/01 01:56:25 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 144 bytes -> D:\ProgramData\Temp:5D7E5A8F @Alternate Data Stream - 143 bytes -> D:\ProgramData\Temp:CDFF58FE < End of report > |
|
27.02.2012, 11:12
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | OTLPE.txt wie geht es nun weiter? Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?
__________________Abgesicherter Modus zur Bereinigung
__________________ |
|
27.02.2012, 20:26
| #3 |
| | OTLPE.txt wie geht es nun weiter? Nee, leider geht der auch nicht...es ist alles weiß :-(
__________________ |
|
27.02.2012, 21:48
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | OTLPE.txt wie geht es nun weiter? Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O4 - HKU\christoph.utess_ON_D..\Run: [m29dAlvRev1yx2E] D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKU\christoph.utess_ON_D Winlogon: Shell - (C:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe) - D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
@Alternate Data Stream - 144 bytes -> D:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 143 bytes -> D:\ProgramData\Temp:CDFF58FE
:Files
D:\Users\christoph.utess\AppData\Roaming\*.exe
D:\Users\christoph.utess\AppData\Local\76561198058820333
:Commands
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann! Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen! 2.) Ordner movedfiles in C:\_OTL in eine Datei zippen 3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu OTLPE.txt wie geht es nun weiter? |
| alternate, antivir, autorun, avira, bho, bildschirm, bonjour, converter, defender, desktop, deutsche bank, disabletaskmgr, entfernen, error, excel, explorer, firefox, format, google earth, helper, home, launch, locker, logfile, mbamservice.exe, mp3, mywinlocker, nvidia, plug-in, pmmupdate.exe, realtek, registry, software, starmoney, studio, system, version=1.0, windows xp |
Linear-Darstellung
