Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: System musste blockiert werden. 50€ Trjoaner/Virus

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 10.01.2012, 12:58   #1
Willow1989
 
System musste blockiert werden. 50€ Trjoaner/Virus - Standard

System musste blockiert werden. 50€ Trjoaner/Virus



Hallo meine lieben Helfer ,

so nun habe ich mir OTL runtergeladen und nun hier die OTL. txt datei


Code:
ATTFilter
OTL logfile created on: 10.01.2012 13:32:17 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Dani\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free
5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS
Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS
 
Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
PRC - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () -- C:\Program Files\Guard-ICQ\GuardICQ.exe
PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.12.14 12:23:34 | 001,212,224 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesApp32.exe
PRC - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesService32.exe
PRC - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2008.08.20 11:35:20 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2006.09.14 08:20:24 | 000,126,464 | ---- | M] () -- C:\Program Files\WinRAR 3.61 Multi\rarext.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () [Auto | Running] -- C:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Running] -- D:\Tuneup\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.12.12 19:31:38 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- D:\Tuneup\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.06.23 09:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.01.13 09:45:00 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.08.23 02:28:32 | 000,333,824 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187Se.sys -- (RTL8187Se)
DRV - [2008.08.07 10:01:44 | 000,097,536 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008.07.19 20:53:00 | 007,545,824 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.06.10 01:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2008.04.01 14:42:36 | 000,014,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.02.29 23:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.03.19 16:00:14 | 000,031,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RLVrtAuCbl.sys -- (ReallusionVirtualAudio)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net [2011.12.27 14:48:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de [2011.12.27 14:48:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M]
 
