Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Incredibar Virus

Incredibar Virus


Log-Analyse und Auswertung: Incredibar Virus

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 20.08.2012, 20:19   #1
SamNotHam
 
Incredibar Virus - Standard

Incredibar Virus


Hallo Forumuser,
Ich mir vor ein paar Tagen die Incredibar Toolbar eingefangen. Nachdem ich mich im Internet zu dem Thema belesen habe, bin ich darauf gekommen einen Scan mit OLT zu machen, da herkoemmliche Antivir Programme nicht weiterhalfen (Malwarebytes...). Ich poste einfach mal die Logfiles von OLT, ich hoffe ihr koennt mir dann weiterhelfen. Vielen Vielen Dank im Vorraus

Sam

Code:
ATTFilter
OTL Extras logfile created on: 20.08.2012 20:59:46 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Felix\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 2,11 Gb Available Physical Memory | 71,15% Memory free
5,93 Gb Paging File | 4,93 Gb Available in Paging File | 83,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,12 Gb Total Space | 58,04 Gb Free Space | 74,29% Space Free | Partition Type: NTFS
Drive D: | 206,96 Gb Total Space | 206,87 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{129A9176-3784-41BD-B924-A028678E8BB3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{36F6D210-0C67-4A31-946E-A9D5DBCF239D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3D034F48-BC07-44F2-85F4-E578D53D7703}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{3E3D3B95-B4D4-4C04-981A-AF24DF2490D4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4D03668B-7E6C-4B87-BBA5-7183DFA2CE69}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{51051A3D-9A6B-41DE-BD51-891D11C88C60}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5AA3DA06-AE07-457F-A6CE-DD89F200CD4C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{679E0653-8116-4227-AEEE-50E561B3C97D}" = lport=139 | protocol=6 | dir=in | app=system | 
"{6B4A639D-2289-4719-A3D8-CA9B366305A0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7CDD8DA9-DA37-4830-A438-6AF890AD5E4E}" = rport=139 | protocol=6 | dir=out | app=system | 
"{81DFDEAA-7FCB-4E0B-9CC3-9154A630E7E6}" = lport=138 | protocol=17 | dir=in | app=system | 
"{A10EBA0B-1FE8-4CE3-A643-7168D4224629}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{AE5F5199-0AE4-4AD9-BCC7-3941E9DC1E20}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{B22E81EA-23B8-4B3E-B7B0-DE685188EF16}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BB2689CD-09E2-45F6-BA02-D7BEA862CEFF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C2A85500-9482-4213-A0AF-531BA9E5638F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C72C8BD7-2FC4-4326-A96D-1DE2D6A58DFF}" = lport=445 | protocol=6 | dir=in | app=system | 
"{CE2DD8FA-3564-4132-B94C-C69E30CFBFC6}" = lport=137 | protocol=17 | dir=in | app=system | 
"{E47BAC8F-8208-4DB9-9D53-26E07845476A}" = rport=445 | protocol=6 | dir=out | app=system | 
"{EF77F6B2-94C1-44EC-8445-D3C4F6E046C3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{F33A4E8E-9F71-47E4-B0DF-5D0C016E5A93}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{12BBD671-BFB1-48BE-AE6E-E9BA60C13F8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{2C7E8D57-BC4B-4134-84B4-84CAD44EBF12}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{39F9F6F2-5B56-4D1F-A7E5-5E11D81F6D9E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{59F92D05-4B88-4F98-B174-7EE6EE4F05C1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5DA10D02-DC11-4BDE-9891-EBA51FEA148D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{603C4E45-4821-4D98-A72A-D3A58D42CD89}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{65C6A03F-0716-42E8-AAF1-D8BAF6106EB8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{677BC341-D7E0-47EF-A2BB-2B7CEAB990DD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{729C387B-AD85-4804-A579-E249730EB54B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{76C5293C-5300-491D-A68C-17AF2E922CE0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{AD1BB02E-4334-4542-95D2-88D5C5C3BE07}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B6148F9D-5AC2-4F93-8DE9-5A3C02D79FC0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B82A7394-9185-4893-801E-E0E79D6734E0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BF6DD35B-A19C-4ED2-B7B0-5C3D08715998}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C862BE64-2437-4DFA-84C7-7CCD18934DF8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DD5C65E6-CACD-4938-BE91-38093C6ED40E}" = protocol=6 | dir=out | app=system | 
"TCP Query User{5AE45332-FFC9-46C5-BDBE-FB22C0833164}C:\users\felix\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\felix\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{3B9F1989-B73E-46FD-B186-3F14793B9967}C:\users\felix\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\felix\appdata\roaming\spotify\spotify.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Avira AntiVir Desktop" = Avira Free Antivirus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"VLC media player" = VLC media player 2.0.3
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-33552640-399596032-3019488962-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.08.2012 13:07:22 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.08.2012 13:16:36 | Computer Name = Felix-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 19.08.2012 03:42:07 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 19.08.2012 17:27:09 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 19.08.2012 18:56:34 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 19.08.2012 23:39:21 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.08.2012 03:04:07 | Computer Name = Felix-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 20.08.2012 14:16:16 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.08.2012 14:25:19 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.08.2012 14:50:14 | Computer Name = Felix-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 19.08.2012 23:37:34 | Computer Name = Felix-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 19.08.2012 23:37:34 | Computer Name = Felix-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 20.08.2012 03:04:08 | Computer Name = Felix-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 20.08.2012 14:14:31 | Computer Name = Felix-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 20.08.2012 14:14:31 | Computer Name = Felix-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 20.08.2012 14:23:40 | Computer Name = Felix-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 20.08.2012 14:23:40 | Computer Name = Felix-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 20.08.2012 14:47:30 | Computer Name = Felix-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD External Events Utility" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 20.08.2012 14:48:28 | Computer Name = Felix-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 20.08.2012 14:48:28 | Computer Name = Felix-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >

Code:
ATTFilter
OTL logfile created on: 20.08.2012 20:59:46 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Felix\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 2,11 Gb Available Physical Memory | 71,15% Memory free
5,93 Gb Paging File | 4,93 Gb Available in Paging File | 83,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,12 Gb Total Space | 58,04 Gb Free Space | 74,29% Space Free | Partition Type: NTFS
Drive D: | 206,96 Gb Total Space | 206,87 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Felix\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Felix\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
PRC - C:\Users\Felix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\pdf.dll ()
MOD - C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\avutil-51.dll ()
MOD - C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\avformat-54.dll ()
MOD - C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\avcodec-54.dll ()
MOD - C:\Users\Felix\AppData\Roaming\Spotify\Data\libcef.dll ()
MOD - C:\Users\Felix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
 
 
 
 
 
 
IE - HKU\S-1-5-21-33552640-399596032-3019488962-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKU\S-1-5-21-33552640-399596032-3019488962-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-33552640-399596032-3019488962-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Felix\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Felix\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
 
[2012.08.19 06:20:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Felix\AppData\Local\Google\Chrome\Application\21.0.1180.79\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Felix\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - Extension: Adblock Plus (Beta) = C:\Users\Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-21-33552640-399596032-3019488962-1000..\Run: [Spotify] C:\Users\Felix\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-33552640-399596032-3019488962-1000..\Run: [Spotify Web Helper] C:\Users\Felix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{467A4ED3-6339-4C32-B308-C33CFA33CA60}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.20 20:47:29 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.20 20:46:10 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Felix\Desktop\OTL.exe
[2012.08.19 23:47:10 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Malwarebytes
[2012.08.19 23:47:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.19 23:47:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.19 23:47:01 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.19 06:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012.08.19 06:20:58 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\SendSpace
[2012.08.19 06:20:52 | 000,000,000 | ---D | C] -- C:\Program Files\Perion
[2012.08.19 06:20:45 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.08.19 06:19:10 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2012.08.18 19:29:01 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Diagnostics
[2012.08.18 19:21:32 | 000,000,000 | ---D | C] -- C:\Users\Felix\Desktop\Dateien
[2012.08.18 19:20:07 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\OpenOffice.org
[2012.08.18 19:18:19 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2012.08.14 09:55:03 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\vlc
[2012.08.14 09:54:40 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012.08.13 22:51:43 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Spotify
[2012.08.13 22:51:15 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Spotify
[2012.08.13 22:51:04 | 000,087,360 | ---- | C] (Spotify Ltd) -- C:\Users\Felix\Desktop\SpotifySetup.exe
[2012.08.13 07:31:54 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Western Digital
[2012.08.11 23:45:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2012.08.11 20:26:02 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.08.11 20:25:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.08.11 20:25:32 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.08.11 20:25:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.08.07 22:42:40 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Avira
[2012.08.07 22:36:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.08.07 22:36:06 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2012.08.07 22:36:05 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012.08.07 22:36:05 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2012.08.07 22:36:05 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2012.08.07 22:36:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.08.07 22:36:04 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.08.07 20:31:57 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.08.07 18:51:47 | 000,284,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2012.08.07 18:51:47 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2012.08.07 18:51:42 | 000,148,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys
[2012.08.07 18:51:42 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe
[2012.08.07 18:50:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2012.08.07 18:50:30 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.08.07 18:44:41 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.08.07 18:44:26 | 000,000,000 | -HSD | C] -- C:\Boot
[2012.08.07 18:42:47 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.08.07 18:41:34 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Google
[2012.08.07 18:41:27 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Deployment
[2012.08.07 18:41:27 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Apps
[2012.08.07 18:24:10 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.08.07 18:24:07 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.08.07 18:22:47 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.08.07 18:22:47 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.08.07 18:22:47 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.08.07 18:22:47 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.08.07 18:22:47 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.08.07 18:22:47 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.08.07 18:22:47 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.08.07 18:22:47 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.08.07 18:22:47 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.08.07 18:22:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.08.07 18:22:47 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.08.07 18:22:47 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.08.07 18:22:47 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.08.07 18:22:47 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.08.07 18:22:47 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.08.07 18:22:47 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.08.07 18:22:47 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.08.07 