| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System musste blockiert werden. 50€ Trjoaner/VirusWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.01.2012, 13:58
| #1 |
| |  System musste blockiert werden. 50€ Trjoaner/Virus Hallo meine lieben Helfer  ,so nun habe ich mir OTL runtergeladen und nun hier die OTL. txt datei Code:
ATTFilter OTL logfile created on: 10.01.2012 13:32:17 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dani\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19170) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free 5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe PRC - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () -- C:\Program Files\Guard-ICQ\GuardICQ.exe PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.12.14 12:23:34 | 001,212,224 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesApp32.exe PRC - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesService32.exe PRC - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe PRC - [2008.08.20 11:35:20 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe ========== Modules (No Company Name) ========== MOD - [2006.09.14 08:20:24 | 000,126,464 | ---- | M] () -- C:\Program Files\WinRAR 3.61 Multi\rarext.dll ========== Win32 Services (SafeList) ========== SRV - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () [Auto | Running] -- C:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru) SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Running] -- D:\Tuneup\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp) SRV - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.12.12 19:31:38 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- D:\Tuneup\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2010.06.23 09:21:32 | 000,259,176 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.01.13 09:45:00 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008.08.23 02:28:32 | 000,333,824 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187Se.sys -- (RTL8187Se) DRV - [2008.08.07 10:01:44 | 000,097,536 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR) DRV - [2008.07.19 20:53:00 | 007,545,824 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008.06.10 01:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32) DRV - [2008.04.01 14:42:36 | 000,014,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) DRV - [2008.02.29 23:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2007.03.19 16:00:14 | 000,031,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RLVrtAuCbl.sys -- (ReallusionVirtualAudio) DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net [2011.12.27 14:48:26 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de [2011.12.27 14:48:35 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M] [2011.12.21 17:00:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Extensions [2012.01.05 18:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions [2012.01.05 16:36:15 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.12.27 14:48:26 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net [2011.12.27 14:48:35 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de [2012.01.03 18:58:45 | 000,001,048 | ---- | M] () -- C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\searchplugins\icqplugin.xml () (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{1FC895A6-2042-46EC-A61B-233165B4C218}.XPI () (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files\Guard-ICQ\GuardICQ.exe () O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International CO., LTD.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org) O4 - HKCU..\Run: [EPSON SX218 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIGDE.EXE (SEIKO EPSON CORPORATION) O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69392199-458C-42AD-B6BC-728C723712B3}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F682A9C3-252C-4710-8AFB-98221359DD31}: DhcpNameServer = 192.168.178.1 O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.01.10 13:25:39 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe [2012.01.10 13:23:51 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{648E6D91-1BCF-4FE5-BDAE-6777BD7917FE} [2012.01.10 13:23:30 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{5173D77C-D270-4016-921F-B51E57C0D86F} [2012.01.09 19:32:43 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\GTA Vice City User Files [2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games [2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games [2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield Installation Information [2012.01.09 14:55:57 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{483C0C77-9B4A-4832-9E17-D00F0C41CEEF} [2012.01.09 14:55:36 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{DD268440-8875-43E0-B750-D36001316736} [2012.01.09 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{86CFB256-CD44-4169-B015-A0E0A4A27ECB} [2012.01.08 12:31:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F15A13D5-0B80-49D1-8722-492714A003C1} [2012.01.07 19:02:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9E4C8377-579D-4F8F-AF42-466078873D79} [2012.01.05 12:33:27 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{77D8518A-BE6E-4176-969D-16E1F9889ABA} [2012.01.05 12:33:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9599849E-C1AE-408D-989C-184055158D1C} [2012.01.04 17:53:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\EPSON [2012.01.04 17:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Xerox [2012.01.04 13:01:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{29C0D372-F898-471F-9E40-BE58B56F4E7F} [2012.01.04 