Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: BKA-Trojaner - Auswertung

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 25.08.2011, 21:14   #1
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Hallo liebe Leute.
Ich hatte auch vor ein paar Tagen den lästigen BKA-Trojaner. Ich habe mir zunächst provisorisch damit beholfen über den abgesicherten Modus eine Systemwiederherstellung zu machen aber hier im Forum durchs Stöbern gesehen, dass das das Problem nicht unbedingt löst.

Ich habe alle in einem anderen Post beschrieben Schritte erledigt:

1. Mal Otl

Code:
ATTFilter
All processes killed
========== OTL ==========
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-2.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-3.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.gif not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.src not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM not found.
File C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File X:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
File F:\LaunchU3.exe -a not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
File C:\Users\dube\Documents\Yvi.mcf not found.
File C:\Users\dube\Documents\Yvi.mcf~ not found.
Folder C:\ProgramData\SweetIM\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: asasas
->Temp folder emptied: 406157 bytes
->Temporary Internet Files folder emptied: 62442 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fabian
->Temp folder emptied: 171486774 bytes
->Temporary Internet Files folder emptied: 5977585 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64206707 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 17283 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 7693347 bytes
->FireFox cache emptied: 12349165 bytes
->Flash cache emptied: 495 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 384522 bytes
%systemroot%\System32 .tmp files removed: 4384 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1898178 bytes
RecycleBin emptied: 374123 bytes
 
Total Files Cleaned = 253,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192512

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         
Malware Bytes

Code:
ATTFilter
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7536

Windows 6.0.6000
Internet Explorer 7.0.6000.16809

25.08.2011 21:49:10
mbam-log-2011-08-25 (21-49-10).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|Z:\|)
Durchsuchte Objekte: 460483
Laufzeit: 2 Stunde(n), 16 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
         