18:22:47 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.08.07 18:22:47 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.08.07 18:22:47 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.08.07 18:22:47 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.08.07 18:22:47 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.08.07 18:22:47 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.08.07 18:22:47 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.08.07 18:22:47 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.08.07 18:22:47 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.08.07 18:22:47 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.08.07 18:22:47 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.08.07 18:22:47 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.08.07 18:22:47 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.08.07 18:22:47 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.08.07 18:22:47 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.08.07 18:22:47 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.08.07 18:22:47 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.08.07 18:22:47 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.08.07 18:22:47 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.08.07 18:22:47 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.08.07 18:21:39 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2012.08.07 18:19:34 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2012.08.07 18:19:34 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2012.08.07 18:19:28 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012.08.07 18:19:21 | 001,549,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2012.08.07 18:19:21 | 001,401,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2012.08.07 18:19:21 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2012.08.07 18:19:21 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2012.08.07 18:19:21 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2012.08.07 18:19:21 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2012.08.07 18:19:18 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2012.08.07 18:19:17 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2012.08.07 18:19:17 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2012.08.07 18:19:17 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2012.08.07 18:19:12 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012.08.07 18:19:11 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.08.07 18:19:10 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012.08.07 18:19:10 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012.08.07 18:19:06 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2012.08.07 18:19:06 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012.08.07 18:19:03 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2012.08.07 18:18:59 | 000,870,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2012.08.07 18:18:56 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2012.08.07 18:18:55 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.08.07 18:18:55 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2012.08.07 18:18:53 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2012.08.07 18:18:29 | 000,850,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2012.08.07 18:18:29 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll
[2012.08.07 18:18:29 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2012.08.07 18:18:28 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2012.08.07 18:18:28 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012.08.07 18:18:28 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012.08.07 18:18:28 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012.08.07 18:18:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.08.07 18:18:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012.08.07 18:18:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012.08.07 18:18:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012.08.07 18:18:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012.08.07 18:18:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.08.07 18:18:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012.08.07 18:18:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012.08.07 18:18:27 | 002,616,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2012.08.07 18:18:27 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012.08.07 18:18:27 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012.08.07 18:18:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012.08.07 18:18:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012.08.07 18:18:26 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2012.08.07 18:18:25 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.08.07 18:18:25 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.08.07 18:14:05 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2012.08.07 18:14:05 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2012.08.07 18:14:01 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.08.07 18:13:59 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2012.08.07 18:13:59 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2012.08.07 18:13:58 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbcjt32.dll
[2012.08.07 18:13:58 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbctrac.dll
[2012.08.07 18:13:58 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccp32.dll
[2012.08.07 18:13:58 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccu32.dll
[2012.08.07 18:13:58 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbccr32.dll
[2012.08.07 18:13:57 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.08.07 18:13:55 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.08.07 18:13:55 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.08.07 18:13:55 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.08.07 18:13:53 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2012.08.07 18:13:46 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2012.08.07 18:13:45 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2012.08.07 18:04:37 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012.08.07 18:01:57 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.08.07 18:01:57 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.08.07 18:01:48 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.08.07 18:01:48 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.08.07 18:01:48 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.08.07 18:01:48 | 000,000,000 | R--D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.08.07 18:01:48 | 000,000,000 | R--D | C] -- C:\Users\Felix\Searches
[2012.08.07 18:01:48 | 000,000,000 | R--D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.08.07 18:01:35 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.08.07 18:01:35 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012.08.07 18:01:24 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Identities
