Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
BKA-Trojaner, OTL-Scan mit Fehlermeldung

BKA-Trojaner, OTL-Scan mit Fehlermeldung


Log-Analyse und Auswertung: BKA-Trojaner, OTL-Scan mit Fehlermeldung

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 06.07.2012, 11:14   #1
RClay
 
BKA-Trojaner, OTL-Scan mit Fehlermeldung - Standard

BKA-Trojaner, OTL-Scan mit Fehlermeldung


Hallo miteinander,

habe ein Notebook befallen mit dem BKA-Trojaner (Win 7, 64bit). bei normalem Start braucht der Rechner sehr lange und öffnet danach den Browser, manchmal mit einer Fehlermeldung von Antivir, manchmal mit besagter BKA-Seite. Start im abgesicherten Modus klappt bisweilen.
Nachdem diverse Rescue-Discs (Avira, Kaspersky, etc.) kein Ergebnis brachten oder nicht starteten, wollte ich nun einen OTL-Scan machen und mich in eure Hände begeben.
Leider ist auch dies mir nicht ohne Fehler vergönnt.
Sowohl beim Quick Scan als auch beim Scan liefert OTL nach einer Weile folgende Fehlermeldung:
"List index out of bounds (23)"
Auch nach längerem Abwarten wird kein Ergebnis geliefert.
Die Suchzeile unten bleibt bei: "Application Event Log Record 29071" hängen.

Was mach ich falsch, bzw. was sollte ich jetzt tun?

Alt 06.07.2012, 17:25   #2
markusg
/// Malware-holic
 
BKA-Trojaner, OTL-Scan mit Fehlermeldung - Standard

BKA-Trojaner, OTL-Scan mit Fehlermeldung


hi hast du otl mit script ausgeführt? dann versuche es mal ohne.
__________________

__________________
Alt 09.08.2012, 19:02   #3
RClay
 
BKA-Trojaner, OTL-Scan mit Fehlermeldung - Standard

BKA-Trojaner, OTL-Scan mit Fehlermeldung


Hi,
auf dem besagten Rechner wurde der Virus erfolgreich mit einem Wiederherstellungspunkt bearbeitet. Ob das jetzt optimal ist, ist nicht mein Bier, da es nicht mein Rechner ist.

Nun habe ich das Ding selbst auf dem Rechner.
Und der OTL-Scan liefert auch an diesem Rechner wieder eine Fehlermeldung.
"Win32 Error. Code 23.
Datenfehler (CRC-Prüfung)"

ich weiß nicht genau, was mit einem Script ausführen bedeuten soll. Eigentlich bin ich exakt nach der Anleitung vorgegangen.

sry für Doppelpost, ich finde aber keine Bearbeiten-Option.

OTL liefert trotz der Fehlermeldung eine OTL.txt
Code:
ATTFilter
OTL logfile created on: 10.08.2012 11:00:26 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Steffen\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,31 Gb Available Physical Memory | 57,88% Memory free
8,19 Gb Paging File | 6,20 Gb Available in Paging File | 75,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 20,60 Gb Free Space | 21,09% Space Free | Partition Type: NTFS
Drive D: | 234,37 Gb Total Space | 155,78 Gb Free Space | 66,47% Space Free | Partition Type: NTFS
Drive E: | 540,89 Gb Total Space | 7,40 Gb Free Space | 1,37% Space Free | Partition Type: NTFS
Drive L: | 3,75 Gb Total Space | 2,98 Gb Free Space | 79,27% Space Free | Partition Type: FAT32
 