Ccleaner
Code:
ATTFilter
AC3Filter (remove only)		03.05.2010	1,43MB	
Activation Assistant for the 2007 Microsoft Office suites	Microsoft Corporation	01.11.2007	14,0MB	
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	14.03.2010		10.0.45.2
Adobe Flash Player 10 Plugin	Adobe Systems Incorporated	18.07.2011		10.3.181.34
Adobe Photoshop CS4	Adobe Systems Incorporated	30.04.2010		11.0
Adobe Photoshop Elements 6.0	Adobe Systems, Inc.	24.02.2010	375MB	6.0
Adobe Reader 8.1.1 - Deutsch	Adobe Systems Incorporated	29.12.2007	105,7MB	8.1.1
AGEIA PhysX v7.09.13	AGEIA Technologies, Inc.	21.06.2008	99,5MB	7.09.13
Amazon Kindle	Amazon	05.08.2011	55,2MB	
AnyToISO	CrystalIdea Software, Inc.	04.04.2010	12,7MB	2.6.2
Apple Application Support	Apple Inc.	05.09.2010	42,8MB	1.3.2
Apple Mobile Device Support	Apple Inc.	05.09.2010	20,1MB	3.2.0.47
Apple Software Update	Apple Inc.	29.11.2009	2,16MB	2.1.1.116
Audacity 1.2.6		17.01.2008	8,43MB	
Avira AntiVir Personal - Free Antivirus	Avira GmbH	20.07.2008	30,3MB	
Bananarama		18.07.2009	1,55MB	
Bonjour	Apple Inc.	04.10.2010	1,12MB	2.0.3.0
Borland Delphi 5		31.08.2008		
Borland Delphi 7	Borland Software Corporation	20.11.2008	141,2MB	7.0
CCleaner	Piriform	24.08.2011	2,95MB	3.10
Cheat Engine 5.6.1	Dark Byte	23.09.2010	23,3MB	
Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University		02.11.2007	698MB	2.0 (beta)
Compact&Easy		21.12.2007	9,07MB	
Compatibility Pack für 2007 Office System	Microsoft Corporation	31.12.2006	56,2MB	12.0.4518.1014
Crazy Machines	FAKT Software GmbH	11.06.2011	41,7MB	1.0
Crysis® 2 Demo	Electronic Arts	27.03.2011	1.760MB	1.0.0.0
Die Sims 2: Family Fun - Accessoires		12.11.2007	282MB	
Die Sims 2: Nightlife		11.11.2007	1.287MB	
Die Sims 2: Open For Business		11.11.2007	698MB	
Die Sims 2: Wilde Campus-Jahre		01.11.2007	925MB	
Die Sims™ 2 Apartment-Leben	Electronic Arts	29.08.2008	1.307MB	
Die Sims™ 2 Freizeit-Spaß	Electronic Arts	02.08.2008	1.179MB	
Die Sims™ 2 Gute Reise	Electronic Arts	11.11.2007	947MB	
Die Sims™ 2 H&M®-Fashion-Accessoires		12.11.2007	498MB	
Die Sims™ 2 Haustiere		01.11.2007	801MB	
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires	Electronic Arts	01.08.2008	473MB	
Die Sims™ 2 Party-Accessoires		12.11.2007	367MB	
Die Sims™ 2 Vier Jahreszeiten		11.11.2007	869MB	
Die Sims™ 2: Glamour-Accessoires		12.11.2007	356MB	
DivX Converter	DivX, Inc.	15.04.2010	37,1MB	7.0.0
DivX Plus DirectShow Filters	DivX, Inc.	15.04.2010	1,22MB	
DivX-Setup	DivX, Inc. 	03.05.2010	2,06MB	1.0.1.5
Dungeon Keeper 2		22.07.2010	491MB	
DVDVideoSoftTB Toolbar		30.05.2010	2,61MB	
Efficient WMA MP3 Converter v0.99.2		11.09.2008	26,9MB	
Elecard MPEG-2 Decoder&Streaming Plug-in for WMP	Elecard	03.05.2010	0,66MB	3.7.90209
Electronic Arts Product Registration	Electronic Arts	19.07.2009	1,64MB	1.01.0000
FirstSteps Diagnostics	Fujitsu Siemens Computers	31.12.2006	4,67MB	1.00
Folder Access 2.1 Free Version		16.01.2010	0,94MB	
foobar2000 v1.0.3	Peter Pawlowski	09.08.2010	8,17MB	1.0.3
Forte Free 2.0		04.10.2010	27,8MB	
Fraps		05.02.2009	4,61MB	
Free Audio CD Burner version 1.4	DVDVideoSoft Limited.	11.09.2010	3,12MB	
Free Audio Converter version 2.0	DVDVideoSoft Limited.	05.09.2010	5,77MB	
Free YouTube Download 2.9	DVDVideoSoft Limited.	13.11.2010	3,27MB	
Free YouTube Download 3 version 3.0.3.622	DVDVideoSoft Limited.	30.06.2011	4,27MB	
Free YouTube to MP3 Converter version 3.9.40.602	DVDVideoSoft Limited.	09.06.2011	12,5MB	
FreeMind		04.09.2010	10,3MB	0.8.1
Freez FLV to MP3 Converter	www.smallvideosoft.com	01.11.2009	9,21MB	1.5
FSCLounge	Fujitsu Siemens Computers	01.01.2007	8,47MB	1.0.0
GameWiz32	Nico Ebert	02.01.2011	1,64MB	1.43
GeoGebra	GeoGebra Inc.	28.08.2008	55,9MB	3.0.0.0
Google Chrome	Google Inc.	28.06.2011	46,6MB	13.0.782.215
Google Earth	Google	31.05.2011	84,7MB	6.0.3.2197
Grand Theft Auto San Andreas	Rockstar Games	24.12.2007	4.795MB	1.00.00001
GTA2		25.03.2010	72,0MB	
Hama Double Action Air Grip	GASIA	06.04.2010	1,09MB	1.00.0000
HP Smart Web Printing	Ihr Firmenname	13.09.2008	6,33MB	2.15.7.0
HP Update	Hewlett-Packard	13.09.2008	3,71MB	4.000.006.003
HPSSupply	Ihr Firmenname	13.09.2008	0,96MB	2.2.0.0000
HyperCam 2		10.02.2009	1,28MB	
ICQ Toolbar	ICQ	31.10.2010	0,13MB	3.0.0
ICQ7.5	ICQ	04.08.2011	54,0MB	7.5
ISO Commander 1.6 (remove only)	TurtleBlast Software	02.04.2010	1,18MB	1.6
iTunes	Apple Inc.	04.10.2010	138,7MB	10.0.1.22
Java DB 10.2.2.0	Sun Microsystems, Inc	28.12.2007	24,4MB	10.2.2.0
Java(TM) 6 Update 19	Sun Microsystems, Inc.	02.04.2010	94,5MB	6.0.190
Java(TM) 6 Update 3	Sun Microsystems, Inc.	29.12.2007	168,1MB	1.6.0.30
Java(TM) SE Development Kit 6 Update 3	Sun Microsystems, Inc.	29.12.2007	342MB	1.6.0.30
JDownloader	AppWork UG (haftungsbeschränkt)	07.09.2010	56,2MB	0.89
Last.fm 1.5.4.27091	Last.fm	31.10.2010	33,0MB	
Lazarus 0.9.22		05.11.2010	374MB	0.9.22
LEGO Star Wars	Ihr Firmenname	13.12.2007	1.873MB	1.00.0000
LEGO Star Wars 2 DEMO	LucasArts	01.11.2007	245MB	1.00.0000
LEGO Star Wars Demo Disc	Ihr Firmenname	12.11.2009	245MB	1.00.0000