[2012.08.07 18:01:22 | 000,000,000 | R--D | C] -- C:\Users\Felix\Contacts
[2012.08.07 18:01:15 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\VirtualStore
[2012.08.07 18:01:14 | 000,000,000 | --SD | C] -- C:\Users\Felix\AppData\Roaming\Microsoft
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Videos
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Saved Games
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Pictures
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Music
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Links
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Favorites
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Downloads
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Documents
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\Desktop
[2012.08.07 18:01:14 | 000,000,000 | R--D | C] -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Vorlagen
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\AppData\Local\Verlauf
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\AppData\Local\Temporary Internet Files
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Startmenü
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\SendTo
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Recent
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Netzwerkumgebung
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Lokale Einstellungen
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Documents\Eigene Videos
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Documents\Eigene Musik
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Eigene Dateien
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Documents\Eigene Bilder
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Druckumgebung
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Cookies
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\AppData\Local\Anwendungsdaten
[2012.08.07 18:01:14 | 000,000,000 | -HSD | C] -- C:\Users\Felix\Anwendungsdaten
[2012.08.07 18:01:14 | 000,000,000 | -H-D | C] -- C:\Users\Felix\AppData
[2012.08.07 18:01:14 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Temp
[2012.08.07 18:01:14 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Microsoft
[2012.08.07 18:01:14 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Media Center Programs
[2012.08.07 18:01:02 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.08.07 18:01:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.08.07 17:48:31 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.08.07 17:46:17 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.08.07 17:45:17 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.20 20:55:45 | 000,021,888 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.20 20:55:45 | 000,021,888 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.20 20:51:03 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-33552640-399596032-3019488962-1000UA.job
[2012.08.20 20:48:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.20 20:48:20 | 2388,086,784 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.20 20:46:12 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Desktop\OTL.exe
[2012.08.20 20:29:53 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.20 20:29:53 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.20 20:29:53 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.20 20:29:53 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.19 06:22:17 | 137,388,401 | ---- | M] () -- C:\Users\Felix\Desktop\Glen & Adrian Minimal Summer Set [2012] 2.mp3
[2012.08.13 22:51:42 | 000,001,805 | ---- | M] () -- C:\Users\Felix\Desktop\Spotify.lnk
[2012.08.13 22:51:04 | 000,087,360 | ---- | M] (Spotify Ltd) -- C:\Users\Felix\Desktop\SpotifySetup.exe
[2012.08.13 07:41:09 | 022,617,148 | ---- | M] () -- C:\Users\Felix\Desktop\vlc-2.0.3-win32.exe
[2012.08.11 20:25:44 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.08.07 18:51:02 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-33552640-399596032-3019488962-1000Core.job
[2012.08.07 18:44:28 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012.08.07 18:39:54 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.07 18:22:47 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.08.07 18:22:47 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.08.07 18:22:47 | 001,800,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.08.07 18:22:47 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.08.07 18:22:47 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.08.07 18:22:47 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.08.07 18:22:47 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.08.07 18:22:47 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.08.07 18:22:47 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.08.07 18:22:47 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.08.07 18:22:47 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.08.07 18:22:47 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.08.07 18:22:47 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.08.07 18:22:47 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.08.07 18:22:47 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.08.07 18:22:47 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.08.07 18:22:47 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.08.07 18:22:47 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.08.07 18:22:47 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.08.07 18:22:47 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.08.07 18:22:47 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.08.07 18:22:47 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.08.07 18:22:47 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.08.07 18:22:47 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.08.07 18:22:47 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.08.07 18:22:47 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.08.07 18:22:47 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.08.07 18:22:47 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.08.07 18:22:47 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.08.07 18:22:47 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.08.07 18:22:47 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.08.07 18:22:47 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.08.07 18:22:47 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.08.07 18:22:47 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.08.07 18:22:47 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.08.07 18:22:47 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.08.07 18:22:47 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.08.07 18:22:47 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.08.07 17:49:34 | 000,159,772 | ---- | M] () -- C:\Windows\System32\license.rtf
[2012.08.07 17:47:59 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
 