Computer Name: STEFFEN-PC | User Name: Steffen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.09 18:13:36 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Steffen\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.05.14 23:03:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.14 23:03:18 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.05.14 23:03:18 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.05.14 23:03:17 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.14 23:03:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
PRC - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2011.10.05 07:32:35 | 000,272,896 | ---- | M] (TrekStor) -- C:\Users\Steffen\AppData\Roaming\Imbenu\bosez.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.05.20 10:04:14 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2010.05.05 20:56:42 | 000,025,600 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe
PRC - [2010.05.05 20:51:56 | 001,212,928 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.05.03 19:57:07 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.03.20 02:03:00 | 001,904,640 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2009.03.20 02:03:00 | 000,368,640 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2008.12.02 21:34:40 | 000,070,144 | ---- | M] (AlcaTech) -- C:\Windows\SysWOW64\mmrtkrnl.exe
PRC - [2008.09.05 19:18:40 | 002,177,576 | ---- | M] (Gainward Co.) -- C:\Program Files (x86)\EXPERTool\TBPANEL.exe
PRC - [2008.07.23 18:04:20 | 005,625,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
PRC - [2008.07.14 10:14:38 | 000,615,936 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\aaCenter.exe
PRC - [2008.03.03 23:54:30 | 000,196,608 | ---- | M] () -- C:\Programme\Mouse\Amoumain.exe
PRC - [2007.07.23 16:43:42 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
PRC - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2007.02.01 11:13:06 | 000,094,208 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe
PRC - [2006.12.06 19:10:16 | 000,180,224 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
PRC - [2006.11.17 17:42:46 | 000,053,341 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
PRC - [2005.10.21 19:12:22 | 000,040,960 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.09 15:14:30 | 000,217,600 | ---- | M] () -- C:\Users\Steffen\AppData\Local\Temp\soap0_wsdl.exe
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2010.12.22 10:01:20 | 000,186,880 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.12.29 16:52:38 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
MOD - [2008.07.23 18:04:20 | 005,625,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
MOD - [2008.07.14 10:14:38 | 000,615,936 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\aaCenter.exe
MOD - [2008.03.03 23:54:30 | 000,196,608 | ---- | M] () -- C:\Programme\Mouse\Amoumain.exe
MOD - [2008.01.17 10:46:20 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\cpuutil.dll
MOD - [2006.01.10 10:50:20 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll
MOD - [2005.06.22 11:39:56 | 000,204,851 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\PowerDll.dll
MOD - [2005.05.11 17:39:32 | 000,565,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
MOD - [1998.10.31 11:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\EXPERTool\TBManage.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.08.02 20:59:56 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.18 21:29:24 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.14 23:03:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.14 23:03:18 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.05.14 23:03:18 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.05.14 23:03:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2011.10.13 18:08:33 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.03.03 11:05:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010.05.20 10:04:14 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010.05.03 19:57:07 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.11 13:42:32 | 000,172,328 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.12.08 20:58:27 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.12.07 07:13:14 | 000,397,312 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe -- (AVerScheduleService)
SRV - [2009.10.31 00:48:42 | 000,348,160 | ---- | M] (AVerMedia) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe -- (AVerRemote)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.03.20 02:03:00 | 000,368,640 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2008.11.28 00:24:28 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe -- (Creative ALchemy AL1 Licensing Service)
SRV - [2008.11.03 17:15:34 | 000,098,488 | ---- | M] (SiSoftware) [Disabled | Stopped] -- C:\Programme\SiSoftware Sandra Lite 2009.SP1\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2008.07.27 20:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
SRV - [2006.12.14 18:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2005.11.17 16:18:52 | 001,527,900 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2005.01.25 16:27:32 | 000,024,576 | ---- | M] (IBM) [Disabled | Stopped] -- C:\IFOR\WIN\BIN\i4lmd.exe -- (IBM LUM LMD)
SRV - [2004.07.23 16:11:08 | 000,024,576 | ---- | M] (IBM) [Disabled | Stopped] -- C:\IFOR\WIN\BIN\i4gdb.exe -- (IBM LUM CR)
SRV - [2004.07.23 16:11:06 | 000,024,576 | ---- | M] (IBM) [On_Demand | Stopped] -- C:\IFOR\WIN\BIN\i4llmd.exe -- (IBM LUM NDL)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.14 23:03:22 | 000,132,832 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.14 23:03:22 | 000,098,848 | ---- | M] () [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.12.15 16:07:21 | 000,027,760 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.12.09 15:27:31 | 000,047,208 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2011.09.17 03:00:30 | 000,034,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SAlpham64.sys -- (SAlphamHid)
DRV:64bit: - [2010.10.01 09:36:33 | 000,828,912 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.09.30 23:25:10 | 000,040,104 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.09.16 08:08:50 | 001,077,416 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\mod77-64.sys -- (mod7764)
DRV:64bit: - [2010.09.14 15:16:15 | 000,125,888 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2010.08.31 14:37:42 | 000,116,096 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\avmaura.sys -- (avmaura)
DRV:64bit: - [2010.07.13 11:53:56 | 000,576,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cydtv.sys -- (CYDTV_SRV)