Lern-o-Mat		22.06.2009	2,17MB	
LiveUpdate 3.2 (Symantec Corporation)	Symantec Corporation	03.11.2007	19,4MB	3.2.0.68
LiveUpdate Notice (Symantec Corporation)	Symantec Corporation	11.08.2008	7,59MB	1.4.5
Luxor Amun Rising (remove only)		01.11.2007	18,1MB	
Macro Express 3	Insight Software Solutions, Inc.	30.06.2008	15,8MB	3.0
Magic FLAC to MP3 Converter 3.72	Magic Video	09.08.2010	3,71MB	
Mahjong Towers Eternity EU (remove only)		01.11.2007	15,7MB	
Malwarebytes' Anti-Malware Version 1.51.1.1800	Malwarebytes Corporation	21.08.2011	3,91MB	1.51.1.1800
Master 2.3 Freeware	Theo Heinze	19.11.2009	2,15MB	
Mein Gutscheincode Finder 1.0.0.0	Conversion One GmbH	05.08.2011	1,91MB	1.0.0.0
Microsoft .NET Framework 1.1		15.08.2008		
Microsoft .NET Framework 1.1 Hotfix (KB929729)		22.08.2008		
Microsoft .NET Framework 3.5	Microsoft Corporation	06.07.2008	33,6MB	
Microsoft .NET Framework 3.5 Language Pack - DEU	Microsoft Corporation	06.07.2008	33,6MB	
Microsoft .NET Framework SDK (German) 1.1	Microsoft	01.09.2008	332MB	1.1.4322
Microsoft Age of Empires II		26.09.2008	344MB	
Microsoft Office Enterprise 2007	Microsoft Corporation	18.03.2010	731MB	12.0.6425.1000
Microsoft Office Home and Student 2007	Microsoft Corporation	18.03.2010	297MB	12.0.6425.1000
Microsoft Office PowerPoint Viewer 2007 (German)	Microsoft Corporation	31.12.2006	51,0MB	12.0.4518.1014
Microsoft Silverlight	Microsoft Corporation	23.07.2010	34,5MB	4.0.50524.0
Microsoft SQL Server Compact 3.5 Design Tools DEU	Microsoft Corporation	04.04.2009	8,54MB	3.5.5386.0
Microsoft SQL Server Compact 3.5 DEU	Microsoft Corporation	04.04.2009	2,25MB	3.5.5386.0
Microsoft Virtual PC 2007	Microsoft Corporation	05.04.2010	36,8MB	6.0.156.0
Microsoft Visual Basic 2005 Express Edition - DEU	Microsoft Corporation	11.05.2008	166,3MB	
Microsoft Visual Basic 2008 Express Edition - DEU	Microsoft Corporation	03.04.2009	157,0MB	
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	12.07.2010	0,41MB	8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	23.07.2010	0,58MB	9.0.30729
Microsoft Visual J# 2.0 Redistributable Package	Microsoft Corporation	28.08.2008	133,1MB	
Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework	Microsoft	04.04.2009	5,62MB	3.5.21022
Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32	Microsoft Corporation	04.04.2009	2,61MB	6.1.5288.17011
Microsoft Works	Microsoft Corporation	01.01.2007	377MB	9.7.0621
Microsoft WSE 3.0 Runtime	Microsoft Corp.	11.07.2010	0,92MB	3.0.5305.0
MobileMe Control Panel	Apple Inc.	04.10.2010	11,8MB	3.1.3.0
Movavi VideoSuite 5	MOVAVI	17.10.2008	68,4MB	5.07.004
Mozilla Firefox (3.6.20)	Mozilla	17.08.2011	31,5MB	3.6.20 (de)
MSXML 4.0 SP2 (KB941833)	Microsoft Corporation	01.01.2007	1,27MB	4.20.9849.0
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	22.11.2008	1,28MB	4.20.9870.0
Muziic Player & Encoder		01.11.2009	57,0MB	
Mystery Case Files - Prime Suspects (remove only)		01.11.2007	39,3MB	
Nero 7 Essentials	Nero AG	31.12.2006	377MB	7.02.5851
Netscape Navigator (9.0.0.6)	Netscape	27.03.2008	20,7MB	9.0.0.6 (en-US)
Norton Security Scan	Symantec Corporation	03.05.2010	12,4MB	2.7.3.34
NVIDIA Drivers		14.07.2008		
OJOsoft Audio Converter	OJOsoft	05.09.2010	16,3MB	2.7.5.0412
OpenAL		11.02.2010	0,77MB	
OpenOffice.org 2.4	OpenOffice.org	01.08.2008	328MB	2.4.9310
Opera 9.26	Opera Software ASA	11.03.2008	11,8MB	9.26
Pando Media Booster	Pando Networks Inc.	02.11.2009	6,69MB	2.3.2.8
Pcsx2 0.9.6	Pcsx2 Team	06.04.2010	19,3MB	1.0.0
Poker Superstars II (remove only)		01.11.2007	30,3MB	
PowerISO	PowerISO Computing, Inc.	24.02.2010	3,76MB	4.6
QuickTime	Apple Inc.	04.10.2010	73,7MB	7.68.75.0
RealPlayer	RealNetworks	17.01.2008	46,8MB	
Realtek High Definition Audio Driver		31.12.2006		
Safari	Apple Inc.	27.03.2008	60,8MB	3.525.13.0
SimCity 3000		28.12.2010	225MB	
SimCity 4		30.12.2010	920MB	
Softonic Toolbar	Ask.com	28.05.2011	3,33MB	1.12.2.0
Softonic_Deutsch Toolbar		23.03.2011	3,91MB	
Spesoft Audio Converter 2.30	Spesoft	09.08.2010	18,0MB	
Streamripper (Remove only)		06.11.2009	6,30MB	
Super nude patch II 2.8		31.07.2008		
Theme Park World		28.12.2010	157,5MB	
TIPP10 Version 2.0.3	(c) 2006-2008, Tom Thielicke	22.02.2010	12,2MB	
Uninstall 1.0.0.1		13.11.2010	19,4MB	
Unity Web Player	Unity Technologies ApS	10.02.2011	0,20MB	
VideoLAN VLC media player 0.8.6h	VideoLAN Team	20.06.2008	32,4MB	0.8.6h
VoiceOver Kit	Apple Inc.	26.07.2010	35,7MB	1.30.128.0
Vokabel Trainer 5	Manuel Wäschle	05.08.2011	4,98MB	
WAV to MP3		06.08.2009	0,66MB	
Winamp	Nullsoft, Inc	08.01.2008	27,0MB	5.51 
Windows Live Anmelde-Assistent	Microsoft Corporation	21.12.2010	1,93MB	5.000.818.5
Windows Live Essentials	Microsoft Corporation	21.12.2010	43,9MB	14.0.8117.0416
Windows Live-Uploadtool	Microsoft Corporation	21.12.2010	0,22MB	14.0.8014.1029
Winload Toolbar	Winload	05.08.2011	4,36MB	6.3.3.3
WinRAR		25.12.2007	3,66MB	
Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY	KONAMI	02.04.2010	229MB	1.00.0000
         