========== Files Created - No Company Name ==========
 
[2012.08.19 06:20:58 | 137,388,401 | ---- | C] () -- C:\Users\Felix\Desktop\Glen & Adrian Minimal Summer Set [2012] 2.mp3
[2012.08.13 22:51:42 | 000,001,805 | ---- | C] () -- C:\Users\Felix\Desktop\Spotify.lnk
[2012.08.13 22:51:42 | 000,001,791 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2012.08.13 07:40:46 | 022,617,148 | ---- | C] () -- C:\Users\Felix\Desktop\vlc-2.0.3-win32.exe
[2012.08.11 20:25:44 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.08.11 20:25:44 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.08.07 18:44:28 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
[2012.08.07 18:44:26 | 000,383,786 | RHS- | C] () -- C:\bootmgr
[2012.08.07 18:41:36 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-33552640-399596032-3019488962-1000UA.job
[2012.08.07 18:41:35 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-33552640-399596032-3019488962-1000Core.job
[2012.08.07 18:22:47 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.08.07 18:01:49 | 000,001,405 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.08.07 17:49:27 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.08.07 17:49:15 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.08.07 17:47:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.08.07 17:45:17 | 2388,086,784 | -HS- | C] () -- C:\hiberfil.sys
[2011.04.12 03:30:05 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 03:30:05 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
 
========== LOP Check ==========
 
[2012.08.18 19:20:07 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\OpenOffice.org
[2012.08.19 06:20:58 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\SendSpace
[2012.08.20 20:54:20 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Spotify
[2009.07.14 06:53:46 | 000,005,672 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

Alt 20.08.2012, 20:51   #2
t'john
/// Helfer-Team
 
Incredibar Virus - Standard

Incredibar Virus




1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________

__________________
Alt 22.08.2012, 20:18   #3
SamNotHam
 
Incredibar Virus - Standard

Incredibar Virus


Danke fuer die schnelle Hilfe

Hier die Logdatei von Malwarebytes
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.21.13

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Felix :: FELIX-PC [Administrator]

Schutz: Deaktiviert

22.08.2012 02:32:41
mbam-log-2012-08-22 (02-32-41).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 232082
Laufzeit: 24 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
und AdwCleaner
Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/22/2012 at 21:11:37
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Felix - FELIX-PC
# Boot Mode : Normal
# Running from : C:\Users\Felix\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\ProgramData\Premium

***** [Registry] *****


***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Google Chrome v21.0.1180.83

File : C:\Users\Felix\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found :          "urls_to_restore_on_startup": [ "hxxp://mystart.incredibar.com/mb139?a=6OyLt7OjhU&i=26" ]
Found :       "urls_to_restore_on_startup": [ "hxxp://mystart.incredibar.com/mb139?a=6OyLt7OjhU&i=26" ]

*************************

AdwCleaner[R1].txt - [965 octets] - [22/08/2012 21:11:37]

########## EOF - C:\AdwCleaner[R1].txt - [1092 octets] ##########
__________________
Alt 22.08.2012, 22:08   #4
t'john
/// Helfer-Team
 
Incredibar Virus - Standard

Incredibar Virus


Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 22.08.2012, 22:44   #5
SamNotHam
 
Incredibar Virus - Standard

Incredibar Virus


Danke

Hier die AdwCleaner Log
Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/22/2012 at 23:09:53
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : Felix - FELIX-PC
# Boot Mode : Normal
# Running from : C:\Users\Felix\Desktop\Dateien\Programme\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Premium

***** [Registry] *****


***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Google Chrome v21.0.1180.83

File : C:\Users\Felix\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted :          "urls_to_restore_on_startup": [ "hxxp://mystart.incredibar.com/mb139?a=6OyLt7OjhU&i=26" ]
Deleted :       "urls_to_restore_on_startup": [ "hxxp://mystart.incredibar.com/mb139?a=6OyLt7OjhU&i=26" ]

