| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BKA-Trojaner - AuswertungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
25.08.2011, 21:14
| #1 |
 |  BKA-Trojaner - Auswertung Hallo liebe Leute. Ich hatte auch vor ein paar Tagen den lästigen BKA-Trojaner. Ich habe mir zunächst provisorisch damit beholfen über den abgesicherten Modus eine Systemwiederherstellung zu machen aber hier im Forum durchs Stöbern gesehen, dass das das Problem nicht unbedingt löst. Ich habe alle in einem anderen Post beschrieben Schritte erledigt: 1. Mal Otl Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-2.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-3.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.gif not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.src not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM not found.
File C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File X:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
File F:\LaunchU3.exe -a not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
File C:\Users\dube\Documents\Yvi.mcf not found.
File C:\Users\dube\Documents\Yvi.mcf~ not found.
Folder C:\ProgramData\SweetIM\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: asasas
->Temp folder emptied: 406157 bytes
->Temporary Internet Files folder emptied: 62442 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Fabian
->Temp folder emptied: 171486774 bytes
->Temporary Internet Files folder emptied: 5977585 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64206707 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 17283 bytes
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 7693347 bytes
->FireFox cache emptied: 12349165 bytes
->Flash cache emptied: 495 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 384522 bytes
%systemroot%\System32 .tmp files removed: 4384 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1898178 bytes
RecycleBin emptied: 374123 bytes
Total Files Cleaned = 253,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192512
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Datenbank Version: 7536
Windows 6.0.6000
Internet Explorer 7.0.6000.16809
25.08.2011 21:49:10
mbam-log-2011-08-25 (21-49-10).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|Z:\|)
Durchsuchte Objekte: 460483
Laufzeit: 2 Stunde(n), 16 Minute(n), 41 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter AC3Filter (remove only) 03.05.2010 1,43MB
Activation Assistant for the 2007 Microsoft Office suites Microsoft Corporation 01.11.2007 14,0MB
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 14.03.2010 10.0.45.2
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 18.07.2011 10.3.181.34
Adobe Photoshop CS4 Adobe Systems Incorporated 30.04.2010 11.0
Adobe Photoshop Elements 6.0 Adobe Systems, Inc. 24.02.2010 375MB 6.0
Adobe Reader 8.1.1 - Deutsch Adobe Systems Incorporated 29.12.2007 105,7MB 8.1.1
AGEIA PhysX v7.09.13 AGEIA Technologies, Inc. 21.06.2008 99,5MB 7.09.13
Amazon Kindle Amazon 05.08.2011 55,2MB
AnyToISO CrystalIdea Software, Inc. 04.04.2010 12,7MB 2.6.2
Apple Application Support Apple Inc. 05.09.2010 42,8MB 1.3.2
Apple Mobile Device Support Apple Inc. 05.09.2010 20,1MB 3.2.0.47
Apple Software Update Apple Inc. 29.11.2009 2,16MB 2.1.1.116
Audacity 1.2.6 17.01.2008 8,43MB
Avira AntiVir Personal - Free Antivirus Avira GmbH 20.07.2008 30,3MB
Bananarama 18.07.2009 1,55MB
Bonjour Apple Inc. 04.10.2010 1,12MB 2.0.3.0
Borland Delphi 5 31.08.2008
Borland Delphi 7 Borland Software Corporation 20.11.2008 141,2MB 7.0
CCleaner Piriform 24.08.2011 2,95MB 3.10
Cheat Engine 5.6.1 Dark Byte 23.09.2010 23,3MB
Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University 02.11.2007 698MB 2.0 (beta)
Compact&Easy 21.12.2007 9,07MB
Compatibility Pack für 2007 Office System Microsoft Corporation 31.12.2006 56,2MB 12.0.4518.1014
Crazy Machines FAKT Software GmbH 11.06.2011 41,7MB 1.0
Crysis® 2 Demo Electronic Arts 27.03.2011 1.760MB 1.0.0.0
Die Sims 2: Family Fun - Accessoires 12.11.2007 282MB
Die Sims 2: Nightlife 11.11.2007 1.287MB
Die Sims 2: Open For Business 11.11.2007 698MB
Die Sims 2: Wilde Campus-Jahre 01.11.2007 925MB
Die Sims™ 2 Apartment-Leben Electronic Arts 29.08.2008 1.307MB
Die Sims™ 2 Freizeit-Spaß Electronic Arts 02.08.2008 1.179MB
Die Sims™ 2 Gute Reise Electronic Arts 11.11.2007 947MB
Die Sims™ 2 H&M®-Fashion-Accessoires 12.11.2007 498MB
Die Sims™ 2 Haustiere 01.11.2007 801MB
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires Electronic Arts 01.08.2008 473MB
Die Sims™ 2 Party-Accessoires 12.11.2007 367MB
Die Sims™ 2 Vier Jahreszeiten 11.11.2007 869MB
Die Sims™ 2: Glamour-Accessoires 12.11.2007 356MB