OTL 2. Mal

Code:
ATTFilter
OTL logfile created on: 25.08.2011 21:56:25 - Run 2
OTL by OldTimer - Version 3.2.26.5     Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free
6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
PRC - [2011.05.17 13:29:46 | 000,395,144 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2010.10.27 22:21:54 | 001,155,072 | ---- | M] (Last.fm) -- C:\Programme\Last.fm\LastFM.exe
PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe
PRC - [2007.09.26 11:53:56 | 000,623,984 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AUPDATE.EXE
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe
PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.10.27 22:23:04 | 000,106,496 | ---- | M] () -- C:\Programme\Last.fm\srv_rtaudioplayback.dll
MOD - [2010.10.27 22:22:52 | 000,057,344 | ---- | M] () -- C:\Programme\Last.fm\ext_messengernotify.dll
MOD - [2010.10.27 22:22:42 | 000,058,880 | ---- | M] () -- C:\Programme\Last.fm\ext_skypenotify.dll
MOD - [2010.10.27 22:22:08 | 000,147,456 | ---- | M] () -- C:\Programme\Last.fm\srv_madtranscode.dll
MOD - [2010.10.27 22:22:00 | 000,028,160 | ---- | M] () -- C:\Programme\Last.fm\srv_httpinput.dll
MOD - [2010.10.27 22:19:28 | 000,372,736 | ---- | M] () -- C:\Programme\Last.fm\LastFmFingerprint1.dll
MOD - [2010.10.27 22:19:06 | 000,025,088 | ---- | M] () -- C:\Programme\Last.fm\breakpad.dll
MOD - [2010.10.27 22:18:50 | 000,180,224 | ---- | M] () -- C:\Programme\Last.fm\Moose1.dll
MOD - [2010.10.27 22:18:34 | 000,540,672 | ---- | M] () -- C:\Programme\Last.fm\LastFmTools1.dll
MOD - [2010.10.27 22:13:52 | 001,382,507 | ---- | M] () -- C:\Programme\Last.fm\libfftw3f-3.dll
MOD - [2010.10.27 22:13:52 | 000,074,240 | ---- | M] () -- C:\Programme\Last.fm\zlibwapi.dll
MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008.04.16 18:42:30 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtNetwork4.dll
MOD - [2008.04.16 18:42:16 | 000,524,288 | ---- | M] () -- C:\Programme\Last.fm\QtSql4.dll
MOD - [2008.04.16 18:42:02 | 006,701,056 | ---- | M] () -- C:\Programme\Last.fm\QtGui4.dll
MOD - [2008.04.16 18:36:38 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtXml4.dll
MOD - [2008.04.16 18:36:34 | 001,654,784 | ---- | M] () -- C:\Programme\Last.fm\QtCore4.dll
MOD - [2008.04.02 15:26:50 | 000,233,472 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qmng4.dll
MOD - [2008.04.02 15:26:34 | 000,021,504 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qgif4.dll
MOD - [2008.04.02 15:26:28 | 000,135,168 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qjpeg4.dll
MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (sdCoreService)
SRV - File not found [Auto | Stopped] --  -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] --  -- (osagent)
SRV - File not found [On_Demand | Stopped] --  -- (oad)
SRV - File not found [Auto | Stopped] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] --  -- (LckFldService)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt)
DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID)
DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA)
DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.100006
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Fabian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.18 19:08:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.18 19:08:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Components: C:\Program Files\Netscape\Navigator 9\components [2010.10.04 20:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Plugins: C:\Program Files\Netscape\Navigator 9\plugins [2010.10.04 20:43:45 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.08.06 02:58:52 | 000,000,000 | ---D | M]
 
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions
[2011.08.25 14:05:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions
[2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2011.08.01 14:07:05 | 000,000,000 | ---D | M] ("Softonic Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\toolbar@ask.com
[2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.24 14:23:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
[2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2011.08.06 02:58:52 | 000,000,000 | ---D | M] (preisspion.de) -- C:\PROGRAM FILES\MEIN GUTSCHEINCODE FINDER\FIREFOX
[2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll
[2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder
[2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder
[2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin
[2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin
[2011.08.21 15:10:30 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\Geäusche für Musik
[2011.08.19 14:52:01 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\teeworlds-b122-r50edfd37-win32
[2011.08.12 20:43:14 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\bio-referat
[2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content
[2011.08.06 17:55:52 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
[2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon
[2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2011.08.06 02:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vokabel Trainer
[2011.08.06 02:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Vokabel Trainer
[2011.08.06 02:59:00 | 000,000,000 | ---D | C] -- C:\Program Files\Winload
[2011.08.06 02:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mein Gutscheincode Finder
[2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
[2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.25 21:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
[2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 21:20:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.25 19:27:07 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.25 19:26:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.25 19:26:50 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.08.24 00:10:46 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.24 00:10:46 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.24 00:10:46 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.24 00:10:46 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.23 20:50:48 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job
[2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.23 15:15:58 | 000,010,054 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt
[2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2011.08.11 19:55:43 | 009,527,411 | ---- | M] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3
[2011.08.06 02:59:37 | 000,000,904 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
[2011.07.27 05:02:13 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Files Created - No Company Name ==========
 
[2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.11 19:55:18 | 009,527,411 | ---- | C] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3
[2011.08.06 02:59:37 | 000,000,904 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2010.09.24 19:12:00 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009.11.02 19:48:01 | 008,676,883 | ---- | C] () -- C:\Windows\System32\mp3Media2.dll
[2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
[2008.10.18 16:40:35 | 000,000,060 | ---- | C] () -- C:\Windows\IniFile1.ini
[2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat
[2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll
[2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png
[2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI
[2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll
[2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat
[2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe
[2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat
[2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat
[2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
[2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
 
========== LOP Check ==========
 
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2010.08.10 14:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\foobar2000
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2011.08.25 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2011.08.25 19:26:01 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
         

Alt 25.08.2011, 21:16   #2
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Extras