DRV:64bit: - [2010.05.05 22:30:52 | 001,561,688 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.05.05 22:30:42 | 000,118,360 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.05.05 22:30:34 | 000,213,080 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.05.05 22:30:26 | 000,015,960 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.05.05 22:30:18 | 000,179,288 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.05.05 22:30:10 | 000,684,376 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.05.05 22:30:02 | 000,580,696 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.05.05 22:29:52 | 001,417,304 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.05.05 22:29:52 | 001,417,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX)
DRV:64bit: - [2010.05.05 22:29:42 | 000,094,808 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT.SYS)
DRV:64bit: - [2010.05.05 22:29:42 | 000,094,808 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT)
DRV:64bit: - [2010.05.05 22:29:34 | 000,202,840 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT.SYS)
DRV:64bit: - [2010.05.05 22:29:34 | 000,202,840 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT)
DRV:64bit: - [2009.11.24 03:38:00 | 000,016,008 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 03:37:50 | 000,022,408 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.11.09 19:12:42 | 000,035,112 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\teamviewervpn.sys -- (teamviewervpn)
DRV:64bit: - [2009.10.15 10:39:14 | 000,024,848 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\LUMDriver.sys -- (LUMDriver)
DRV:64bit: - [2009.09.11 12:49:18 | 000,076,552 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2009.09.11 12:49:08 | 000,015,880 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2009.09.11 12:48:46 | 000,041,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2009.09.11 12:48:36 | 000,026,248 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2009.09.11 07:47:24 | 000,615,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SkyNET_AMD64.SYS -- (SKYNET)
DRV:64bit: - [2009.08.05 07:18:34 | 000,057,856 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\L1E60x64.sys -- (L1E)
DRV:64bit: - [2009.07.31 12:40:32 | 000,025,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\XENfiltv.sys -- (XENfiltv)
DRV:64bit: - [2009.03.20 02:03:00 | 000,552,704 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2009.03.20 02:03:00 | 000,014,120 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2009.03.20 00:06:51 | 000,026,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2009.03.20 00:06:51 | 000,013,352 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggflt.sys -- (ggflt)
DRV:64bit: - [2009.01.05 08:47:54 | 000,518,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\AVerAF15DMBTH64.sys -- (AVerAF15DMBTH64)
DRV:64bit: - [2008.02.13 17:20:16 | 000,017,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Amusbx64.sys -- (Amusbprt)
DRV:64bit: - [2008.01.21 04:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008.01.21 04:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2007.10.16 21:02:22 | 000,167,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TTCinTun.sys -- (PTDVB)
DRV:64bit: - [2007.10.16 21:02:16 | 000,087,584 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TTCinCap.sys -- (Cap7146_DVB)
DRV:64bit: - [2007.10.15 12:39:18 | 000,021,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Amps2x64.sys -- (Amps2prt)
DRV:64bit: - [2007.10.15 12:37:22 | 000,012,288 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\Amfltx64.sys -- (Amfilter)
DRV:64bit: - [2007.07.23 07:57:04 | 000,052,992 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Alpham164.sys -- (Alpham1)
DRV:64bit: - [2007.04.24 12:33:30 | 000,123,656 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125obex.sys -- (s125obex)
DRV:64bit: - [2007.04.24 12:33:28 | 000,126,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mgmt.sys -- (s125mgmt)
DRV:64bit: - [2007.04.24 12:33:26 | 000,144,648 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdm.sys -- (s125mdm)
DRV:64bit: - [2007.04.24 12:33:24 | 000,019,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdfl.sys -- (s125mdfl)
DRV:64bit: - [2007.04.24 12:33:14 | 000,108,296 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125bus.sys -- (s125bus)
DRV:64bit: - [2007.03.20 09:51:04 | 000,021,760 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Alpham264.sys -- (Alpham2)
DRV:64bit: - [2006.11.02 01:23:00 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2010.09.14 15:16:15 | 000,125,888 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2008.10.31 17:28:26 | 000,022,944 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware Sandra Lite 2009.SP1\WNt500x64\sandra.sys -- (SANDRA)
DRV - [2007.03.16 11:11:20 | 000,015,648 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)
DRV - [2006.05.05 20:21:00 | 000,004,608 | ---- | M] (NVIDIA Corporation.) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\nvport.sys -- (nvport)
DRV - [2006.03.29 09:49:26 | 000,009,856 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\pfc.sys -- (pfc)
DRV - [2004.12.23 05:47:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ULCDRHlp.sys -- (ULCDRHlp)
DRV - [2004.07.23 16:20:44 | 000,015,348 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\LUMDriver.sys -- (LUMDriver)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1561552
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {AC854C16-CA1E-43f1-8513-0D2F36C726ED}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{AC854C16-CA1E-43f1-8513-0D2F36C726ED}: "URL" = hxxp://www.tryff.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=2j9e1fh7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {c95a4e8e-816d-4655-8c79-d736da1adb6d}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.3
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:1.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.tryff.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=2j9e1fh7&q="
FF - prefs.js..network.proxy.autoconfig_url: "hxxp://www.bib.hochschule-bonn-rhein-sieg.de/bibmedia/Downloads/bibliothek/proxy_pac-p-6656.pac"
FF - prefs.js..network.proxy.type: 2
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Steffen\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.07 22:53:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 21:29:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.25 13:53:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 0.9\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2010.04.29 21:39:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 0.9\extensions\\Plugins: C:\Program Files (x86)\Mozilla Sunbird\plugins [2012.02.25 13:53:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.25 13:50:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.12.12 22:15:24 | 000,000,000 | ---D | M]
 