*************************

AdwCleaner[R1].txt - [1093 octets] - [22/08/2012 21:11:37]
AdwCleaner[S1].txt - [1051 octets] - [22/08/2012 23:09:53]

########## EOF - C:\AdwCleaner[S1].txt - [1179 octets] ##########
und hier die andere
Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 22.08.2012 23:21:41

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	22.08.2012 23:23:44


Gescannt	506545
Gefunden	0

Scan Ende:	22.08.2012 23:43:18
Scan Zeit:	0:19:34


Alt 22.08.2012, 23:21   #6
t'john
/// Helfer-Team
 
Incredibar Virus - Standard

Incredibar Virus


Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
--> Incredibar Virus

Alt 23.08.2012, 00:50   #7
SamNotHam
 
Incredibar Virus - Standard

Incredibar Virus


Hier die Logfile
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=03883eb70f36c84aa6feee6bf266bcf2
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-22 11:47:49
# local_time=2012-08-23 01:47:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 1305916 1305916 0 0
# compatibility_mode=5893 16776573 100 94 7009 97308871 0 0
# compatibility_mode=8192 67108863 100 0 1083 1083 0 0
# scanned=63053
# found=0
# cleaned=0
# scan_time=1589

Alt 23.08.2012, 23:56   #8
t'john
/// Helfer-Team
 
Incredibar Virus - Standard

Incredibar Virus


Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 07.10.2012, 00:21   #9
t'john
/// Helfer-Team
 
Incredibar Virus - Standard

Incredibar Virus


Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Incredibar Virus
adblock, adobe, antivir, autorun, avira, defender, dll, error, explorer, firefox, format, google, home, homepage, incredibar, incredibar toolbar, install.exe, internet, log file, olt.exe, opera, registry, rundll, scan, security, software, spotify web helper, svchost.exe, taskhost.exe, tcp, udp, virus, windows


« GVU Trojaner | Ucash trojaner, TR/RevetonCM.A, TR/Graftor.39522.1 »


Ähnliche Themen: Incredibar Virus


  1. incredibar
    Log-Analyse und Auswertung - 26.03.2014 (12)
  2. Virus "incredibar" bei Windows Vista, 32bit
    Log-Analyse und Auswertung - 24.10.2013 (9)
  3. mystart incredibar virus
    Plagegeister aller Art und deren Bekämpfung - 29.01.2013 (13)
  4. MyStart Incredibar
    Plagegeister aller Art und deren Bekämpfung - 29.01.2013 (24)
  5. incredibar
    Log-Analyse und Auswertung - 27.01.2013 (19)
  6. IncrediBar
    Plagegeister aller Art und deren Bekämpfung - 06.12.2012 (7)
  7. Mystart incredibar Virus nach Treiberdownload
    Plagegeister aller Art und deren Bekämpfung - 27.11.2012 (18)
  8. Incredibar
    Plagegeister aller Art und deren Bekämpfung - 20.10.2012 (1)
  9. IncrediBar
    Plagegeister aller Art und deren Bekämpfung - 10.10.2012 (31)
  10. MyStart Incredibar Virus eingefangen.
    Plagegeister aller Art und deren Bekämpfung - 08.10.2012 (50)
  11. incredibar entfernen?
    Plagegeister aller Art und deren Bekämpfung - 16.09.2012 (23)
  12. incredibar
    Plagegeister aller Art und deren Bekämpfung - 11.08.2012 (28)
  13. Mystart Incredibar - Ein Virus?
    Plagegeister aller Art und deren Bekämpfung - 15.07.2012 (29)
  14. Ich werde incredibar virus nicht los
    Log-Analyse und Auswertung - 14.07.2012 (4)
  15. "MyStart Incredibar"-Virus nach Schriftartdownload?
    Plagegeister aller Art und deren Bekämpfung - 11.07.2012 (1)
  16. leider auch incredibar virus eingefangen
    Plagegeister aller Art und deren Bekämpfung - 08.07.2012 (3)
  17. MyStart by IncrediBar - Was tun um "Virus" zu löschen?
    Plagegeister aller Art und deren Bekämpfung - 29.06.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Incredibar Virus - Hallo Forumuser, Ich mir vor ein paar Tagen die Incredibar Toolbar eingefangen. Nachdem ich mich im Internet zu dem Thema belesen habe, bin ich darauf gekommen einen Scan mit OLT - Incredibar Virus...
Archiv
Du betrachtest: Incredibar Virus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129