Code:
ATTFilter
OTL Extras logfile created on: 25.08.2011 21:56:25 - Run 2
OTL by OldTimer - Version 3.2.26.5     Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free
6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036AD46C-F133-4870-9973-43F8F1749C05}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{0827B1ED-7C0E-46DE-9B68-FE4507996B1B}" = lport=138 | protocol=17 | dir=in | app=system | 
"{0D776123-0177-4A44-8CE8-5394DCBCE19F}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe | 
"{0DFF39ED-609F-4F70-A312-977BB4EA4C95}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0E3EE5EF-F522-4387-80AB-719C4D2C9999}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe | 
"{0E9B2B55-907D-4914-B06F-8E5B79D158C2}" = rport=138 | protocol=17 | dir=out | app=system | 
"{1759072B-13B7-499D-9B61-612CCC1B3D2D}" = lport=27000 | protocol=6 | dir=in | name=d | 
"{1EBEA911-67BE-419C-874F-E1581C565E9A}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe | 
"{2A278909-A1EA-402A-93CE-300F9EFB6D73}" = rport=137 | protocol=17 | dir=out | app=system | 
"{2F7144FB-161C-4466-AFC0-D29C1B7C1454}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=datei- und druckerfreigabe (spoolerdienst - rpc-epmap) | 
"{3150F03F-4F16-4A48-8203-A940A6031EFF}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe | 
"{35D8F183-3920-4557-B596-19870DB6DE51}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{36011B8E-B147-4963-A6D2-826484F3082B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe | 
"{435A64E7-0986-45B9-B8E5-94966C533E52}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe | 
"{439BF87C-C7A6-4CE2-935F-6AD809675F30}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{4D6A5E9F-143B-44EB-BC4B-FFF9516BE53E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{52AEC027-3A2F-4BF1-BF67-BD24A029AE1A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe | 
"{65999647-1C74-4D35-99C1-36CC42D060E0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe | 
"{67334780-E818-47DA-827B-1A5B43202C2C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{6B567DA0-527B-4EF3-8EC9-0211B47F59BF}" = lport=139 | protocol=6 | dir=in | app=system | 
"{6FA4AB99-4DB6-4C10-89D9-C88972EA2583}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{813B975C-3260-4B28-9F16-9F07AEC40D30}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{944D6ECB-DD63-4DE7-84CB-F3959E0E195A}" = rport=139 | protocol=6 | dir=out | app=system | 
"{99D470F2-0066-4F55-A9C8-881ACD582D56}" = rport=2178 | protocol=6 | dir=out | app=system | 
"{9BEEA4BF-ADBC-43B9-8FCA-FEA9145EE6B7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{AB4B898A-879E-4AFC-9AE5-876285DA4D9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{AD7FE4B7-98AF-4BFB-AE5D-A90063314809}" = lport=445 | protocol=6 | dir=in | app=system | 
"{AEB42302-8669-4D9C-8398-49CF2494882A}" = lport=6884 | protocol=17 | dir=in | name=6884 | 
"{B0B4E08D-F005-440A-B8BD-5DB578B6DC5C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{BC0C8E39-60D1-40F1-AF7F-343E32F4475C}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe | 
"{C6BC8FC2-94D7-44ED-924B-F8E405BE3B68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{C92A54A0-15A1-4E64-AA9F-AF034FBD95D0}" = rport=445 | protocol=6 | dir=out | app=system | 
"{C9FBF73F-656A-4369-AE29-1EF0253D3253}" = lport=2178 | protocol=6 | dir=in | app=system | 
"{E84AFAE9-1D9C-45C9-9E56-C06E07C385FF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{EEF4DA8D-99F4-4E27-80F7-0F1B83C67635}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15B7DACE-B63D-4B00-BDE7-38EBE09CD8B8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{1906B78A-1159-499A-9E4D-2453B77F4950}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{1D561E35-6EBC-45E2-83CE-2A0C2EDEBD93}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe | 
"{232CF333-A59B-4C26-A399-E4254B8F9C6D}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{23D860D8-52FC-4732-84F6-E3BBA890E6F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{27D5C767-A8DE-49D0-A43F-FADB8815438D}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{2CA149DF-F520-4730-BCE3-46D689750ECF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{30D0F232-C116-4A20-A2DE-9B5BC04E7C3B}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) | 
"{37FFD9AE-FE98-469F-85B3-55F9F4F35E46}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{3C45477E-95C6-408B-B992-7E22911994C6}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{433D1D5A-F129-4D74-8BE6-5A8D33700882}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{435E5788-3302-4210-B920-5255232777BD}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) | 
"{4754B88C-2B44-438D-8FF7-FCFF22B00F68}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{4A0942E6-2365-44DD-BA0E-77D346AE430D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{51504434-7621-456C-9571-14825D5F4ABA}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe | 
"{61C7C6D5-891B-4708-A525-0965793F9FDE}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{771AAC88-87B4-4A32-9A08-EC21885B4603}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{82FBAC0C-7A7E-4A98-8DA6-3B6319EF14BE}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe | 
"{8E8B846C-446E-4DEB-8C0D-D7ECF303529E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{93B56A5A-7FA5-446A-BF6F-140D7A04D42C}" = protocol=6 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe | 
"{9562B05F-1968-478E-9FAA-BB70B3439EDD}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{96A48BB4-BB84-4D82-8117-8E82664C88C7}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{98E66267-3FBC-4BF7-A82E-8747C9DC9AE0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{9B6D63F1-5909-4231-9198-EB4A1E2E9A33}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{A24F9136-82F0-4B84-9696-690EEA537AD8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{A28EC850-3092-4143-9B94-88A1D2FD3461}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{A3B82801-0D1E-4C35-8A2F-69C76DCC8154}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A681499F-FFC5-406F-BBF6-4C0C5761C370}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A9B112C1-8DC6-4119-A805-88E380BEB530}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe | 
"{AB9F5538-F00F-4C8A-BD02-3FC401046CA1}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{B2BDA0AB-BEEC-4BA4-A559-083978D7A417}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{BFF1FE41-2B7D-43F4-ABB0-E3096347F65A}" = protocol=17 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe | 
"{CA8FB01D-F1E9-4584-82C6-1F899AF18E04}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{D2C859FB-6AE9-4B51-8047-6D854C1FD5CC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{D396557A-B10D-433D-8EAF-7F3B0E6ABA09}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{E96972C8-6FBC-4693-868D-25DD48A7FB03}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{F62E7995-EC73-4D64-BD39-301199818FC9}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe | 
"{FCD20E1D-696D-41D7-9BE8-02774CF95EBC}" = protocol=58 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv6 ausgehend) | 
"{FEE82F35-479B-4856-95D0-21CEFA9FB224}" = protocol=1 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv4 ausgehend) | 
"TCP Query User{257E13E3-4875-4248-B254-0B20E8379C49}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=6 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe | 
"TCP Query User{3DF5626D-F4A2-43B8-BC7F-9D4116F33FD0}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{5C31B729-1B71-4381-BE09-1A9900197AFA}C:\program files\pando networks\media booster\pmb.exe" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"TCP Query User{640A83A8-A2B6-472B-9BE5-31F7B07295FD}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"TCP Query User{9BC5B727-73F0-4BEE-A7B1-97AD6040F044}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"TCP Query User{AF729254-2EC2-4F2E-A3EE-D650B643879C}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"TCP Query User{B9B2ED80-1CB0-47FA-9F39-D7E425EDD390}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=6 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe | 
