Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Winlogon.exe stealer.exe was ist das alles

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 25.11.2011, 10:09   #1
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Hallo liebe Gemeinde,
ich habe vor kurzem zufällig eine Meldung auf meinem Rechner gesehen in der stand das 34892stealer.exe nicht mehr funktioniert, nach ewiger Suche hatte ich sie gefunden,prüfen lassen und gelöscht aber in der Prüfung stand nichts negatives.
nun habe ich im Selben Ordner (temp) eine Datei namens 34748winlogon.exe, natürlich wieder Online prüfen lassen aber auch wieder nichts erkannt, Antivir komplett über meinen PC rennen lassen aber findet auch nichts.
Hijackthis meldet aber viele sachen.
Da ich aber keine Ahnung davon habe würde ich euch bitten mal drüber zu schauen und Tipps zu geben denn allein komme ich nicht weiter und neu Aufsetzen will ich auch nicht denn alle Bilder Videos und Musik von meiner Familie sind dann wohl auch infiziert wenn da was ist, so vermute ich zumindest.
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 25.11.2011 11:30:34 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\*****\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,93 Gb Total Physical Memory | 4,13 Gb Available Physical Memory | 69,70% Memory free
11,86 Gb Paging File | 9,98 Gb Available in Paging File | 84,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918,27 Gb Total Space | 404,38 Gb Free Space | 44,04% Space Free | Partition Type: NTFS
Drive D: | 13,14 Gb Total Space | 1,81 Gb Free Space | 13,77% Space Free | Partition Type: NTFS
Drive E: | 465,67 Gb Total Space | 206,79 Gb Free Space | 44,41% Space Free | Partition Type: NTFS
Drive F: | 100,97 Mb Total Space | 72,77 Mb Free Space | 72,07% Space Free | Partition Type: NTFS
Drive G: | 7,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Y: | 465,83 Gb Total Space | 354,08 Gb Free Space | 76,01% Space Free | Partition Type: NTFS
 
Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*****\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Digital Trends Club\Payback-Reporting.exe ()
PRC - C:\Program Files (x86)\Digital Trends Club\Payback-Updater.exe ()
PRC - C:\Program Files (x86)\Bandoo\Bandoo.exe (Bandoo Media Inc.)
PRC - C:\Program Files (x86)\Common Files\Mediafour\iPod\M4iPodWPDService.exe (Mediafour Corporation)
PRC - C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE (Mediafour Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (MSCamSvc) -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Payback-Reporting-Service) -- C:\Program Files (x86)\Digital Trends Club\Payback-Reporting.exe ()
SRV - (Payback-Update-Service) -- C:\Program Files (x86)\Digital Trends Club\Payback-Updater.exe ()
SRV - (Bandoo Coordinator) -- C:\Program Files (x86)\Bandoo\Bandoo.exe (Bandoo Media Inc.)
SRV - (M4iPodWPDService) -- C:\Program Files (x86)\Common Files\Mediafour\iPod\M4iPodWPDService.exe (Mediafour Corporation)
SRV - (OS Selector) -- C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
SRV - (LBTServ) -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (M4LIC) -- C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE (Mediafour Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (KMService) -- C:\Windows\SysWOW64\srvany.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (mobiolavs) -- C:\Windows\SysNative\drivers\mobiolavs.sys (SHAPE Services GmbH)
DRV:64bit: - (MOBIOLA_Wave) Mobiola Wave Audio Device (WDM) -- C:\Windows\SysNative\drivers\mobiolawave.sys (SHAPE Services)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (CLNUIDriver) -- C:\Windows\SysNative\drivers\CLNUIDriver.sys (Code Laboratories, Inc.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (CbFs) -- C:\Windows\SysNative\drivers\cbfs.sys (EldoS Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (VX3000) -- C:\Windows\SysNative\drivers\VX3000.sys (Microsoft Corporation)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (DFUBTUSB) -- C:\Windows\SysNative\drivers\frmupgr.sys (Broadcom Corporation.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (MDFSYSNT) -- C:\Windows\SysNative\drivers\MDFSYSNT.SYS (Mediafour Corporation)
DRV:64bit: - (vncmirror) -- C:\Windows\SysNative\drivers\vncmirror.sys (RealVNC Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (KMWDFILTER) -- C:\Windows\SysNative\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (ElbyCDFL) -- C:\Windows\SysNative\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ElbyCDFL) -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys (SlySoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://startsear.ch/?aff=1&src=sp&cf=8fa34532-0237-11e1-8054-cf6766fd19f9&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q="
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.defaultengine: "Web Search"
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: [INSTALLDIR]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files (x86)\Google\Google Gears\Firefox\ [2010.08.02 19:07:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: C:\Program Files (x86)\Digital Trends Club\ [2011.11.25 11:23:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.08 18:37:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.29 15:09:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_7.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.10 19:45:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firefox@bandoo.com: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles/67b3q80q.default\extensions\firefox@bandoo.com [2011.02.13 11:50:55 | 000,000,000 | ---D | M]
 