13:01:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{C2E9B22A-B731-4554-A790-7E94ABC0EC6C} [2012.01.03 13:18:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{264BC785-2A52-4B93-A67D-E93C7C5F8C95} [2012.01.03 13:17:49 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{136D686E-C663-4A64-A32B-3E76A1820EB9} [2012.01.02 10:59:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON [2012.01.02 10:57:24 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON [2012.01.02 10:57:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON [2012.01.02 10:57:06 | 000,000,000 | ---D | C] -- C:\Program Files\epson [2012.01.02 10:37:59 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{2DB0CA50-BB90-446E-86AE-CEF92D171830} [2012.01.02 10:37:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{57FA067B-1B5A-4EB1-8048-3EA0FD848FBA} [2012.01.01 14:34:58 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{519BCA38-E62C-42AE-9825-23A18DCF100B} [2012.01.01 14:34:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{4D298421-D036-4C55-A654-4B90B1C5B342} [2011.12.30 13:46:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org [2011.12.30 13:44:17 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3 [2011.12.30 13:42:38 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3 [2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2011.12.30 13:41:37 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2011.12.30 11:38:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{23AEC93C-592B-43B7-8BFC-DF33806CD7D3} [2011.12.30 11:38:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{95BAD371-73A0-42A9-8510-A91FB2312E93} [2011.12.29 21:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys [2011.12.27 15:09:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\ICQ [2011.12.27 14:49:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ-Banner-Remover [2011.12.27 14:48:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon [2011.12.27 14:48:26 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\System32\dhRichClient3.dll [2011.12.27 14:40:54 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ6Toolbar [2011.12.27 14:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ [2011.12.27 14:39:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7 [2011.12.27 14:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Guard-ICQ [2011.12.27 14:39:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\ICQ [2011.12.27 14:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.7 [2011.12.27 14:07:25 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{3FE3CBE6-09F2-452B-91AC-82DAE19EE321} [2011.12.27 14:07:14 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{18DC6E01-3EE7-4956-B2C9-5C3C533F8558} [2011.12.27 14:07:13 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F36BE284-F332-4FBB-A58A-47060C4B52BC} [2011.12.24 23:43:09 | 000,028,992 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll [2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Reallusion [2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\CamSuite Gallery [2011.12.23 19:44:45 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{A9DC22AE-1A88-4810-837D-439AD9E15D08} [2011.12.23 19:44:35 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{98CB93AE-8609-46CA-B957-68CA22D4FE83} [2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer [2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live Writer [2011.12.22 23:54:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\updates [2011.12.22 00:52:55 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.12.22 00:47:54 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2011.12.22 00:08:53 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2011.12.22 00:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2011.12.22 00:06:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live [2011.12.21 23:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices [2011.12.21 23:11:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{ADB0B6D3-CEB3-4253-B7A7-808FFEF1B4C1} [2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES [2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES [2011.12.21 22:54:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN [2011.12.21 22:21:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2011.12.21 22:15:47 | 000,000,000 | --SD | C] -- C:\Users\Dani\AppData\Roaming\Microsoft [2011.12.21 21:28:44 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft Games [2011.12.21 21:21:50 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{408070E9-A3E0-410B-9D5E-CC681A8A7B65} [2011.12.21 20:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live [2011.12.21 20:18:22 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{BD52F1DC-2973-42FB-9D62-C819F7A05AC1} [2011.12.21 20:16:17 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Avira [2011.12.21 20:10:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.12.21 20:10:27 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.12.21 20:10:26 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.12.21 20:10:26 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.12.21 20:10:26 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.12.21 19:29:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Skype [2011.12.21 19:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.12.21 19:26:51 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2011.12.21 19:26:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.12.21 17:37:32 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2011.12.21 17:37:32 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2011.12.21 17:37:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012 [2011.12.21 17:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2011.12.21 17:21:38 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Macromedia [2011.12.21 17:01:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\TuneUp Software [2011.12.21 17:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2011.12.21 17:00:21 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} [2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Mozilla [2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Mozilla [2011.12.21 17:00:01 | 016,096,216 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xul.dll [2011.12.21 17:00:01 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\updater.exe [2011.12.21 17:00:01 | 000,170,968 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll [2011.12.21 17:00:01 | 000,154,584 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll [2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll [2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll [2011.12.21 17:00:01 | 000,021,976 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll [2011.12.21 17:00:01 | 000,020,440 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll [2011.12.21 17:00:01 | 000,019,928 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll [2011.12.21 17:00:01 | 000,016,856 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe [2011.12.21 17:00:01 | 000,000,000 | ---D | C] -- C:\Users\Dani\searchplugins [2011.12.21 17:00:00 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll [2011.12.21 17:00:00 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll [2011.12.21 17:00:00 | 000,924,632 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe [2011.12.21 17:00:00 | 000,814,040 | ---- | C] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll [2011.12.21 17:00:00 | 000,646,104 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll [2011.12.21 17:00:00 | 000,626,688 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll [2011.12.21 17:00:00 | 000,548,864 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll [2011.12.21 17:00:00 | 000,486,360 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll [2011.12.21 17:00:00 | 000,479,232 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll [2011.12.21 17:00:00 | 000,371,672 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll [2011.12.21 17:00:00 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll [2011.12.21 17:00:00 | 000,187,352 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll [2011.12.21 17:00:00 | 000,125,912 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe [2011.12.21 17:00:00 | 000,109,528 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll [2011.12.21 17:00:00 | 000,097,240 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll [2011.12.21 17:00:00 | 000,043,992 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll [2011.12.21 17:00:00 | 000,019,416 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll [2011.12.21 17:00:00 | 000,015,832 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll [2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\uninstall [2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\hyphenation [2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\extensions [2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\defaults [2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\components [2011.12.21 16:51:47 | 000,917,504 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\System32\athr.sys [2011.12.21 16:51:47 | 000,376,832 | ---- | C] (Atheros) -- C:\Windows\System32\S64CPA.exe [2011.12.21 16:51:47 | 000,053,248 | ---- | C] (Atheros) -- C:\Windows\System32\athihvui.dll [2011.12.21 16:51:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\nn-NO [2011.12.21 16:51:45 | 000,393,216 | ---- | C] (Atheros) -- C:\Windows\System32\athihvs.dll [2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco [2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Atheros [2011.12.21 16:50:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Atheros [2011.12.21 16:31:07 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\Ulead Burn.Now [2011.12.21 16:31:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Ulead Systems [2011.12.21 16:10:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Toshiba [2011.12.21 16:10:34 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Symantec [2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Adobe [2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Adobe [2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\Searches [2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.12.21 16:10:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Identities [2011.12.21 16:09:58 | 000,000,000 | R--D | C] -- C:\Users\Dani\Contacts [2011.12.21 16:09:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead Burn.Now 4.5 SE [2011.12.21 16:08:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ulead Systems [2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Ulead Systems [2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\Ulead Systems [2011.12.21 16:07:32 | 005,632,000 | ---- | C] (Reallusion Inc.) -- C:\Windows\System32\RLVirtualCamera.ocx [2011.12.21 16:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reallusion [2011.12.21 16:07:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Reallusion [2011.12.21 16:07:15 | 000,000,000 | ---D | C] -- C:\Program Files\Reallusion [2011.12.21 16:06:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield [2011.12.21 16:04:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\VirtualStore [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Videos [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Saved Games [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Pictures [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Music [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Links [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Favorites [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Downloads [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Documents [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Desktop [2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Vorlagen [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Verlauf [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Temporary Internet Files [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Startmenü [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\SendTo [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Recent [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Netzwerkumgebung [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Lokale Einstellungen [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Videos [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Musik [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Eigene Dateien [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Bilder [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Druckumgebung [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Cookies [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Anwendungsdaten [2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Anwendungsdaten [2011.12.21 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Dani\AppData [2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Temp [2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft [2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Media Center Programs [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.10 13:26:15 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.001 [2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe [2012.01.10 13:03:10 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.01.10 13:03:10 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.01.10 13:03:10 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.01.10 13:03:10 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.01.10 12:57:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.01.10 12:57:15 | 2951,798,784 | -HS- | M] () -- C:\hiberfil.sys [2012.01.09 20:10:01 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.dat [2012.01.09 14:54:07 | 000,648,194 | ---- | M] () -- C:\Users\Dani\Documents\weber006.jpg [2012.01.09 14:53:33 | 000,527,575 | ---- | M] () -- C:\Users\Dani\Documents\niermann005.jpg [2012.01.09 14:52:56 | 000,467,510 | ---- | M] () -- C:\Users\Dani\Documents\kreuzer004.jpg [2012.01.09 14:52:16 | 000,570,189 | ---- | M] () -- C:\Users\Dani\Documents\avitea003.jpg [2012.01.09 14:50:28 | 000,730,926 | ---- | M] () -- C:\Users\Dani\Documents\berufsberatung002.jpg [2012.01.09 14:49:46 | 000,601,006 | ---- | M] () -- C:\Users\Dani\Documents\harz4001.jpg [2012.01.09 14:48:31 | 000,449,126 | ---- | M] () -- C:\Users\Dani\Documents\schulabsage002.jpg [2012.01.04 17:54:37 | 000,494,619 | ---- | M] () -- C:\Users\Dani\Documents\Zeugnis.jpg [2012.01.04 17:26:34 | 000,000,775 | ---- | M] () -- C:\Users\Public\Desktop\EPSON Scan.lnk [2012.01.01 04:38:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2011.12.30 22:06:51 | 000,284,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml [2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml [2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini [2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk [2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar [2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll [2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll [2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk [2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete [2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk [2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini [2011.12.22 00:55:54 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf [2011.12.21 17:37:29 | 000,000,616 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini [2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale [2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini [2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini [2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml [2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list [2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files [2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2011.12.14 12:23:40 | 000,031,552 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll [2011.12.14 12:23:22 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.09 14:54:07 | 000,648,194 | ---- | C] () -- C:\Users\Dani\Documents\weber006.jpg [2012.01.09 14:53:32 | 000,527,575 | ---- | C] () -- C:\Users\Dani\Documents\niermann005.jpg [2012.01.09 14:52:56 | 000,467,510 | ---- | C] () -- C:\Users\Dani\Documents\kreuzer004.jpg [2012.01.09 14:52:15 | 000,570,189 | ---- | C] () -- C:\Users\Dani\Documents\avitea003.jpg [2012.01.09 14:50:28 | 000,730,926 | ---- | C] () -- C:\Users\Dani\Documents\berufsberatung002.jpg [2012.01.09 14:49:45 | 000,601,006 | ---- | C] () -- C:\Users\Dani\Documents\harz4001.jpg [2012.01.09 14:48:31 | 000,449,126 | ---- | C] () -- C:\Users\Dani\Documents\schulabsage002.jpg [2012.01.04 17:54:37 | 000,494,619 | ---- | C] () -- C:\Users\Dani\Documents\Zeugnis.jpg [2012.01.04 17:26:34 | 000,000,775 | ---- | C] () -- C:\Users\Public\Desktop\EPSON Scan.lnk [2012.01.01 