[2010.09.08 14:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Extensions
[2010.09.08 14:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.08.06 19:59:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions
[2009.11.04 15:30:39 | 000,000,000 | ---D | M] (El-Bilder-Mod) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012.07.15 13:37:51 | 000,000,000 | ---D | M] (Hotspot Shield Community Toolbar) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
[2009.11.19 08:48:53 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\firefox@tvunetworks.com
[2012.05.18 10:16:05 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\ich@maltegoetz.de
[2009.10.02 11:05:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Sunbird\Profiles\enaexsu9.default\extensions
[2012.08.06 19:59:06 | 000,000,853 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\11-suche.xml
[2012.08.06 19:59:06 | 000,002,209 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\englische-ergebnisse.xml
[2012.08.06 19:59:06 | 000,010,506 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\gmx-suche.xml
[2012.08.06 19:59:06 | 000,002,368 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\lastminute.xml
[2010.07.01 21:26:33 | 000,001,115 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\rapidshare-filefinder.xml
[2010.07.01 21:26:39 | 000,001,679 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\thepiratebayorg.xml
[2012.08.06 19:59:06 | 000,005,489 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\webde-suche.xml
[2010.07.01 21:26:10 | 000,004,140 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\youtube.xml
[2012.03.17 21:33:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.16 18:23:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.12.07 22:53:22 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011.12.23 23:04:11 | 000,013,268 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\{C666C018-6409-4479-AFA3-68E4129E7EFF}.XPI
[2012.02.12 23:22:56 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2012.08.06 19:59:01 | 000,525,702 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2011.08.26 18:10:03 | 000,011,510 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2012.07.18 21:29:25 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.01 17:45:05 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2009.04.08 04:06:28 | 000,122,880 | ---- | M] (AB) -- C:\Program Files (x86)\mozilla firefox\plugins\NPOP7PlugIn.dll
[2012.02.12 01:35:48 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.12 01:35:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.12 01:35:48 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.12 01:35:48 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.12 01:35:48 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.12 01:35:48 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: No name found = C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
 