[2010.03.31 14:22:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2011.07.28 11:02:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions
[2010.03.31 22:17:13 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011.06.12 13:23:54 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.09 20:00:41 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.06.09 09:18:44 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.03.31 22:17:13 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.02.13 11:50:55 | 000,000,000 | ---D | M] (Bandoo for Firefox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\firefox@bandoo.com
[2011.11.24 20:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions
[2010.04.27 22:14:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.09.06 08:48:23 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010.03.31 22:40:20 | 000,000,000 | ---D | M] (IE Tab) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011.10.14 12:24:33 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.03.31 22:40:18 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2011.08.09 13:12:55 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\DeviceDetection@logitech.com
[2010.03.31 22:40:21 | 000,000,000 | ---D | M] (Noia 2.0 eXtreme OPT) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\noia2_option@kk.noia
[2011.03.13 08:36:22 | 000,000,000 | ---D | M] (Personas) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\personas@christopher.beard
[2011.10.27 19:25:34 | 000,000,000 | ---D | M] (Reload Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\reloadplus@blackwind
[2011.06.12 13:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011.06.12 13:23:55 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.09 20:00:41 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Noia 2.0 eXtreme OPT) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\noia2_option@kk.noia
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Personas) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\personas@christopher.beard
[2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FastestFox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\smarterwiki@wikiatic.com
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\icqplugin.xml
[2010.08.12 12:12:24 | 000,005,529 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\SearchquWebSearch.xml
[2011.07.11 19:04:02 | 000,000,633 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\startsear.xml
[2011.11.08 18:37:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011.10.24 09:13:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2010.08.02 19:07:00 | 000,000,000 | ---D | M] (Google Gears) -- C:\PROGRAM FILES (X86)\GOOGLE\GOOGLE GEARS\FIREFOX
File not found (No name found) -- C:\PROGRAM FILES (X86)\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC
[2011.11.08 18:37:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2007.12.17 18:16:14 | 000,065,536 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npkimi.dll
[2011.10.03 10:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2011.10.01 07:19:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.01 07:19:12 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.10.01 07:19:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.07.28 11:02:44 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011.10.01 07:19:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.08.12 12:12:24 | 000,005,529 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchquWebSearch.xml
[2011.10.01 07:19:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.01 07:19:12 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Web Search (Enabled)
CHR - default_search_provider: search_url = hxxp://startsear.ch/?aff=1&src=sp&cf=8fa34532-0237-11e1-8054-cf6766fd19f9&q={searchTerms}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Users\*****\AppData\Roaming\Mozilla\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\pdf.dll
CHR - plugin: Gacela Plugin (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.1.3037_1\plugin/npgacela.dll
CHR - plugin: Imikimi.com Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npkimi.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Donna Karan = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\fijgnliiiplghalknhobbcngpcngaoji\3_0\
CHR - Extension: AdBlock = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.4.29_0\
CHR - Extension: Page Refresh = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmooaemjmediafeacjplpbpenjnpcneg\1.0.5_0\
CHR - Extension: Payback Digital Trends Club = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.1.3067_0\
CHR - Extension: vshare plugin = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\
 