04:38:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf [2011.12.27 14:48:27 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll [2011.12.23 14:24:17 | 000,001,457 | ---- | C] () -- C:\Users\Dani\updates.xml [2011.12.23 14:24:17 | 000,000,057 | ---- | C] () -- C:\Users\Dani\active-update.xml [2011.12.22 00:47:59 | 2951,798,784 | -HS- | C] () -- C:\hiberfil.sys [2011.12.22 00:10:22 | 000,001,047 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2011.12.21 23:08:40 | 000,000,925 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2011.12.21 22:16:05 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd [2011.12.21 22:16:01 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man [2011.12.21 22:15:47 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf [2011.12.21 22:15:43 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2011.12.21 22:15:43 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2011.12.21 22:15:39 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf [2011.12.21 22:15:33 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf [2011.12.21 22:15:10 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF [2011.12.21 22:15:05 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs [2011.12.21 22:14:04 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml [2011.12.21 21:02:56 | 000,000,959 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.12.21 20:31:51 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2011.12.21 17:46:12 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf [2011.12.21 17:37:29 | 000,000,616 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2011.12.21 17:37:28 | 000,000,608 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk [2011.12.21 17:00:01 | 005,642,801 | ---- | C] () -- C:\Users\Dani\omni.jar [2011.12.21 17:00:01 | 000,034,427 | ---- | C] () -- C:\Users\Dani\removed-files [2011.12.21 17:00:01 | 000,002,723 | ---- | C] () -- C:\Users\Dani\precomplete [2011.12.21 17:00:01 | 000,000,701 | ---- | C] () -- C:\Users\Dani\updater.ini [2011.12.21 17:00:01 | 000,000,478 | ---- | C] () -- C:\Users\Dani\softokn3.chk [2011.12.21 17:00:01 | 000,000,141 | ---- | C] () -- C:\Users\Dani\platform.ini [2011.12.21 17:00:01 | 000,000,003 | ---- | C] () -- C:\Users\Dani\update.locale [2011.12.21 17:00:00 | 002,124,760 | ---- | C] () -- C:\Users\Dani\mozjs.dll [2011.12.21 17:00:00 | 000,011,263 | ---- | C] () -- C:\Users\Dani\blocklist.xml [2011.12.21 17:00:00 | 000,004,284 | ---- | C] () -- C:\Users\Dani\crashreporter.ini [2011.12.21 17:00:00 | 000,002,153 | ---- | C] () -- C:\Users\Dani\application.ini [2011.12.21 17:00:00 | 000,000,706 | ---- | C] () -- C:\Users\Dani\crashreporter-override.ini [2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\nssdbm3.chk [2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\freebl3.chk [2011.12.21 17:00:00 | 000,000,130 | ---- | C] () -- C:\Users\Dani\dependentlibs.list [2011.12.21 16:51:47 | 000,116,863 | ---- | C] () -- C:\Windows\System32\netathr.inf [2011.12.21 16:51:47 | 000,038,711 | ---- | C] () -- C:\Windows\System32\athrext.cat [2011.12.21 16:10:08 | 000,000,954 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2011.12.21 16:07:31 | 000,031,616 | ---- | C] () -- C:\Windows\System32\drivers\RLVrtAuCbl.sys [2011.12.21 16:03:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.12.03 09:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2009.02.24 10:57:02 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI [2009.02.23 20:08:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2009.02.23 18:20:20 | 000,618,442 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.02.23 18:20:20 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.02.23 18:20:20 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.02.23 18:20:20 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.01.05 08:31:24 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2009.01.05 08:31:24 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008.12.31 11:06:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008.12.31 10:38:39 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,284,520 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2011.12.27 14:48:34 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon [2012.01.04 17:53:55 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\EPSON [2012.01.06 12:46:29 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\ICQ [2011.12.30 13:46:47 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org [2011.12.24 23:42:37 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\TuneUp Software [2011.12.21 16:31:06 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Ulead Systems [2012.01.02 10:40:09 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer [2012.01.10 12:56:25 | 000,026,208 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.12.21 16:10:14 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.12.21 23:07:50 | 000,000,000 | -HSD | M] -- C:\Boot [2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.01.02 10:57:06 | 000,000,000 | R--D | M] -- C:\Program Files [2012.01.04 17:20:37 | 000,000,000 | -H-D | M] -- C:\ProgramData [2012.01.10 13:33:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.12.21 16:04:02 | 000,000,000 | R--D | M] -- C:\Users [2012.01.10 12:55:14 | 000,000,000 | ---D | M] -- C:\Windows [2009.02.24 11:25:44 | 000,000,000 | ---D | M] -- C:\works8.5_dutch [2009.02.24 11:31:15 | 000,000,000 | ---D | M] -- C:\works8.5_english [2009.02.24 11:39:00 | 000,000,000 | ---D | M] -- C:\works8.5_french [2009.02.24 11:47:28 | 000,000,000 | ---D | M] -- C:\works8.5_german [2009.02.24 11:19:35 | 000,000,000 | ---D | M] -- C:\works8.5_polish < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EXPLORER.EXE > [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTORV.SYS > [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\drivers\nvstor32.sys [2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_2ced8b81\nvstor32.sys < MD5 for: SCECLI.DLL > [2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2011.12.23 14:24:12 | 000,019,416 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll [2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml [2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini [2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml [2011.12.17 02:33:26 | 000,000,036 | ---- | M] () -- C:\Users\Dani\chrome.manifest [2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini [2011.12.23 14:24:12 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe [2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini [2011.12.17 02:19:09 | 002,106,216 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll [2011.12.17 02:19:09 | 001,998,168 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll [2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list [2011.12.23 14:24:12 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe [2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk [2011.12.23 14:24:12 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll [2011.12.21 17:00:02 | 000,022,338 | ---- | M] () -- C:\Users\Dani\install.log [2011.12.23 14:24:12 | 000,097,240 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll [2011.12.23 14:24:12 | 000,486,360 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll [2011.12.17 02:19:03 | 000,001,869 | ---- | M] () -- C:\Users\Dani\Microsoft.VC80.CRT.manifest [2011.12.23 14:24:11 | 000,015,832 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll [2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll [2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll [2011.12.23 14:24:11 | 000,043,992 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll [2011.12.17 02:19:03 | 000,479,232 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll [2011.12.17 02:19:03 | 000,548,864 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll [2011.12.17 02:19:03 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll [2011.12.23 14:24:11 | 000,187,352 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll [2011.12.23 14:24:11 | 000,646,104 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll [2011.12.23 14:24:11 | 000,371,672 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll [2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk [2011.12.23 14:24:11 | 000,109,528 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll [2011.12.23 14:24:11 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll [2012.01.10 13:45:40 | 001,310,720 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT [2012.01.10 13:45:40 | 000,262,144 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG1 [2011.12.21 16:04:02 | 000,000,000 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG2 [2012.01.10 12:56:29 | 000,065,536 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2012.01.10 12:56:29 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2011.12.21 16:11:09 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2011.12.21 16:04:02 | 000,000,020 | -HS- | M] () -- C:\Users\Dani\ntuser.ini [2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar [2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini [2011.12.23 14:24:10 | 000,021,976 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll [2011.12.23 14:24:10 | 000,020,440 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll [2011.12.23 14:24:10 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe [2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete [2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files [2011.12.23 14:24:10 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll [2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk [2011.12.23 14:24:10 | 000,170,968 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll [2011.12.23 14:24:10 | 000,154,584 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll [2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale [2011.12.23 14:24:10 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\updater.exe [2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini [2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml [2011.12.23 14:24:10 | 000,019,928 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll [2011.12.23 14:24:10 | 016,096,216 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xul.dll < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < > < End of report > und die Extras.txt datei. Code:
ATTFilter OTL Extras logfile created on: 10.01.2012 13:32:17 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dani\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free
5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS
Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS
Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Users\Dani\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E555093-4A6A-486C-99F7-EE088F62E15E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{28AFFCC5-50B4-468B-9576-44B0CE78BAB2}" = rport=137 | protocol=17 | dir=out | app=system |
"{31C47179-2452-4111-AF2F-26B32701D3D3}" = rport=139 | protocol=6 | dir=out | app=system |
"{4E8054E0-1813-4488-BC12-EC8769096DDD}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{536A78E0-F512-45B8-A4C0-80A4D41F9CF9}" = lport=138 | protocol=17 | dir=in | app=system |
"{9C54A3AF-B4E3-4625-9F81-8E05E46E366F}" = lport=139 | protocol=6 | dir=in | app=system |