DivX Converter DivX, Inc. 15.04.2010 37,1MB 7.0.0
DivX Plus DirectShow Filters DivX, Inc. 15.04.2010 1,22MB
DivX-Setup DivX, Inc. 03.05.2010 2,06MB 1.0.1.5
Dungeon Keeper 2 22.07.2010 491MB
DVDVideoSoftTB Toolbar 30.05.2010 2,61MB
Efficient WMA MP3 Converter v0.99.2 11.09.2008 26,9MB
Elecard MPEG-2 Decoder&Streaming Plug-in for WMP Elecard 03.05.2010 0,66MB 3.7.90209
Electronic Arts Product Registration Electronic Arts 19.07.2009 1,64MB 1.01.0000
FirstSteps Diagnostics Fujitsu Siemens Computers 31.12.2006 4,67MB 1.00
Folder Access 2.1 Free Version 16.01.2010 0,94MB
foobar2000 v1.0.3 Peter Pawlowski 09.08.2010 8,17MB 1.0.3
Forte Free 2.0 04.10.2010 27,8MB
Fraps 05.02.2009 4,61MB
Free Audio CD Burner version 1.4 DVDVideoSoft Limited. 11.09.2010 3,12MB
Free Audio Converter version 2.0 DVDVideoSoft Limited. 05.09.2010 5,77MB
Free YouTube Download 2.9 DVDVideoSoft Limited. 13.11.2010 3,27MB
Free YouTube Download 3 version 3.0.3.622 DVDVideoSoft Limited. 30.06.2011 4,27MB
Free YouTube to MP3 Converter version 3.9.40.602 DVDVideoSoft Limited. 09.06.2011 12,5MB
FreeMind 04.09.2010 10,3MB 0.8.1
Freez FLV to MP3 Converter www.smallvideosoft.com 01.11.2009 9,21MB 1.5
FSCLounge Fujitsu Siemens Computers 01.01.2007 8,47MB 1.0.0
GameWiz32 Nico Ebert 02.01.2011 1,64MB 1.43
GeoGebra GeoGebra Inc. 28.08.2008 55,9MB 3.0.0.0
Google Chrome Google Inc. 28.06.2011 46,6MB 13.0.782.215
Google Earth Google 31.05.2011 84,7MB 6.0.3.2197
Grand Theft Auto San Andreas Rockstar Games 24.12.2007 4.795MB 1.00.00001
GTA2 25.03.2010 72,0MB
Hama Double Action Air Grip GASIA 06.04.2010 1,09MB 1.00.0000
HP Smart Web Printing Ihr Firmenname 13.09.2008 6,33MB 2.15.7.0
HP Update Hewlett-Packard 13.09.2008 3,71MB 4.000.006.003
HPSSupply Ihr Firmenname 13.09.2008 0,96MB 2.2.0.0000
HyperCam 2 10.02.2009 1,28MB
ICQ Toolbar ICQ 31.10.2010 0,13MB 3.0.0
ICQ7.5 ICQ 04.08.2011 54,0MB 7.5
ISO Commander 1.6 (remove only) TurtleBlast Software 02.04.2010 1,18MB 1.6
iTunes Apple Inc. 04.10.2010 138,7MB 10.0.1.22
Java DB 10.2.2.0 Sun Microsystems, Inc 28.12.2007 24,4MB 10.2.2.0
Java(TM) 6 Update 19 Sun Microsystems, Inc. 02.04.2010 94,5MB 6.0.190
Java(TM) 6 Update 3 Sun Microsystems, Inc. 29.12.2007 168,1MB 1.6.0.30
Java(TM) SE Development Kit 6 Update 3 Sun Microsystems, Inc. 29.12.2007 342MB 1.6.0.30
JDownloader AppWork UG (haftungsbeschränkt) 07.09.2010 56,2MB 0.89
Last.fm 1.5.4.27091 Last.fm 31.10.2010 33,0MB
Lazarus 0.9.22 05.11.2010 374MB 0.9.22
LEGO Star Wars Ihr Firmenname 13.12.2007 1.873MB 1.00.0000
LEGO Star Wars 2 DEMO LucasArts 01.11.2007 245MB 1.00.0000
LEGO Star Wars Demo Disc Ihr Firmenname 12.11.2009 245MB 1.00.0000
Lern-o-Mat 22.06.2009 2,17MB
LiveUpdate 3.2 (Symantec Corporation) Symantec Corporation 03.11.2007 19,4MB 3.2.0.68
LiveUpdate Notice (Symantec Corporation) Symantec Corporation 11.08.2008 7,59MB 1.4.5
Luxor Amun Rising (remove only) 01.11.2007 18,1MB
Macro Express 3 Insight Software Solutions, Inc. 30.06.2008 15,8MB 3.0
Magic FLAC to MP3 Converter 3.72 Magic Video 09.08.2010 3,71MB
Mahjong Towers Eternity EU (remove only) 01.11.2007 15,7MB
Malwarebytes' Anti-Malware Version 1.51.1.1800 Malwarebytes Corporation 21.08.2011 3,91MB 1.51.1.1800
Master 2.3 Freeware Theo Heinze 19.11.2009 2,15MB
Mein Gutscheincode Finder 1.0.0.0 Conversion One GmbH 05.08.2011 1,91MB 1.0.0.0
Microsoft .NET Framework 1.1 15.08.2008
Microsoft .NET Framework 1.1 Hotfix (KB929729) 22.08.2008
Microsoft .NET Framework 3.5 Microsoft Corporation 06.07.2008 33,6MB
Microsoft .NET Framework 3.5 Language Pack - DEU Microsoft Corporation 06.07.2008 33,6MB
Microsoft .NET Framework SDK (German) 1.1 Microsoft 01.09.2008 332MB 1.1.4322
Microsoft Age of Empires II 26.09.2008 344MB
Microsoft Office Enterprise 2007 Microsoft Corporation 18.03.2010 731MB 12.0.6425.1000
Microsoft Office Home and Student 2007 Microsoft Corporation 18.03.2010 297MB 12.0.6425.1000
Microsoft Office PowerPoint Viewer 2007 (German) Microsoft Corporation 31.12.2006 51,0MB 12.0.4518.1014
Microsoft Silverlight Microsoft Corporation 23.07.2010 34,5MB 4.0.50524.0
Microsoft SQL Server Compact 3.5 Design Tools DEU Microsoft Corporation 04.04.2009 8,54MB 3.5.5386.0
Microsoft SQL Server Compact 3.5 DEU Microsoft Corporation 04.04.2009 2,25MB 3.5.5386.0
Microsoft Virtual PC 2007 Microsoft Corporation 05.04.2010 36,8MB 6.0.156.0
Microsoft Visual Basic 2005 Express Edition - DEU Microsoft Corporation 11.05.2008 166,3MB
Microsoft Visual Basic 2008 Express Edition - DEU Microsoft Corporation 03.04.2009 157,0MB
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 12.07.2010 0,41MB 8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 23.07.2010 0,58MB 9.0.30729
Microsoft Visual J# 2.0 Redistributable Package Microsoft Corporation 28.08.2008 133,1MB
Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework Microsoft 04.04.2009 5,62MB 3.5.21022
Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32 Microsoft Corporation 04.04.2009 2,61MB 6.1.5288.17011
Microsoft Works Microsoft Corporation 01.01.2007 377MB 9.7.0621
Microsoft WSE 3.0 Runtime Microsoft Corp. 11.07.2010 0,92MB 3.0.5305.0
MobileMe Control Panel Apple Inc. 04.10.2010 11,8MB 3.1.3.0
Movavi VideoSuite 5 MOVAVI 17.10.2008 68,4MB 5.07.004
Mozilla Firefox (3.6.20) Mozilla 17.08.2011 31,5MB 3.6.20 (de)
MSXML 4.0 SP2 (KB941833) Microsoft Corporation 01.01.2007 1,27MB 4.20.9849.0
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 22.11.2008 1,28MB 4.20.9870.0
Muziic Player & Encoder 01.11.2009 57,0MB
Mystery Case Files - Prime Suspects (remove only) 01.11.2007 39,3MB
Nero 7 Essentials Nero AG 31.12.2006 377MB 7.02.5851
Netscape Navigator (9.0.0.6) Netscape 27.03.2008 20,7MB 9.0.0.6 (en-US)
Norton Security Scan Symantec Corporation 03.05.2010 12,4MB 2.7.3.34
NVIDIA Drivers 14.07.2008
OJOsoft Audio Converter OJOsoft 05.09.2010 16,3MB 2.7.5.0412
OpenAL 11.02.2010 0,77MB
OpenOffice.org 2.4 OpenOffice.org 01.08.2008 328MB 2.4.9310
Opera 9.26 Opera Software ASA 11.03.2008 11,8MB 9.26
Pando Media Booster Pando Networks Inc. 02.11.2009 6,69MB 2.3.2.8
Pcsx2 0.9.6 Pcsx2 Team 06.04.2010 19,3MB 1.0.0
Poker Superstars II (remove only) 01.11.2007 30,3MB
PowerISO PowerISO Computing, Inc. 24.02.2010 3,76MB 4.6
QuickTime Apple Inc. 04.10.2010 73,7MB 7.68.75.0
RealPlayer RealNetworks 17.01.2008 46,8MB
Realtek High Definition Audio Driver 31.12.2006
Safari Apple Inc. 27.03.2008 60,8MB 3.525.13.0
SimCity 3000 28.12.2010 225MB
SimCity 4 30.12.2010 920MB
Softonic Toolbar Ask.com 28.05.2011 3,33MB 1.12.2.0
Softonic_Deutsch Toolbar 23.03.2011 3,91MB
Spesoft Audio Converter 2.30 Spesoft 09.08.2010 18,0MB
Streamripper (Remove only) 06.11.2009 6,30MB
Super nude patch II 2.8 31.07.2008
Theme Park World 28.12.2010 157,5MB
TIPP10 Version 2.0.3 (c) 2006-2008, Tom Thielicke 22.02.2010 12,2MB
Uninstall 1.0.0.1 13.11.2010 19,4MB
Unity Web Player Unity Technologies ApS 10.02.2011 0,20MB
VideoLAN VLC media player 0.8.6h VideoLAN Team 20.06.2008 32,4MB 0.8.6h
VoiceOver Kit Apple Inc. 26.07.2010 35,7MB 1.30.128.0
Vokabel Trainer 5 Manuel Wäschle 05.08.2011 4,98MB
WAV to MP3 06.08.2009 0,66MB
Winamp Nullsoft, Inc 08.01.2008 27,0MB 5.51
Windows Live Anmelde-Assistent Microsoft Corporation 21.12.2010 1,93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 21.12.2010 43,9MB 14.0.8117.0416
Windows Live-Uploadtool Microsoft Corporation 21.12.2010 0,22MB 14.0.8014.1029
Winload Toolbar Winload 05.08.2011 4,36MB 6.3.3.3
WinRAR 25.12.2007 3,66MB
Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY KONAMI 02.04.2010 229MB 1.00.0000
OTL 2. Mal Code:
ATTFilter OTL logfile created on: 25.08.2011 21:56:25 - Run 2 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\Fabian\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.16809) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free 6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe PRC - [2011.05.17 13:29:46 | 000,395,144 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe PRC - [2010.10.27 22:21:54 | 001,155,072 | ---- | M] (Last.fm) -- C:\Programme\Last.fm\LastFM.exe PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe PRC - [2007.09.26 11:53:56 | 000,623,984 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AUPDATE.EXE PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe ========== Modules (No Company Name) ========== MOD - [2010.10.27 22:23:04 | 000,106,496 | ---- | M] () -- C:\Programme\Last.fm\srv_rtaudioplayback.dll MOD - [2010.10.27 22:22:52 | 000,057,344 | ---- | M] () -- C:\Programme\Last.fm\ext_messengernotify.dll MOD - [2010.10.27 22:22:42 | 000,058,880 | ---- | M] () -- C:\Programme\Last.fm\ext_skypenotify.dll MOD - [2010.10.27 22:22:08 | 000,147,456 | ---- | M] () -- C:\Programme\Last.fm\srv_madtranscode.dll MOD - [2010.10.27 22:22:00 | 000,028,160 | ---- | M] () -- C:\Programme\Last.fm\srv_httpinput.dll MOD - [2010.10.27 22:19:28 | 000,372,736 | ---- | M] () -- C:\Programme\Last.fm\LastFmFingerprint1.dll MOD - [2010.10.27 22:19:06 | 000,025,088 | ---- | M] () -- C:\Programme\Last.fm\breakpad.dll MOD - [2010.10.27 22:18:50 | 000,180,224 | ---- | M] () -- C:\Programme\Last.fm\Moose1.dll MOD - [2010.10.27 22:18:34 | 000,540,672 | ---- | M] () -- C:\Programme\Last.fm\LastFmTools1.dll MOD - [2010.10.27 22:13:52 | 001,382,507 | ---- | M] () -- C:\Programme\Last.fm\libfftw3f-3.dll MOD - [2010.10.27 22:13:52 | 000,074,240 | ---- | M] () -- C:\Programme\Last.fm\zlibwapi.dll MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2008.04.16 18:42:30 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtNetwork4.dll MOD - [2008.04.16 18:42:16 | 000,524,288 | ---- | M] () -- C:\Programme\Last.fm\QtSql4.dll MOD - [2008.04.16 18:42:02 | 006,701,056 | ---- | M] () -- C:\Programme\Last.fm\QtGui4.dll MOD - [2008.04.16 18:36:38 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtXml4.dll MOD - [2008.04.16 18:36:34 | 001,654,784 | ---- | M] () -- C:\Programme\Last.fm\QtCore4.dll MOD - [2008.04.02 15:26:50 | 000,233,472 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qmng4.dll MOD - [2008.04.02 15:26:34 | 000,021,504 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qgif4.dll MOD - [2008.04.02 15:26:28 | 000,135,168 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qjpeg4.dll MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (sdCoreService) SRV - File not found [Auto | Stopped] -- -- (sdAuxService) SRV - File not found [On_Demand | Stopped] -- -- (osagent) SRV - File not found [On_Demand | Stopped] -- -- (oad) SRV - File not found [Auto | Stopped] -- -- (LiveUpdate Notice Ex) SRV - File not found [Auto | Stopped] -- -- (LckFldService) SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService) SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler) SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService) SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service) SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate) SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler) SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) ========== Driver Services (SafeList) ========== DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp) DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu) DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt) DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD) DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec) DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt) DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec) DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32) DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32) DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID) DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio) DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm) DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA) DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM) DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2) DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO) DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl) DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl) DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/" FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.100006 FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12 FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.2 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team) FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Fabian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.18 19:08:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.18 19:08:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Components: C:\Program Files\Netscape\Navigator 9\components [2010.10.04 20:43:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Plugins: C:\Program Files\Netscape\Navigator 9\plugins [2010.10.04 20:43:45 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.08.06 02:58:52 | 000,000,000 | ---D | M] [2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions [2011.08.25 14:05:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions [2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f} [2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} [2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} [2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} [2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard [2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis [2011.08.01 14:07:05 | 000,000,000 | ---D | M] ("Softonic Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\toolbar@ask.com [2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml [2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml [2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml [2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml [2011.08.24 14:23:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml [2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml [2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml [2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml [2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml [2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml [2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml [2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml [2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml [2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml [2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml [2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml [2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml [2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml [2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml [2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml [2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml [2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml [2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml [2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif [2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src [2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml [2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com [2011.08.06 02:58:52 | 000,000,000 | ---D | M] (preisspion.de) -- C:\PROGRAM FILES\MEIN GUTSCHEINCODE FINDER\FIREFOX [2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll [2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll [2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found. O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation) O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [EA Core] File not found O4 - HKCU..\Run: [ICQ] File not found O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: Free YouTube Download - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL [2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe [2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder [2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder [2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin [2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin [2011.08.21 15:10:30 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\Geäusche für Musik [2011.08.19 14:52:01 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\teeworlds-b122-r50edfd37-win32 [2011.08.12 20:43:14 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\bio-referat [2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content [2011.08.06 17:55:52 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon [2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon [2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer [2011.08.06 02:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vokabel Trainer [2011.08.06 02:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Vokabel Trainer [2011.08.06 02:59:00 | 000,000,000 | ---D | C] -- C:\Program Files\Winload [2011.08.06 02:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mein Gutscheincode Finder [2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5 [2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5 ========== Files - Modified Within 30 Days ========== [2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job [2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.08.25 21:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job [2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.08.25 21:20:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.08.25 19:27:07 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.08.25 19:26:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.08.25 19:26:50 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys [2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts [2011.08.24 00:10:46 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.08.24 00:10:46 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.08.24 00:10:46 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.08.24 00:10:46 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.08.23 20:50:48 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe [2011.08.23 15:15:58 | 000,010,054 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt [2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat [2011.08.11 19:55:43 | 009,527,411 | ---- | M] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3 [2011.08.06 02:59:37 | 000,000,904 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job [2011.07.27 05:02:13 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== Files Created - No Company Name ========== [2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys [2011.08.11 19:55:18 | 009,527,411 | ---- | C] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3 [2011.08.06 02:59:37 | 000,000,904 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk [2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE [2010.09.24 