O1 HOSTS File: ([2011.10.14 21:11:28 | 000,000,918 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.acronis.de.
O1 - Hosts: 127.0.0.1 secure.tune-up.com   
O2:64bit: - BHO: (Reg Error: Value error.) - {4907C0AD-874D-44D9-B13E-7B0A4D8B9D3E} - C:\Programme\Mediafour\XPlay 3\XPBHO.DLL (Mediafour Corporation)
O2:64bit: - BHO: (Digital Trends Club) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (nurago GmbH)
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Digital Trends Club) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (nurago GmbH)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (BandooIEPlugin Class) - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Program Files (x86)\Bandoo\Plugins\IE\ieplugin.dll (Bandoo Media Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files (x86)\YRefresher\YRefresher.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files (x86)\YRefresher\YRefresher.dll ()
O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [HKCU] C:\Users\*****\AppData\Roaming\Java\Java.exe (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Ãœber Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (nurago GmbH)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Über Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (nurago GmbH)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20110606050927 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6241356A-2B31-4D51-B2C6-EE02547F87C1}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\bandoo\bndhook.dll) -c:\Program Files (x86)\Bandoo\BndHook.dll (Discordia Limited)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{12c927ef-aaed-11df-9459-406186961122}\Shell - "" = AutoRun
O33 - MountPoints2\{12c927ef-aaed-11df-9459-406186961122}\Shell\AutoRun\command - "" = L:\iStudio.exe
O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell - "" = AutoRun
O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell\AutoRun\command - "" = M:\SETUP.EXE
O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell\dinstall\command - "" = M:\DirectX\dxsetup.exe
O33 - MountPoints2\{9feb5d87-dd3a-11df-a4de-406186961122}\Shell - "" = AutoRun
O33 - MountPoints2\{9feb5d87-dd3a-11df-a4de-406186961122}\Shell\AutoRun\command - "" = H:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.25 10:46:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft HiJackFree
[2011.11.25 10:46:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft HiJackFree
[2011.11.25 10:13:50 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\E000019F5AC9EFB0_MountPt
[2011.11.24 20:27:10 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{7DF87030-9AFB-4919-A6A7-FA2F64AE3EA4}
[2011.11.24 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{7A5B1994-C0BE-43F8-8F4D-C84F1678CD60}
[2011.11.24 14:48:35 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Xbox 360 Hash Block Calculator
[2011.11.24 14:48:35 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\CON-Uncorrupter
[2011.11.24 14:05:39 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\DaysOfThunder XBLA - Non JTAG
[2011.11.23 10:18:09 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{48B30CBD-051F-474E-9947-9989752B80C5}
[2011.11.23 10:17:58 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{35E71655-CAFB-488F-A056-4D59A0230827}
[2011.11.21 13:41:47 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{EE93B1D3-6645-487F-A155-57E9010D6CBA}
[2011.11.21 13:41:36 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{F1B2DD0E-75A4-455F-A132-277E96EAF0E0}
[2011.11.20 11:56:19 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{82EC050F-6D29-4D73-A29D-66C2D9B95C67}
[2011.11.20 11:55:54 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{F6BC02C0-DE0D-4ABF-A66D-1151FA9D2390}
[2011.11.19 12:01:32 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A5836E48-7BD4-41F9-B3B9-8C60EA52549F}
[2011.11.19 12:01:21 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{FA6A59B2-732C-49D0-A4F7-9821291967EB}
[2011.11.19 00:00:57 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{483F9527-7294-4D3C-ABDD-8542C23F81AF}
[2011.11.19 00:00:46 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{CA39CD1B-D409-47D0-BEB1-5E566346E982}
[2011.11.18 12:00:33 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{2922FA3D-0634-43DF-9138-FC929F3AEF48}
[2011.11.18 12:00:09 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{0CA9EDF5-4388-4610-AED1-020F14AA6FC4}
[2011.11.17 15:27:02 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E7AD2F8D-2512-4BF4-85DA-60BD136D4B7C}
[2011.11.17 15:26:51 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A499F695-BB4A-4763-8E74-18992D7E4450}
[2011.11.16 15:30:18 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{EB8B8600-7500-46E8-9B49-3D9D42CE275E}
[2011.11.16 15:30:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{CFE809EE-8772-4F21-BFE5-E2D7730D9A03}
[2011.11.16 09:20:46 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011.11.15 17:21:51 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{5FD551FE-4C93-4D26-A74D-22E3C7D04E3B}
[2011.11.15 17:21:25 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{B83214DD-84CF-4846-89F7-B68E44C33F3A}
[2011.11.10 19:44:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Connectivity Solution
[2011.11.10 19:34:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EroNavi
[2011.11.10 19:34:00 | 000,000,000 | ---D | C] -- C:\ProgramData\EroNavi
[2011.11.10 19:34:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EroNavi
[2011.11.10 16:04:47 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Content
[2011.11.07 11:31:05 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{D7C55F2A-7465-42AC-94AF-54CBD365302A}
[2011.11.07 11:30:40 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{215FAAAB-0265-43F2-9BE5-02EC76E25A57}
[2011.11.06 21:13:08 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\ODUI
[2011.11.06 21:13:01 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Stardock
[2011.11.06 21:12:59 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\Stardock
[2011.11.06 21:12:59 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Stardock
[2011.11.06 21:12:47 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\PackageAware
[2011.11.06 20:42:19 | 000,034,624 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe
[2011.11.06 20:42:19 | 000,025,920 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll
[2011.11.06 20:42:19 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2011.11.06 20:42:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012
[2011.11.06 20:42:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2012
[2011.11.06 20:40:39 | 026,148,728 | ---- | C] (TuneUp Software) -- C:\Users\*****\AppData\Roaming\TuneUpUtilities2012_2030.5-DE.exe
[2011.11.06 20:40:39 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Java
[2011.11.06 20:40:38 | 000,040,960 | ---- | C] (Microsoft) -- C:\Users\*****\AppData\Roaming\Java.exe
[2011.11.06 08:57:27 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{8EBCB85A-7674-4A55-A569-1E836D28048A}
[2011.11.06 08:57:03 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{C85BCF8B-1DC7-4F54-B21A-D3AAB9BD2545}
[2011.11.04 11:33:14 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E9753DF3-8850-4975-B735-1D46FB779BB4}
[2011.11.04 11:33:03 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{94793514-D774-40C2-84F6-7EE662195523}
[2011.11.03 22:44:32 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\TrueCrypt
[2011.11.03 22:44:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
[2011.11.03 22:44:15 | 000,230,864 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.11.03 22:44:13 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt
[2011.11.03 11:47:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A3E9553B-7C63-4293-87EF-F401FD7D22A1}
[2011.11.03 11:46:57 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{60CE36AB-522F-4AFC-A816-94D0BB1AB521}
[2011.11.02 23:46:31 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{8EC3181F-EDCF-4C94-9CEB-D667506B3889}
[2011.11.02 23:46:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{29D59D44-A31D-4CCD-8CF9-88388218531A}
[2011.11.02 21:13:56 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\gtk-2.0
[2011.11.02 20:24:24 | 000,000,000 | ---D | C] -- C:\Users\*****\.thumbnails
[2011.11.02 20:22:58 | 000,000,000 | ---D | C] -- C:\Users\*****\.gimp-2.6
[2011.11.02 09:10:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\NVIDIA
[2011.11.01 10:15:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{5E6B09E4-2224-4326-B445-0E18F42CACAF}
[2011.11.01 10:14:42 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{17996A8A-A11A-46F3-9533-4363F18CB874}
[2011.10.31 09:15:12 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{030BA732-4F81-4E1A-8845-B13F84BF8C27}