"{AF7B4B2D-91F1-4F32-954A-D19BABC785B2}" = lport=137 | protocol=17 | dir=in | app=system |
"{B3D93FBB-ACAA-416C-90C0-3F4B2AFC2785}" = rport=445 | protocol=6 | dir=out | app=system |
"{D7135758-6D82-47D2-82CF-E91651C2C4B4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E177A86B-BE9A-4901-A9EB-D7E40C04FBF5}" = lport=445 | protocol=6 | dir=in | app=system |
"{E3D44108-8F0B-41A8-97E7-366CA48513BA}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F79AEBFD-0BC8-44D3-A8BC-296E8E78B4AE}" = rport=138 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0352013A-D4D4-4477-8B6A-8E174C624B43}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{06346BB0-1067-4DDC-8238-2EA398C0536F}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{1671EF7E-F980-4F87-87BF-6A23E455994F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1914A68E-4B00-4BEB-B1B4-B3D2CA4533CE}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{1C7111FC-37E0-4D11-9389-52D95048FDCD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{64DB1840-E22A-44DD-9905-E575F563EE9C}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{8172F516-4DFB-4770-B928-95120A9A961E}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{8EFA82F5-64A1-4FBA-9249-962E345B7212}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{AF643D27-7E94-46DA-B44A-80BC81784B07}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B8335073-989A-498F-A3A8-D0AE8FAB7F54}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E00204C6-C11A-43D4-82AE-4BD835339E44}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{E7FDC54A-A88B-4652-A031-80268216450B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.6 Build #5618 Banner Remover 1.0
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1" = GutscheinRausch.de - AddOn für Firefox
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB 2.0 Camera
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1504C77-1B19-4AF0-8DEC-946666123B55}" = CrazyTalk Cam Suite
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump 1.0.1.8
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"DesktopIconAmazon" = Desktop Icon für Amazon
"EPSON Scanner" = EPSON Scan
"EPSON SX218 Series" = Druckerdeinstallation für EPSON SX218 Series
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Guard.Mail.ru" = Guard.ICQ
"ICQToolbar" = ICQ Toolbar
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 9.0 (x86 de)" = Mozilla Firefox 9.0 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 23.12.2011 14:40:40 | Computer Name = Dani-Laptop | Source = Avira Antivirus | ID = 4122
Description = Die Datei avreg.dll konnte nicht geladen werden. Fehlercode: 0x2
Error - 23.12.2011 14:41:38 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 24.12.2011 15:35:45 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 25.12.2011 16:49:33 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 27.12.2011 09:03:23 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 29.12.2011 08:46:46 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 30.12.2011 06:35:48 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 30.12.2011 17:07:17 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 31.12.2011 05:48:40 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
Error - 31.12.2011 08:04:35 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 07.01.2012 13:21:47 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 07.01.2012 19:26:24 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 07.01.2012 20:19:21 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description =
Error - 08.01.2012 07:20:01 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 08.01.2012 13:52:03 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 09.01.2012 08:35:45 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 09.01.2012 11:20:06 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 09.01.2012 11:22:07 | Computer Name = Dani-Laptop | Source = DCOM | ID = 10010
Description =
Error - 10.01.2012 07:55:18 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 10.01.2012 07:58:33 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
< End of report >
ich hoffe ihr könnt mir weiterhelfen Geändert von Willow1989 (10.01.2012 um 14:06 Uhr) |
|
10.01.2012, 15:51
| #2 |
| | System musste blockiert werden. 50€ Trjoaner/Virus Kann mir den keiner Helfen?
__________________ |
|
10.01.2012, 16:17
| #3 |
| /// Malware-holic   | System musste blockiert werden. 50€ Trjoaner/Virus hi
__________________bist du der einzige hier? sieht nicht so aus oder... wir machen das hier alles komplett kostenlos für euch, also sollte man sich evtl. auch mal gedulden, oder du musst in ein geschäft gehen und geld für schnellere hilfe zahlen. hi dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org)
:Files
C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden öffne computer, öffne C: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. folge dem link, und lade das archiv im upload channel hoch http://www.trojaner-board.de/54791-a...ner-board.html
__________________ |
|
16.01.2012, 10:28
| #4 |
| | System musste blockiert werden. 50€ Trjoaner/Virus vielen dank aber da ich so verzweifelt war da ich den Laptop auch für die Arbeit brauchte hab ich alle themen durch gelesen bezüglich dieses virus und hab das nun so gelöst. |
|
| Themen zu System musste blockiert werden. 50€ Trjoaner/Virus |
| antivir, autorun, avira, bho, blockiert, defender, error, explorer, firefox, flash player, format, google, grand theft auto, helper, home, install.exe, installation, logfile, nvstor.sys, plug-in, realtek, registry, required, rundll, scan, software, system, usb, usb 2.0, vice city, vista, winlogon.exe, wlan. |
Linear-Darstellung