"TCP Query User{BC6169AD-2DBE-494D-94F5-AB5916DCD08A}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"TCP Query User{CEAE6599-A07C-4596-A36D-2F42F63C65CE}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{FB1981AE-E5BB-4345-BED9-E4608B86F654}C:\program files\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe | 
"UDP Query User{08B0AA2C-D956-4203-8012-C2B45786FD33}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"UDP Query User{100D2469-6D57-43A3-AC65-EE8FF117650A}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | 
"UDP Query User{81608F9D-B034-46B2-9DC8-065455D966A7}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"UDP Query User{9A68E0A5-F49F-4D2C-B8C7-146B8E8E2AF3}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 
"UDP Query User{B0E92103-B06D-4CB1-A9AB-A4E6861C8FF0}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{D27B843C-F33C-4B8F-95E6-63DFFB652B7A}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{DCD3D474-03C1-4A03-9514-EB76E06C534A}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=17 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe | 
"UDP Query User{EAB1E2FD-8538-4E65-B3A0-8C352C0AF04F}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=17 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe | 
"UDP Query User{EF3FA45A-AB22-41F7-B93D-BAF2EB906ECA}C:\program files\pando networks\media booster\pmb.exe" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"UDP Query User{EFF85BBF-A16D-4633-9E2C-41F4B19B5D66}C:\program files\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0AFC9710-5DD6-4C6A-BA52-91AE992B2C9D}" = Safari
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}" = Java DB 10.2.2.0
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BF4CB15-6055-452A-8487-021AE2D91208}" = Crysis® 2 Demo
"{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1" = Mein Gutscheincode Finder 1.0.0.0
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{28F11027-A8BC-44D3-A59A-CA018ED73E8C}" = Compact&Easy
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{32A3A4F4-B792-11D6-A78A-00B0D0160030}" = Java(TM) SE Development Kit 6 Update 3
"{3571656A-575D-4CED-809D-5547587121FF}" = Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E074808-1B86-4230-A9EB-0904942EC4AE}" = LEGO Star Wars II
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56403FFF-145E-35C5-A090-96598BE57FB8}" = Microsoft Visual Basic 2008 Express Edition - DEU
"{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1" = Vokabel Trainer 5
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{63E921D9-799A-44F9-A742-DE3DC968AFEF}" = Microsoft .NET Framework SDK (German) 1.1
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7BE667F1-6643-4469-A830-6C360B1A036F}" = Movavi VideoSuite 5
"{81CD6232-10F5-4832-B3DA-1B88B1571031}" = Nero 7 Essentials
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = Die Sims™ 2 H&M®-Fashion-Accessoires
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8E6A3B40-DCE3-47D9-835B-FE1AD9C083D0}" = Crazy Machines
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" = 
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{975E4CAE-D408-48DA-9346-65D7DB72B7DE}" = Hama Double Action Air Grip
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = Die Sims™ 2: Glamour-Accessoires
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.1 - Deutsch
"{AC816492-1A38-47FA-975E-D5BDAD8ADCAB}" = Lern-o-Mat
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B639110D-747F-40DC-9682-95D94EF73790}" = dj_sf_software
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = Die Sims™ 2 Apartment-Leben
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C07B8BC4-AFD9-3AA4-BDF5-330A07591FDE}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBA2E782-C278-4B81-008D-4703FCBC1A2E}" = SimCity 4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"{EAA38532-7AD0-4f78-918A-4F4F02096ECE}" = Die Sims™ 2 Party-Accessoires
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = Die Sims™ 2 Gute Reise
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"{FB706A00-C234-4716-AB1F-27DCB192C664}" = Opera 9.26
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"AC3Filter" = AC3Filter (remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Age of Empires 2.0" = Microsoft Age of Empires II
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"AnyToISO_is1" = AnyToISO
"Audacity_is1" = Audacity 1.2.6
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Bananarama" = Bananarama
"CCleaner" = CCleaner
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Delphi5" = Borland Delphi 5
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Dungeon Keeper 2" = Dungeon Keeper 2
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Efficient WMA MP3 Converter_is1" = Efficient WMA MP3 Converter v0.99.2
"Elecard MPEG-2 Decoder&Streaming Plug-in for WMP 3.7.90209" = Elecard MPEG-2 Decoder&Streaming Plug-in for WMP
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Folder Access 2.1 Free Version" = Folder Access 2.1 Free Version
"foobar2000" = foobar2000 v1.0.3
"Forte Free" = Forte Free 2.0
"Fraps" = Fraps
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Audio Converter_is1" = Free Audio Converter version 2.0
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.3.622
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"Freez FLV to MP3 Converter v1.5_is1" = Freez FLV to MP3 Converter
"GameWiz32" = GameWiz32
"GeoGebra" = GeoGebra
"GTA2" = GTA2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HyperCam 2" = HyperCam 2
"ICQToolbar" = ICQ Toolbar
"InstallShield_{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"InstallShield_{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"InstallShield_{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"ISO Commander" = ISO Commander 1.6 (remove only)
"JDownloader" = JDownloader
"LastFM_is1" = Last.fm 1.5.4.27091
"Lazarus_is1" = Lazarus 0.9.22
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Luxor Amun Rising" = Luxor Amun Rising (remove only)
"Macro Express 3" = Macro Express 3
"Magic FLAC to MP3 Converter_is1" = Magic FLAC to MP3 Converter 3.72
"Mahjong Towers Eternity EU" = Mahjong Towers Eternity EU (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.1.1800
"Master_is1" = Master 2.3 Freeware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft Visual Basic 2005 Express Edition - DEU" = Microsoft Visual Basic 2005 Express Edition - DEU
"Microsoft Visual Basic 2008 Express Edition - DEU" = Microsoft Visual Basic 2008 Express Edition - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox (3.6.20)" = Mozilla Firefox (3.6.20)
"MTS2_ColourOptions_is1" = Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"Netscape Navigator (9.0.0.6)" = Netscape Navigator (9.0.0.6)
"NSS" = Norton Security Scan
"NVIDIA Drivers" = NVIDIA Drivers
"OJOsoft Audio Converter_is1" = OJOsoft Audio Converter
"OpenAL" = OpenAL
"Poker Superstars II" = Poker Superstars II (remove only)
"PowerISO" = PowerISO
"RealPlayer 6.0" = RealPlayer
"SimCity 3000" = SimCity 3000
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"Spesoft Audio Converter_is1" = Spesoft Audio Converter 2.30
"Streamripper" = Streamripper (Remove only)
"Super_nude_patch_II_1.0" = Super nude patch II 2.8
"Theme Park World" = Theme Park World
"TIPP10_is1" = TIPP10 Version 2.0.3
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WAV to MP3" = WAV to MP3
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"Winload Toolbar" = Winload Toolbar
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Google Chrome" = Google Chrome
"Muziic Player & Encoder" = Muziic Player & Encoder
"UnityWebPlayer" = Unity Web Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.08.2011 14:04:15 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 08:26:17 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 25.08.2011 12:49:40 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 384: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 388: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 376: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:32:42 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 25.08.2011 13:32:44 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 25.08.2011 14:26:58 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description = 
 