[2011.10.31 09:15:01 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{0D9907B1-269E-4580-968A-3C37637FAD11}
[2011.10.30 09:45:30 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{05A7D7A8-CE77-4874-A749-8EEF7759766C}
[2011.10.30 09:45:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{56EF9223-4CCB-4052-83D0-1FCFBC497FA6}
[2011.10.29 15:09:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vShare.tv plugin
[2011.10.28 13:33:56 | 000,000,000 | ---D | C] -- C:\Windows\AutoKMS
[2011.10.26 12:56:13 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E7F466A0-71AC-4186-88DB-BBFD082D9DED}
[2011.10.26 12:56:02 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{AFB757D0-0779-476C-B2F7-0321C172D826}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ]
[1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.25 11:30:49 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.25 11:30:49 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.25 11:27:51 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.11.25 11:27:51 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.25 11:27:51 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.11.25 11:27:51 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.25 11:27:51 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.11.25 11:23:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.25 11:23:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.25 11:22:24 | 000,000,020 | ---- | M] () -- C:\Users\*****\defogger_reenable
[2011.11.25 11:02:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.25 10:46:22 | 000,000,984 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft HiJackFree.lnk
[2011.11.25 10:14:20 | 032,034,816 | ---- | M] () -- C:\Users\*****\E000019F5AC9EFB0
[2011.11.25 10:13:50 | 031,981,568 | ---- | M] () -- C:\Users\*****\Desktop\E000019F5AC9EFB0
[2011.11.24 20:41:09 | 004,446,151 | ---- | M] () -- C:\Users\*****\Desktop\K 165.jpg
[2011.11.24 20:39:27 | 000,107,098 | ---- | M] () -- C:\Users\*****\Desktop\Hello-Kitty-Wallpaper-hello-kitty-8257470-1024-768.jpg
[2011.11.24 20:38:37 | 097,409,343 | ---- | M] () -- C:\Users\*****\Desktop\K 165.psd
[2011.11.24 11:26:52 | 000,013,598 | ---- | M] () -- C:\Users\*****\Desktop\1321960655288966372.jpg
[2011.11.22 11:44:41 | 000,021,138 | ---- | M] () -- C:\Users\*****\Desktop\1321958348249268541.jpg
[2011.11.22 11:43:52 | 000,053,266 | ---- | M] () -- C:\Users\*****\Desktop\1321958367076497904.jpg
[2011.11.20 20:18:50 | 013,621,249 | ---- | M] () -- C:\Users\*****\Desktop\cam.pdf
[2011.11.16 09:20:47 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.11.14 14:53:46 | 000,000,132 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.11.10 09:14:45 | 005,013,328 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.11.09 12:33:23 | 000,000,132 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011.11.07 10:22:12 | 000,001,758 | ---- | M] () -- C:\Users\*****\Desktop\Downloads.lnk
[2011.11.07 10:22:00 | 000,001,900 | ---- | M] () -- C:\Users\*****\Desktop\Wizard.lnk
[2011.11.07 10:16:50 | 000,001,077 | ---- | M] () -- C:\Users\*****\Desktop\Musik.lnk
[2011.11.07 10:16:47 | 000,001,094 | ---- | M] () -- C:\Users\*****\Desktop\Bilder.lnk
[2011.11.07 10:16:42 | 000,001,105 | ---- | M] () -- C:\Users\*****\Desktop\Dokumente.lnk
[2011.11.06 20:40:39 | 026,148,728 | ---- | M] (TuneUp Software) -- C:\Users\*****\AppData\Roaming\TuneUpUtilities2012_2030.5-DE.exe
[2011.11.06 20:40:38 | 000,040,960 | ---- | M] (Microsoft) -- C:\Users\*****\AppData\Roaming\Java.exe
[2011.11.03 22:44:15 | 000,230,864 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.11.02 21:13:56 | 000,002,102 | ---- | M] () -- C:\Users\*****\.recently-used.xbel
[2011.10.31 10:43:56 | 000,000,544 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ]
[1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.11.25 11:22:24 | 000,000,020 | ---- | C] () -- C:\Users\*****\defogger_reenable
[2011.11.25 10:46:22 | 000,000,984 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft HiJackFree.lnk
[2011.11.25 10:14:20 | 032,034,816 | ---- | C] () -- C:\Users\*****\E000019F5AC9EFB0
[2011.11.25 10:00:55 | 031,981,568 | ---- | C] () -- C:\Users\*****\Desktop\E000019F5AC9EFB0
[2011.11.24 20:41:04 | 004,446,151 | ---- | C] () -- C:\Users\*****\Desktop\K 165.jpg
[2011.11.24 20:39:26 | 000,107,098 | ---- | C] () -- C:\Users\*****\Desktop\Hello-Kitty-Wallpaper-hello-kitty-8257470-1024-768.jpg
[2011.11.24 20:38:33 | 097,409,343 | ---- | C] () -- C:\Users\*****\Desktop\K 165.psd
[2011.11.22 12:20:42 | 000,013,598 | ---- | C] () -- C:\Users\*****\Desktop\1321960655288966372.jpg
[2011.11.22 11:44:18 | 000,021,138 | ---- | C] () -- C:\Users\*****\Desktop\1321958348249268541.jpg
[2011.11.22 11:43:51 | 000,053,266 | ---- | C] () -- C:\Users\*****\Desktop\1321958367076497904.jpg
[2011.11.20 20:18:47 | 013,621,249 | ---- | C] () -- C:\Users\*****\Desktop\cam.pdf
[2011.11.09 12:33:23 | 000,000,132 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011.11.07 10:18:30 | 000,001,758 | ---- | C] () -- C:\Users\*****\Desktop\Downloads.lnk
[2011.11.07 10:18:06 | 000,001,900 | ---- | C] () -- C:\Users\*****\Desktop\Wizard.lnk
[2011.11.07 10:16:50 | 000,001,077 | ---- | C] () -- C:\Users\*****\Desktop\Musik.lnk
[2011.11.07 10:16:47 | 000,001,094 | ---- | C] () -- C:\Users\*****\Desktop\Bilder.lnk
[2011.11.07 10:16:42 | 000,001,105 | ---- | C] () -- C:\Users\*****\Desktop\Dokumente.lnk
[2011.11.06 20:42:17 | 000,002,167 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2011.11.02 21:13:56 | 000,002,102 | ---- | C] () -- C:\Users\*****\.recently-used.xbel
[2011.10.14 23:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.07.26 16:26:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.05.23 21:11:12 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011.01.30 20:38:24 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2011.01.30 20:38:24 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2010.12.06 14:58:56 | 002,496,715 | ---- | C] () -- C:\Windows\SysWow64\abgx360.exe
[2010.12.04 00:05:28 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\portio64.sys
[2010.12.04 00:05:10 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\portio64.sys
[2010.11.16 14:50:11 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2010.09.29 08:57:34 | 000,000,132 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.09.27 14:30:57 | 000,000,600 | ---- | C] () -- C:\Users\*****\AppData\Roaming\winscp.rnd
[2010.08.13 16:18:54 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2010.08.13 16:18:54 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2010.08.13 16:18:54 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2010.08.13 16:18:54 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2010.08.13 16:18:54 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2010.08.13 16:18:54 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2010.08.13 16:18:54 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2010.08.13 16:18:54 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2010.08.13 16:18:54 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2010.08.13 16:18:54 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2010.08.13 16:18:54 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2010.08.13 16:18:54 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2010.08.13 16:18:54 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2010.08.13 16:18:54 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2010.08.13 16:18:54 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2010.08.13 16:18:54 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2010.08.13 16:18:54 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2010.08.13 16:18:54 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2010.08.13 16:18:54 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2010.04.23 23:23:39 | 000,034,308 | ---- | C] () -- C:\ProgramData\mazuki.dll
[2010.04.09 18:02:33 | 000,000,546 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat
[2010.04.07 18:19:58 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.03.31 23:07:53 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.03.31 23:07:52 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.03.31 23:07:52 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.03.31 23:07:50 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.02.02 16:13:22 | 000,009,868 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2009.09.29 15:25:16 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.26 17:24:18 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2002.10.15 23:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2001.08.29 14:11:40 | 000,398,848 | R--- | C] () -- C:\Windows\SysWow64\DK2WIN32.DLL
 