O1 HOSTS File: ([2010.04.09 13:30:50 | 000,387,129 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 13351 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~2\TerraTec\TERRAT~1\THCDES~1.DLL (TerraTec Electronic GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [WheelMouse] C:\Programme\Mouse\Amoumain.exe ()
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [RCSystem] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\SysWow64\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [CreativeTaskScheduler] C:\Program Files (x86)\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [GAINWARD] C:\Program Files (x86)\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [Utboke] C:\Users\Steffen\AppData\Roaming\Imbenu\bosez.exe (TrekStor)
O4 - HKLM..\RunServicesOnce: [capscanuninstall] "C:\Windows\command.com" /c del "C:\Users\Steffen\AppData\Local\Temp\uninstal.exe" File not found
O4 - Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O4 - Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Steffen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8:64bit: - Extra context menu item: &Download with BitKinex - C:\Program Files (x86)\BitKinex\ieext_cp.htm File not found
O8:64bit: - Extra context menu item: &Register in BitKinex - C:\Program Files (x86)\BitKinex\ieext_reg.htm File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Download with BitKinex - C:\Program Files (x86)\BitKinex\ieext_cp.htm File not found
O8 - Extra context menu item: &Register in BitKinex - C:\Program Files (x86)\BitKinex\ieext_reg.htm File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range37 ([*] in Lokales Intranet)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06D9105A-E318-482C-ADAC-6251240B2CB2}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{33F342AA-A31A-4140-AF45-B7E735F62911}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll ()
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems Incorporated)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{53be69d7-c093-11dd-b040-00235401f696}\Shell - "" = AutoRun
O33 - MountPoints2\{53be69d7-c093-11dd-b040-00235401f696}\Shell\AutoRun\command - "" = M:\setup.exe
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell - "" = Autorun
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL O:\resycled\boot.com h:
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell\Open\command - "" = O:\resycled\boot.com h:
O33 - MountPoints2\{b9f18b6c-43ce-11de-8f7f-00235401f696}\Shell - "" = AutoRun
O33 - MountPoints2\{b9f18b6c-43ce-11de-8f7f-00235401f696}\Shell\AutoRun\command - "" = L:\pushinst.exe
O33 - MountPoints2\{d3670a46-83f6-11de-b5e1-001c4afd1b7c}\Shell\AutoRun\command - "" = O:\InstallTomTomHOME.exe
O33 - MountPoints2\L\Shell\AutoRun\command - "" = novir/novir32.exe
O33 - MountPoints2\L\Shell\explore\command - "" = novir/novir32.exe
O33 - MountPoints2\L\Shell\open\command - "" = .\novir/novir32.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.09 18:23:47 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
[2012.08.09 15:16:04 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Kepaza
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Imbenu
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Caezi
[2012.08.02 19:19:26 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
[2012.07.29 11:18:46 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Dokumente\DVDFab
[2012.07.29 11:18:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt
[2012.07.29 11:18:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDFab 8 Qt
[2012.07.17 14:49:02 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\xm1
[2012.07.17 14:28:23 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\MiKTeX
[2012.07.17 14:28:20 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Local\MiKTeX
[2012.07.17 14:10:09 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Texmaker
[2012.07.17 14:10:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Texmaker
[2012.07.17 14:10:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Texmaker
[2012.07.17 14:08:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiKTeX 2.9
[2012.07.17 14:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\MiKTeX
[2012.07.17 14:02:37 | 000,000,000 | ---D | C] -- C:\Program Files\MiKTeX 2.9
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Ovovx
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Fyxial
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Atedu
[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Steffen\AppData\Roaming\*.tmp files -> C:\Users\Steffen\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.10 10:59:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.10 10:30:00 | 000,001,034 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.08.10 10:22:03 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.10 10:22:00 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 10:22:00 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 10:21:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.10 10:21:52 | 4294,041,600 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.10 10:19:43 | 004,503,728 | ---- | M] () -- C:\ProgramData\ldsw_0paos.pad