19:12:00 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll [2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2009.11.02 19:48:01 | 008,676,883 | ---- | C] () -- C:\Windows\System32\mp3Media2.dll [2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll [2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll [2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate [2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne [2008.10.18 16:40:35 | 000,000,060 | ---- | C] () -- C:\Windows\IniFile1.ini [2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll [2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat [2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE [2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini [2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll [2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI [2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll [2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI [2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll [2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png [2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI [2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll [2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll [2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat [2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll [2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll [2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys [2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys [2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat [2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe [2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat [2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat [2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini [2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll [2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll [2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll [1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll ========== LOP Check ========== [2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft [2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data [2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari [2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus [2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design [2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player [2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite [2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner [2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft [2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers [2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla [2010.08.10 14:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\foobar2000 [2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0 [2011.08.25 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ [2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar [2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite [2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software [2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer [2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin [2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat [2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2 [2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape [2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera [2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web [2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation [2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC [2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking [2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder [2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity [2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter [2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper [2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds [2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template [2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter [2011.08.25 19:26:01 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > |
| Themen zu BKA-Trojaner - Auswertung |
| adblock, alternate, antivir, bho, browser, conduit, error, excel.exe, firefox, flash player, format, google, google chrome, helper, home, internet, internet explorer, logfile, mozilla, mp3, nodrives, nvlddmkm.sys, plug-in, problem, security, senden, server, softonic deutsch toolbar, software, start menu, studio, sweetim, symantec, usb, version=1.0, vista, visual studio, windows, wma |
Baum-Darstellung