========== Files - Unicode (All) ==========
[2011.06.06 10:48:42 | 000,000,000 | ---D | M](C:\Users\*****\Documents\DonChulio21???) -- C:\Users\*****\Documents\DonChulio21的证书
[2009.07.21 08:01:45 | 000,000,000 | ---D | C](C:\Users\*****\Documents\DonChulio21???) -- C:\Users\*****\Documents\DonChulio21的证书
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 164 bytes -> C:\ProgramData\Temp:264B2CC4
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:B6AC352B

< End of report >
         
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 25.11.2011 11:30:34 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\*****\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,93 Gb Total Physical Memory | 4,13 Gb Available Physical Memory | 69,70% Memory free
11,86 Gb Paging File | 9,98 Gb Available in Paging File | 84,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918,27 Gb Total Space | 404,38 Gb Free Space | 44,04% Space Free | Partition Type: NTFS
Drive D: | 13,14 Gb Total Space | 1,81 Gb Free Space | 13,77% Space Free | Partition Type: NTFS
Drive E: | 465,67 Gb Total Space | 206,79 Gb Free Space | 44,41% Space Free | Partition Type: NTFS
Drive F: | 100,97 Mb Total Space | 72,77 Mb Free Space | 72,07% Space Free | Partition Type: NTFS
Drive G: | 7,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Y: | 465,83 Gb Total Space | 354,08 Gb Free Space | 76,01% Space Free | Partition Type: NTFS
 