[2012.08.10 10:07:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.10 09:57:30 | 001,445,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.10 09:57:30 | 000,628,504 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.10 09:57:30 | 000,595,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.10 09:57:30 | 000,126,248 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.10 09:57:30 | 000,103,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.10 09:56:04 | 000,001,356 | ---- | M] () -- C:\Users\Steffen\AppData\Local\d3d9caps.dat
[2012.08.10 09:47:43 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.10 09:47:43 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.10 09:47:43 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.09 18:13:36 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
[2012.08.09 15:21:37 | 000,001,460 | ---- | M] () -- C:\Users\Steffen\AppData\Local\d3d9caps64.dat
[2012.08.09 15:14:32 | 000,001,734 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.09 15:05:51 | 000,000,859 | ---- | M] () -- C:\Windows\client.config.ini
[2012.08.09 13:04:10 | 000,151,552 | ---- | M] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.09 10:29:27 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D3333D40-CCC0-4022-82C5-88EBDCAB575C}.job
[2012.08.02 20:59:56 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.02 20:59:56 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.02 19:19:26 | 000,000,318 | ---- | M] () -- C:\Users\Steffen\Desktop\Curse Client.appref-ms
[2012.07.29 11:12:58 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib
[2012.07.17 14:10:09 | 000,000,838 | ---- | M] () -- C:\Users\Steffen\Desktop\Texmaker.lnk
[2012.07.15 18:31:32 | 001,913,550 | ---- | M] () -- C:\Users\Steffen\Desktop\2003-07-02--17-07-20.JPG
[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Steffen\AppData\Roaming\*.tmp files -> C:\Users\Steffen\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.09 15:30:01 | 4294,041,600 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.09 15:14:32 | 004,503,728 | ---- | C] () -- C:\ProgramData\ldsw_0paos.pad
[2012.08.09 15:14:32 | 000,001,734 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.17 14:10:09 | 000,000,838 | ---- | C] () -- C:\Users\Steffen\Desktop\Texmaker.lnk
[2012.07.15 18:31:28 | 001,913,550 | ---- | C] () -- C:\Users\Steffen\Desktop\2003-07-02--17-07-20.JPG
[2012.06.23 18:26:37 | 000,017,408 | ---- | C] () -- C:\Users\Steffen\AppData\Local\WebpageIcons.db
[2012.03.14 12:07:45 | 000,000,856 | ---- | C] () -- C:\Users\Steffen\.recently-used.xbel
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.12.04 11:25:45 | 000,000,411 | ---- | C] () -- C:\Windows\cdplayer.ini
[2011.11.19 11:49:45 | 000,000,090 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\blckdom.res
[2011.09.29 20:34:35 | 000,000,399 | ---- | C] () -- C:\Users\Steffen\SaveInterface.bat
[2011.09.29 20:32:20 | 000,000,749 | ---- | C] () -- C:\Users\Steffen\SaveInterface.bat - Verknüpfung.lnk
[2011.09.26 19:15:15 | 000,000,000 | ---- | C] () -- C:\Users\Steffen\echo
[2011.07.06 22:37:31 | 000,000,064 | ---- | C] () -- C:\Windows\AVerText.ini
[2011.07.01 09:05:44 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\AVerIO.dll
[2011.07.01 09:05:44 | 000,003,456 | ---- | C] () -- C:\Windows\SysWow64\AVerIO.sys
[2011.07.01 09:05:42 | 000,606,208 | ---- | C] () -- C:\Windows\SysWow64\sptlib21.dll
[2011.07.01 09:05:42 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\sptlib01.dll
[2011.07.01 09:05:42 | 000,294,912 | ---- | C] () -- C:\Windows\SysWow64\sptlib11.dll
[2011.07.01 09:05:42 | 000,290,816 | ---- | C] () -- C:\Windows\SysWow64\sptlib22.dll
[2011.07.01 09:05:42 | 000,249,856 | ---- | C] () -- C:\Windows\SysWow64\sptlib03.dll
[2011.07.01 09:05:42 | 000,225,280 | ---- | C] () -- C:\Windows\SysWow64\sptlib02.dll
[2011.07.01 09:05:42 | 000,135,168 | ---- | C] () -- C:\Windows\SysWow64\sptlib12.dll
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.31 08:59:24 | 000,002,169 | ---- | C] () -- C:\Windows\XENcfg.ini
[2011.03.19 22:46:31 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2011.03.03 12:37:56 | 000,000,029 | ---- | C] () -- C:\Windows\sfbm.INI
[2011.03.03 11:56:03 | 000,000,388 | ---- | C] () -- C:\Windows\XENMCcfg.ini
[2011.02.02 00:18:54 | 000,000,059 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\GoodnightTimer.ini
[2010.12.20 18:59:50 | 000,063,965 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.12.20 18:59:50 | 000,063,965 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.10.05 22:15:38 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010.01.05 18:42:19 | 000,000,036 | ---- | C] () -- C:\Users\Steffen\AppData\Local\housecall.guid.cache
[2009.12.01 22:24:18 | 000,340,482 | ---- | C] () -- C:\Users\Steffen\Diskussion_Ergebnisse.odt
[2009.09.10 16:37:57 | 000,000,722 | ---- | C] () -- C:\Users\Steffen\RSD.rsdf
[2009.07.19 23:22:36 | 000,001,100 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d8caps.dat
[2009.02.07 16:25:09 | 000,013,232 | ---- | C] () -- C:\Program Files (x86)\EEIII - Kopie.ccf
[2008.12.09 22:47:51 | 000,000,564 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\AutoGK.ini
[2008.12.07 18:06:54 | 000,001,356 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d9caps.dat
[2008.12.06 16:46:54 | 000,000,064 | ---- | C] () -- C:\ProgramData\sandra.ldb
[2008.12.06 16:46:00 | 008,101,888 | ---- | C] () -- C:\ProgramData\sandra.mda
[2008.12.03 23:20:18 | 000,151,552 | ---- | C] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.26 23:57:17 | 000,001,460 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d9caps64.dat
 