[ Media Center Events ]
Error - 13.12.2010 17:33:55 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 25.12.2010 10:00:53 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 04.02.2011 10:01:44 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 34
Description = Ereignisinformationen: Ermittlungsdienst: Unerwarteter Fehler. Der
 TV-Programmlistendienst ist zurzeit nicht verfügbar. Wiederholen Sie den Vorgang
 später. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton 
 
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 24.02.2011 11:35:52 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
 Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
 Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 04.03.2011 07:31:20 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
 Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
 Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 22.03.2011 10:00:17 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 14.04.2011 11:32:31 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 07.07.2011 09:49:00 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
[ System Events ]
Error - 25.08.2011 07:25:51 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.08.2011 13:25:15 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7034
Description = 
 
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

So. Hoffe, dass das hilfreich war und ihr mir helfen könnt. Wäre super.
Liebe Grüße Fabian
__________________


Alt 28.08.2011, 10:04   #3
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Hi nochmal. Ich will ja wirklich nicht nerven aber der Thread war ja schon auf Seite 3. Aber könnt ihr mir denn nicht helfen oder so?
Ich kann ja verstehen, dass das schwer ist aufgrund der Menge von Zuschriften hier aber trotzdem
__________________

Alt 29.08.2011, 12:42   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Es steht hier überall, dass du den Thread nicht pushen oder dir selbst antworten sollst. Tust es doch, wird er als "in Arbeit" gesehen und nicht weiter beachtet, er erscheint dann auch nciht mehr in der Liste der unbeantworteten Themen.

Zitat:
Ich habe alle in einem anderen Post beschrieben Schritte erledigt:
Du kannst nicht auf individuell auf einem Rechner zugeschnitttene Fixes auf deinen übertagen! Warum machst du was?!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 29.08.2011, 22:10   #5
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Da hat jemand einfach was total vages gepostet von wegen "hab bka-trojaner" und die anweisung bekommen, die im übrigen auch paar weitere genau so bekommen haben... was ist daran individuell zugeschnitten?

aber tut mir leid, wenn es falsch war...


Alt 30.08.2011, 10:06   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
--> BKA-Trojaner - Auswertung

Alt 30.08.2011, 12:38   #7
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Ja. Es gibt noch ca. 15 weitere. Aber die sind alle nicht von 2011. Trotzdem posten?