Computer Name: *****-PC | User Name: *****| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1934BCF7-A63A-4C1F-809D-2B33C8F03B8F}" = O&O PartitionManager Professional
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = Media Player Classic - Home Cinema v1.3.2494.0 x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5621D339-24C0-492F-ACDD-C7B478EC15BD}" = XPlay 3
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6140C8C0-05CB-427B-9D45-7445CE833FC1}" = WBFS Manager 2.2.2
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{6965A8D2-465D-4F98-9FAA-0E9E2348F329}" = Microsoft LifeCam
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F83779DF-E1F5-43A2-A7BE-732F856FADB7}" = Microsoft SQL Server Compact 3.5 SP1 x64 English
"320E5A650E531D358621D0E81B35A922E0F32E16" = Windows-Treiberpaket - Sony Ericsson Mobile Communications (ggsemc) USB  (04/01/2009 2.2.0.5)
"A195FB90FAD326D6887486405817715BDBC9DA48" = Windows-Treiberpaket - PrimeSense (psdrv3) PrimeSensor  (07/13/2010 3.1.0.4)
"AD7AB2629F8514508E17FEDAF4E26A36107ECC2D" = Windows-Treiberpaket - PrimeSense (psdrv3) PrimeSense  (02/16/2011 3.1.2.0)
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"PC-Doctor for Windows" = Hardwarediagnosetools
"SP6" = Logitech SetPoint 6.15
"Unlocker" = Unlocker 1.9.1-x64
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002FA4C4-DDFE-4E83-A5E0-E2A18B965468}" = Phoenix Service Software
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{06E34C00-0446-4176-81C8-A5DAFE53CA36}" = Acronis*Disk*Director*11*Home
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1EABDDCB-B788-4FD2-BA76-23472D8DD1D6}" = EPSON Easy Photo Print
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{3096C412-7636-45FD-9074-F596F4417076}" = AKVIS Retoucher
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater
"{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}" = PC Connectivity Solution
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F0545E7-3F0F-4730-AF70-26E61DBDF263}" = Digital Trends Club
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D65264D-49E2-4990-9159-4070604BDEA0}" = Playlist tool
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{741CFE3A-1C0B-4A7D-8E08-5D78C911C09D}" = HP Support Assistant
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8969CD6F-5B75-40B9-8701-86ECA4C1F263}_is1" = VSO Image Resizer 4.0.1.5
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90A6D70C-BD95-4AE1-9E8D-45399989D30B}_is1" = Dukto R4
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92DA4424-0CFB-44D1-A08B-B63D5D8BEFBC}_is1" = Phoenix Service Software 2010.8.4.41526
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF88496B-4BBA-4922-97E9-2582D3A28358}" = Nokia Connectivity Cable Driver
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB24A9E5-A068-43DD-88D0-B51BED3C0B99}" = Nokia Suite
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EA4E18F0-E334-41F8-9AB6-7C2E2D1F8CF2}" = Trendyflash Intro Builder
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Activision(R)
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"1489-3350-5074-6281" = JDownloader 0.9
"7-Zip" = 7-Zip 4.65
"abgx360" = abgx360 v1.0.5
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"aEton CommunicaEor" = aEton CommunicaEor
"Angry Birds Rio" = Angry Birds Rio
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bandoo" = Bandoo
"CD Audio Reader Filter" = CD Audio Reader Filter (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CloneCD" = CloneCD
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DCoder Image Source" = DCoder Image Source (remove only)
"DivX Setup.divx.com" = DivX-Setup
"Drum Machine" = Drum Machine 1.36 BETA
"Emsisoft HiJackFree_is1" = Emsisoft HiJackFree 4.5
"EPSON Scanner" = EPSON Scan
"EroNavi_is1" = EroNavi 1.046
"ffdshow_is1" = ffdshow [rev 3124] [2009-11-03]
"FFMPEG Core Files" = FFMPEG Core Files (remove only)
"Filters Unlimited_is1" = Filters Unlimited 2.0.3
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.5
"Gabest MPEG Splitter" = Gabest MPEG Splitter (remove only)
"Gordon's Gate Flash Driver" = Gordon's Gate Flash Driver 1.1.0.12
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"HaaliMkx" = Haali Media Splitter
"HDClone.Professional.3.9.4.1033" = HDClone 3.9 Professional Edition
"HP Remote Solution" = HP Remote Solution
"ImgBurn" = ImgBurn
"Imikimi Plugin" = Imikimi Plugin
"Incomedia WebSite X5 v8 - Evolution" = Incomedia WebSite X5 v8 - Evolution
"InstallShield_{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Drum Controller Standard Tuning Kit
"JAFSetup" = JAF Setup
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.6.6 (Full) BETA
"Live Usb Helper" = Live Usb Helper 0.0.8
"MONOGRAM AMR Splitter/Decoder" = MONOGRAM AMR Splitter/Decoder (remove only)
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Mp3tag" = Mp3tag v2.48
"Noki_is1" = Noki v2.1
"Nokia Suite" = Nokia Suite
"NSS" = NSS (remove only)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenNI 1.0.0 for Windows" = OpenNI 1.0.0 for Windows (remove only)
"OpenSource AVI Splitter" = OpenSource AVI Splitter (remove only)
"OpenSource DTS/AC3/DD+ Source Filter" = OpenSource DTS/AC3/DD+ Source Filter (remove only)
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only)
"Opera 11.52.1100" = Opera 11.52
"Phoenix Service Software 2010.08.004.41526_is1" = Phoenix Service Software 2010.08.004.41526
"Qt SDK 2010.05 - C:_Qt_2010.05" = Qt SDK 2010.05
"QuickPar" = QuickPar 0.9
"RATattack" = RATattack 0.2
"ratDVD" = ratDVD 0.78.1444
"RealMedia" = RealMedia (remove only)
"SHOUTcast Source" = SHOUTcast Source (remove only)
"SSC Service Utility_is1" = SSC Service Utility v4.30
"SystemRequirementsLab" = System Requirements Lab
"TrueCrypt" = TrueCrypt
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Uninstall_is1" = Uninstall 1.0.0.1
"UseNeXT_is1" = UseNeXT
"VLC media player" = VLC media player 1.1.11
"vShare.tv plugin" = vShare.tv plugin 1.3
"WBFS Manager 3.0" = WBFS Manager 3.0
"WinLiveSuite" = Windows Live Essentials
"XMedia Recode" = XMedia Recode 3.0.3.4
"YRefresher_is1" = Yrefresher 1.00
"ZoomPlayer" = Zoom Player (remove only)
"ZoomPlayerLang" = Zoom Player deutsche Sprachdateien (entfernen)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"360WAVESPATCHERCLT" = 360WavesPatcher (Client setup)
"Google Chrome" = Google Chrome
"WinSetupFromUSB" = WinSetupFromUSB
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         
--- --- ---