========== LOP Check ==========
 
[2011.08.28 10:56:05 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\#Short company name#
[2011.01.17 18:46:09 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Advanced Chemistry Development
[2009.09.03 14:25:47 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\AlcaTech
[2011.02.21 14:19:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Amazon
[2010.10.01 09:58:59 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\AquaSoft
[2012.07.15 17:34:16 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Atedu
[2012.01.22 15:17:36 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\BitKinex
[2012.08.09 15:15:32 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Caezi
[2009.07.11 18:35:26 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Canneverbe_Limited
[2009.06.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\capella-software
[2008.12.02 19:02:34 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DAEMON Tools
[2009.10.29 16:22:30 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DassaultSystemes
[2011.02.21 17:12:43 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Desktopicon
[2012.08.10 10:22:42 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Dropbox
[2010.10.01 10:12:34 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.01 00:44:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\FileZilla
[2010.10.29 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\FOG Downloader
[2009.03.24 19:03:40 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Foxit
[2012.07.18 21:40:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Fyxial
[2011.07.25 09:03:55 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\go
[2012.03.14 12:07:46 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\gtk-2.0
[2012.08.10 09:52:21 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\ICQ
[2009.08.04 22:49:31 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ideazon
[2012.08.08 22:17:25 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Imbenu
[2009.09.05 18:57:02 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\ImgBurn
[2011.09.02 09:30:37 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\IrfanView
[2011.09.13 14:30:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\JAM Software
[2009.11.15 20:06:30 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Juniper Networks
[2012.08.08 22:17:25 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Kepaza
[2011.11.19 11:49:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\kock
[2012.01.12 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Leadertech
[2010.12.05 14:36:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\LolClient
[2009.10.17 16:59:17 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\MAGIX
[2012.08.09 14:27:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Mumble
[2009.03.23 22:18:01 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\MyPhoneExplorer
[2008.12.03 23:08:53 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\OpenOffice.org
[2009.01.09 01:25:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Opera
[2012.07.18 22:23:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ovovx
[2009.10.03 19:04:56 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\PPLive
[2011.02.13 13:09:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\RIFT
[2009.03.18 23:18:09 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\RouterControl
[2011.01.27 17:41:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Rovio
[2009.03.15 17:17:22 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Sierra Entertainment
[2010.07.15 10:35:24 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Smart Recorder
[2010.02.15 18:26:31 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\TeamViewer
[2010.04.11 22:53:51 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Teeworlds
[2009.03.20 00:52:56 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Teleca
[2011.08.28 11:29:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\TerraTec
[2010.12.12 20:08:12 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\thriXXX
[2010.09.08 14:51:02 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Thunderbird
[2010.08.23 09:34:58 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Tobit
[2010.01.04 15:32:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ulead Systems
[2008.11.28 01:14:17 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Wormux
[2011.01.28 16:40:35 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Wuala
[2011.04.17 14:51:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Xilisoft
[2012.07.17 14:49:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\xm1
[2011.11.19 11:49:35 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\xmldm
[2012.08.10 09:47:39 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.09 10:29:27 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{D3333D40-CCC0-4022-82C5-88EBDCAB575C}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 841 bytes -> C:\Users\Steffen\Desktop\Ihre Anfrage - 056353 - XITRA.de.eml:OECustomProperty
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0

< End of report >
ja, mein Rechner ist zugemüllt und nicht up to date, aber Vista ließ sich nie updaten und geht mir auf die Nerven.
wenn der Virus, gibts auch ein frisches Win7
__________________
Alt 14.08.2012, 18:16   #4
markusg
/// Malware-holic
 