Alt 30.08.2011, 15:24   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Nee lass mal

Führe auch bitte ESET aus, danach sehen wir weiter.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 01.09.2011, 20:59   #9
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



So. Das sagt die log-datei:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7a48f6434ad31d4989117994f2c86a79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 07:57:14
# local_time=2011-09-01 09:57:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT 
# compatibility_mode=512 16777215 100 0 31376586 31376586 0 0
# compatibility_mode=1792 16777195 100 0 119130417 119130417 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 76735078 152425969 0 0
# compatibility_mode=8192 67108863 100 0 152 152 0 0
# scanned=324290
# found=11
# cleaned=0
# scan_time=13793
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\1dd6a40c-617b9dca	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-44b4cfd1	probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\140bd1ef-2391d66f	a variant of Java/Exploit.Agent.NAL trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2fd1f8ec	Java/TrojanDownloader.Agent.NBL trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-20060773	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-4c33b3ea	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-155183ac	Java/Exploit.Agent.NAJ trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-3767c220	Java/Exploit.Agent.NAJ trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\e668b8-3fab79d9	multiple threats (unable to clean)	00000000000000000000000000000000	I
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe	probably a variant of Win32/Agent.MXEKFBP trojan (unable to clean)	00000000000000000000000000000000	I
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2b70da77-27c687e4	multiple threats (unable to clean)	00000000000000000000000000000000	I
         

Alt 01.09.2011, 21:06   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Zitat:
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe
Was für ein Mist ist das denn schon wieder?
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 01.09.2011, 21:59   #11
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Hab ich gerade gelöscht. Aber das ist locker mal 2,5 Jahre alt

Alt 01.09.2011, 22:25   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Was das ist, wird damit aber nicht gerade erklärt
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 02.09.2011, 07:48   #13
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Weiß nicht mehr, was das ist. Aber finde es reichlich seltsam, dass das jetzt als ne Art Malware angezeigt wird
Und was ist mit dem Rest?

Alt 02.09.2011, 10:04   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Zitat:
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

Warum vermüllst du dir das System mit diesen nutzlosen Toolbars?

Am besten alle nutzlosen Toolbars deinstallieren. Dabei helfen können dir Ask Toolbar Remover und Multi Toolbar Remover:

http://www.chip.de/downloads/ASK-Too..._43117721.html
http://www.chip.de/downloads/Multi-T..._43155841.html


Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 02.09.2011, 13:02   #15
hallohallo1
 
BKA-Trojaner - Auswertung - Standard

BKA-Trojaner - Auswertung



Glaube die Toolbars sind noch fast alle da und wurden nich wirklich gelöscht o.O

Aber hab insgesamt locker mal 50 Dinger bei Systemsteuerung -> Programme und Funktionen gelöscht^^
Was nun? Neuer Eset check?

Antwort

Themen zu BKA-Trojaner - Auswertung
adblock, alternate, antivir, bho, browser, conduit, error, excel.exe, firefox, flash player, format, google, google chrome, helper, home, internet, internet explorer, logfile, mozilla, mp3, nodrives, nvlddmkm.sys, problem, security, senden, server, softonic deutsch toolbar, software, start menu, studio, sweetim, symantec, usb, version=1.0, vista, visual studio, windows, wma



Ähnliche Themen: BKA-Trojaner - Auswertung


  1. GVU Trojaner, OTL.txt, OTL Auswertung
    Log-Analyse und Auswertung - 24.02.2013 (2)
  2. GVU Trojaner, OTL.txt, OTL Auswertung
    Plagegeister aller Art und deren Bekämpfung - 25.01.2013 (2)
  3. Trojaner LOG - Auswertung
    Log-Analyse und Auswertung - 03.11.2012 (1)
  4. GVU-Trojaner Logfiles Auswertung
    Log-Analyse und Auswertung - 30.07.2012 (4)
  5. BKA Trojaner,Auswertung von Log OTL
    Log-Analyse und Auswertung - 30.07.2012 (25)
  6. GVU/BKA Trojaner OTL.log zur Auswertung
    Log-Analyse und Auswertung - 04.07.2012 (3)
  7. OTL Auswertung nach Hijackthis Online-Auswertung
    Log-Analyse und Auswertung - 11.11.2011 (3)
  8. BKA Trojaner brauche LOG Auswertung
    Log-Analyse und Auswertung - 29.08.2011 (17)
  9. BKA-Trojaner Log-Auswertung
    Log-Analyse und Auswertung - 19.08.2011 (1)
  10. BKA-Trojaner LOG-AUswertung
    Log-Analyse und Auswertung - 11.08.2011 (11)
  11. BKA Trojaner - Auswertung der Logdatei
    Log-Analyse und Auswertung - 27.07.2011 (1)
  12. Auswertung BKA/Trojaner
    Log-Analyse und Auswertung - 19.06.2011 (8)
  13. BKA-Trojaner otl.txt auswertung
    Log-Analyse und Auswertung - 24.05.2011 (4)
  14. Auswertung Trojaner ?!
    Log-Analyse und Auswertung - 24.08.2008 (3)
  15. Trojaner auswertung gebeten !??
    Log-Analyse und Auswertung - 29.12.2007 (0)
  16. Trojaner? Bitte um auswertung
    Log-Analyse und Auswertung - 28.12.2007 (0)
  17. Log 'Auswertung, Trojaner? Problem
    Log-Analyse und Auswertung - 25.08.2006 (4)

Zum Thema BKA-Trojaner - Auswertung - Hallo liebe Leute. Ich hatte auch vor ein paar Tagen den lästigen BKA-Trojaner. Ich habe mir zunächst provisorisch damit beholfen über den abgesicherten Modus eine Systemwiederherstellung zu machen aber hier - BKA-Trojaner - Auswertung...
Archiv
Du betrachtest: BKA-Trojaner - Auswertung auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.