Geändert von DonChulio (25.11.2011 um 10:47 Uhr)

Alt 25.11.2011, 10:28   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Bitte beachten => http://www.trojaner-board.de/95173-b...es-posten.html und http://www.trojaner-board.de/69886-a...-beachten.html
__________________

__________________

Alt 25.11.2011, 11:24   #3
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Tut mir leid ich habe es gerade korrigiert und zudem muss ich noch sagen das ich einen PC mit Windows 7 Home Premium 64bit habe.
__________________

Alt 25.11.2011, 11:59   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 25.11.2011, 19:07   #5
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c177b7e56d295e43a7c4bbbdf8f2f786
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-25 07:02:08
# local_time=2011-11-25 08:02:08 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 3383790 3383790 0 0
# compatibility_mode=5893 16776574 100 94 17170712 73848887 0 0
# compatibility_mode=8192 67108863 100 0 3674 3674 0 0
# scanned=968644
# found=14
# cleaned=0
# scan_time=28691
C:\Program Files (x86)\Bandoo\Bandoo.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\BandooGo.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\BandooUI.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\BndCore.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\ExtensionsManager.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\InstallerHelper.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\Plugins\IE\ieplugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\Plugins\MSN\msnplugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files (x86)\Bandoo\Plugins\Yahoo\YahooPlugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS2.tmp HTML/ScrInject.B.Gen virus (unable to clean) 00000000000000000000000000000000 I
C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS3.tmp JS/TrojanClicker.Agent.NCQ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS5.tmp HTML/ScrInject.B.Gen virus (unable to clean) 00000000000000000000000000000000 I
C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\extensions\firefox@bandoo.com\components\FFPlugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I
${Memory} a variant of Win32/Remtasu.R trojan 00000000000000000000000000000000 I


Alt 26.11.2011, 12:37   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Was ist mit dem Vollscan Malwarebytes?
__________________
--> Winlogon.exe stealer.exe was ist das alles

Alt 26.11.2011, 12:52   #7
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



läuft seit 4std und 34 min

Alt 26.11.2011, 17:13   #8
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Über 8,5 STD wahnsinn


Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8245

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

26.11.2011 18:08:51
mbam-log-2011-11-26 (18-08-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|Y:\|)
Durchsuchte Objekte: 1141372
Laufzeit: 8 Stunde(n), 36 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Agent) -> Value: HKCU -> No action taken.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (Search) Good: (Google) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (Search) Good: (Google) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\*****\AppData\Roaming\Java\Java.exe (Backdoor.Agent) -> No action taken.
c:\Users\*****\AppData\Roaming\Java.exe (Backdoor.Agent) -> No action taken.
c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).cfg (Malware.Trace) -> No action taken.
c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).dat (Malware.Trace) -> No action taken.