BKA-Trojaner, OTL-Scan mit Fehlermeldung - Standard

BKA-Trojaner, OTL-Scan mit Fehlermeldung


sorry für die wartezeit
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu BKA-Trojaner, OTL-Scan mit Fehlermeldung
abgesicherten, antivir, avira, befallen, bka - trojaner, brauch, browser, diverse, ergebnis, falsch, fehlermeldung, folge, folgende, index, kaspersky, lange, liefert, log, miteinander, modus, notebook, otl funktioniert nicht, quick, rechner, start, starte, win, öffnet


« Polizeitrojaner Österreich, Trojan.Ransom.Gen, | Trotz bestehender Inetverbindung blockierte Browser nach Quarantänedurchführung »


Ähnliche Themen: BKA-Trojaner, OTL-Scan mit Fehlermeldung


  1. Sophos Scan bricht ab - W32/DCmem-A muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
    Antiviren-, Firewall- und andere Schutzprogramme - 24.06.2015 (18)
  2. Fehlermeldung ".exe - ungültiges Bild" + Ergebniss Farbar's Recovery Scan Tool
    Plagegeister aller Art und deren Bekämpfung - 04.05.2015 (9)
  3. Deaktivierter Echtzeitscanner Avira Antivir + Fehlermeldung beim Datei-Scan, Win 7
    Log-Analyse und Auswertung - 16.12.2014 (9)
  4. Windows 7 Starter: Avast Scan meldet Rootkits, bei zweitem Scan keine mehr
    Log-Analyse und Auswertung - 25.09.2014 (18)
  5. Fehlermeldung nach gescheitertem Filmstreaming- Fehlermeldung regedit.exe ist keine zulässige WIN32-Anwendung
    Log-Analyse und Auswertung - 27.03.2014 (15)
  6. Scan mit Farbars Recovery Scan Tool durchgeführt, was mache ich jetzt?
    Log-Analyse und Auswertung - 14.02.2014 (1)
  7. Fehlermeldung "Erkennung inaktiver Dienste" anbei Antimalwarebyte Scan
    Log-Analyse und Auswertung - 15.12.2013 (11)
  8. McAfee Echtzeit Scan deaktiviert, PC-Scan nicht möglich
    Log-Analyse und Auswertung - 01.11.2013 (7)
  9. Windows 7: Fehlermeldung: Loadlibrary failed in TSRitem-nach Scan: Pub.optional. delta ...Virenbefall?
    Plagegeister aller Art und deren Bekämpfung - 02.10.2013 (16)
  10. Windows 8: McAfee Echtzeit-Scan lässt sich nicht aktiveren, keine normaler Scan möglich
    Log-Analyse und Auswertung - 29.09.2013 (19)
  11. Win7 - Startseite Firefox auf QV06 umgeleitet - Scan u. Desinfektion mit MbAM, nun weitere Funde nach online-Scan mit ESET
    Log-Analyse und Auswertung - 24.08.2013 (9)
  12. Laptop immer langsamer, absturz, OTL scan abgestürzt, gmer scan > Systemabsturz - HILFE!
    Plagegeister aller Art und deren Bekämpfung - 06.02.2013 (3)
  13. Nach dem Neustart einer Bereinigung mit ESETOnline Scan kommt die Fehlermeldung beim Start: Problem beim Starten von install_0_msi.exe
    Plagegeister aller Art und deren Bekämpfung - 14.09.2012 (30)
  14. Vecna Scan & TCP FIN Scan im DHCP Clientlogbuch
    Log-Analyse und Auswertung - 04.04.2011 (2)
  15. Rootkit-Scan mit Fehlermeldung
    Plagegeister aller Art und deren Bekämpfung - 14.01.2010 (1)
  16. Fehlermeldung MFC71.DLL und Malware bei Avira Scan
    Log-Analyse und Auswertung - 04.01.2009 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema BKA-Trojaner, OTL-Scan mit Fehlermeldung - Hallo miteinander, habe ein Notebook befallen mit dem BKA-Trojaner (Win 7, 64bit). bei normalem Start braucht der Rechner sehr lange und öffnet danach den Browser, manchmal mit einer Fehlermeldung von - BKA-Trojaner, OTL-Scan mit Fehlermeldung...
Archiv
Du betrachtest: BKA-Trojaner, OTL-Scan mit Fehlermeldung auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129