Alt 27.11.2011, 00:11   #9
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Zitat:
-> No action taken.
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 27.11.2011, 08:38   #10
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Schon geschehen

Alt 27.11.2011, 10:55   #11
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Log dazu bitte posten
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 28.11.2011, 09:23   #12
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



HAb jetzt mehrfach im fullscan rennen lassen und im quickscan und jedesmal tauchen die selben ergebnisse auf! Bekomme sie nicht weg!

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8255

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

28.11.2011 10:21:10
mbam-log-2011-11-28 (10-21-07).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 189796
Laufzeit: 3 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Agent) -> Value: HKCU -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\*****\AppData\Roaming\Java\Java.exe (Backdoor.Agent) -> No action taken.
c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).cfg (Malware.Trace) -> No action taken.
c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).dat (Malware.Trace) -> No action taken.

Alt 28.11.2011, 12:41   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 28.11.2011, 14:09   #14
DonChulio
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



otl hängt jetzt seit ca 12minuten an dem Punkt ohne das was geschieht %systemroot%\system32\*.dll /lockedfiles

Ging doch weiter
im Anhang die datei

Geändert von DonChulio (28.11.2011 um 14:52 Uhr)

Alt 28.11.2011, 15:06   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Winlogon.exe stealer.exe was ist das alles - Standard

Winlogon.exe stealer.exe was ist das alles



Dann lass diese Zeile mal weg:

%systemroot%\system32\*.dll /lockedfiles
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu Winlogon.exe stealer.exe was ist das alles
2.0.7, 64-bit, 7-zip, adblock, adobe, alternate, antivir, avg, avira, bandoo, bho, bonjour, browser, c:\windows\system32\rundll32.exe, converter, desktop, document, emsisoft, explorer, firefox, google, google chrome, google earth, install.exe, internet, internet explorer, jdownloader, locker, microsoft office word, mozilla, mp3, musik, neu aufsetzen, nvidia, nvidia update, opera, picasa, prüfen, refresh, sched.exe, senden, shell32.dll, shortcut, software, temp, usenext, webcheck, windows, winlogon.exe



Ähnliche Themen: Winlogon.exe stealer.exe was ist das alles


  1. FileZilla Stealer?
    Plagegeister aller Art und deren Bekämpfung - 17.11.2014 (14)
  2. Trojaner oder Stealer
    Log-Analyse und Auswertung - 06.05.2013 (7)
  3. GVU Trojaner und FTP Stealer
    Log-Analyse und Auswertung - 07.12.2012 (21)
  4. Passwörter werden ohne Kenntnis geändert/Verdacht auf RAT oder Stealer
    Log-Analyse und Auswertung - 21.05.2012 (5)
  5. Stealer.exe - System jetzt in Ordnung?
    Plagegeister aller Art und deren Bekämpfung - 10.10.2011 (32)
  6. gecrypteten Stealer eingefangen - Passwörter nun kompromittiert?
    Plagegeister aller Art und deren Bekämpfung - 22.07.2011 (1)
  7. Trojaner... Dropper, Agent, Password-Stealer etc!
    Plagegeister aller Art und deren Bekämpfung - 18.07.2010 (1)
  8. Trjoaner/Stealer Verdacht
    Log-Analyse und Auswertung - 16.12.2009 (5)
  9. Hackhound Stealer?
    Plagegeister aller Art und deren Bekämpfung - 14.10.2009 (9)
  10. C:\Stealer.exe
    Plagegeister aller Art und deren Bekämpfung - 25.08.2009 (15)
  11. Ich teste Dateien auf Stealer/Trojaner und entferne Logs im Falle einer Infizierung
    Plagegeister aller Art und deren Bekämpfung - 10.12.2008 (7)
  12. Password Stealer ??
    Mülltonne - 23.11.2008 (0)
  13. Verdacht auf Stealer (Bitte Log auswerten)
    Log-Analyse und Auswertung - 27.06.2008 (0)
  14. Auswertung nach steam stealer/backdoor ty
    Log-Analyse und Auswertung - 06.06.2008 (6)
  15. Stealer analysieren
    Plagegeister aller Art und deren Bekämpfung - 24.05.2008 (1)
  16. Pw stealer
    Mülltonne - 04.05.2008 (1)
  17. Riesen Problem mit nem Passwort stealer
    Plagegeister aller Art und deren Bekämpfung - 23.01.2007 (14)

Zum Thema Winlogon.exe stealer.exe was ist das alles - Hallo liebe Gemeinde, ich habe vor kurzem zufällig eine Meldung auf meinem Rechner gesehen in der stand das 34892stealer.exe nicht mehr funktioniert, nach ewiger Suche hatte ich sie gefunden,prüfen lassen - Winlogon.exe stealer.exe was ist das alles...
Archiv
Du betrachtest: Winlogon.exe stealer.exe was ist das alles auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.