[2011.12.21 17:00:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Extensions
[2012.01.05 18:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions
[2012.01.05 16:36:15 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.12.27 14:48:26 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net
[2011.12.27 14:48:35 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de
[2012.01.03 18:58:45 | 000,001,048 | ---- | M] () -- C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\searchplugins\icqplugin.xml
() (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{1FC895A6-2042-46EC-A61B-233165B4C218}.XPI
() (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files\Guard-ICQ\GuardICQ.exe ()
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International  CO., LTD.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org)
O4 - HKCU..\Run: [EPSON SX218 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIGDE.EXE (SEIKO EPSON CORPORATION)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69392199-458C-42AD-B6BC-728C723712B3}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F682A9C3-252C-4710-8AFB-98221359DD31}: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.10 13:25:39 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
[2012.01.10 13:23:51 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{648E6D91-1BCF-4FE5-BDAE-6777BD7917FE}
[2012.01.10 13:23:30 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{5173D77C-D270-4016-921F-B51E57C0D86F}
[2012.01.09 19:32:43 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\GTA Vice City User Files
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield Installation Information
[2012.01.09 14:55:57 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{483C0C77-9B4A-4832-9E17-D00F0C41CEEF}
[2012.01.09 14:55:36 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{DD268440-8875-43E0-B750-D36001316736}
[2012.01.09 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{86CFB256-CD44-4169-B015-A0E0A4A27ECB}
[2012.01.08 12:31:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F15A13D5-0B80-49D1-8722-492714A003C1}
[2012.01.07 19:02:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9E4C8377-579D-4F8F-AF42-466078873D79}
[2012.01.05 12:33:27 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{77D8518A-BE6E-4176-969D-16E1F9889ABA}
[2012.01.05 12:33:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9599849E-C1AE-408D-989C-184055158D1C}
[2012.01.04 17:53:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\EPSON
[2012.01.04 17:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Xerox
[2012.01.04 13:01:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{29C0D372-F898-471F-9E40-BE58B56F4E7F}
[2012.01.04 13:01:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{C2E9B22A-B731-4554-A790-7E94ABC0EC6C}
[2012.01.03 13:18:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{264BC785-2A52-4B93-A67D-E93C7C5F8C95}
[2012.01.03 13:17:49 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{136D686E-C663-4A64-A32B-3E76A1820EB9}
[2012.01.02 10:59:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON
[2012.01.02 10:57:24 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2012.01.02 10:57:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2012.01.02 10:57:06 | 000,000,000 | ---D | C] -- C:\Program Files\epson
[2012.01.02 10:37:59 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{2DB0CA50-BB90-446E-86AE-CEF92D171830}
[2012.01.02 10:37:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{57FA067B-1B5A-4EB1-8048-3EA0FD848FBA}
[2012.01.01 14:34:58 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{519BCA38-E62C-42AE-9825-23A18DCF100B}
[2012.01.01 14:34:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{4D298421-D036-4C55-A654-4B90B1C5B342}
[2011.12.30 13:46:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org
[2011.12.30 13:44:17 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011.12.30 13:42:38 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011.12.30 13:41:37 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011.12.30 11:38:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{23AEC93C-592B-43B7-8BFC-DF33806CD7D3}
[2011.12.30 11:38:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{95BAD371-73A0-42A9-8510-A91FB2312E93}
[2011.12.29 21:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2011.12.27 15:09:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\ICQ
[2011.12.27 14:49:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ-Banner-Remover
[2011.12.27 14:48:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon
[2011.12.27 14:48:26 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\System32\dhRichClient3.dll
[2011.12.27 14:40:54 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ6Toolbar
[2011.12.27 14:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ
[2011.12.27 14:39:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7
[2011.12.27 14:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Guard-ICQ
[2011.12.27 14:39:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\ICQ
[2011.12.27 14:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.7
[2011.12.27 14:07:25 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{3FE3CBE6-09F2-452B-91AC-82DAE19EE321}
[2011.12.27 14:07:14 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{18DC6E01-3EE7-4956-B2C9-5C3C533F8558}
[2011.12.27 14:07:13 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F36BE284-F332-4FBB-A58A-47060C4B52BC}
[2011.12.24 23:43:09 | 000,028,992 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Reallusion
[2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\CamSuite Gallery
[2011.12.23 19:44:45 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{A9DC22AE-1A88-4810-837D-439AD9E15D08}
[2011.12.23 19:44:35 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{98CB93AE-8609-46CA-B957-68CA22D4FE83}
[2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer
[2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live Writer
[2011.12.22 23:54:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\updates
[2011.12.22 00:52:55 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.12.22 00:47:54 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011.12.22 00:08:53 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2011.12.22 00:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2011.12.22 00:06:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live
[2011.12.21 23:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2011.12.21 23:11:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{ADB0B6D3-CEB3-4253-B7A7-808FFEF1B4C1}
[2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2011.12.21 22:54:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2011.12.21 22:21:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011.12.21 22:15:47 | 000,000,000 | --SD | C] -- C:\Users\Dani\AppData\Roaming\Microsoft
[2011.12.21 21:28:44 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft Games
[2011.12.21 21:21:50 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{408070E9-A3E0-410B-9D5E-CC681A8A7B65}
[2011.12.21 20:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2011.12.21 20:18:22 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{BD52F1DC-2973-42FB-9D62-C819F7A05AC1}
[2011.12.21 20:16:17 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Avira
[2011.12.21 20:10:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.21 20:10:27 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.12.21 20:10:26 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.21 20:10:26 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.21 20:10:26 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.12.21 19:29:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Skype
[2011.12.21 19:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.12.21 19:26:51 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011.12.21 19:26:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.12.21 17:37:32 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2011.12.21 17:37:32 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2011.12.21 17:37:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012
[2011.12.21 17:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2011.12.21 17:21:38 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Macromedia
[2011.12.21 17:01:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\TuneUp Software
[2011.12.21 17:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2011.12.21 17:00:21 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Mozilla
[2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Mozilla
[2011.12.21 17:00:01 | 016,096,216 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xul.dll
[2011.12.21 17:00:01 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\updater.exe
[2011.12.21 17:00:01 | 000,170,968 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll
[2011.12.21 17:00:01 | 000,154,584 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll
[2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll
[2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll
[2011.12.21 17:00:01 | 000,021,976 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll
[2011.12.21 17:00:01 | 000,020,440 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll
[2011.12.21 17:00:01 | 000,019,928 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll
[2011.12.21 17:00:01 | 000,016,856 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe
[2011.12.21 17:00:01 | 000,000,000 | ---D | C] -- C:\Users\Dani\searchplugins
[2011.12.21 17:00:00 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll
[2011.12.21 17:00:00 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll
[2011.12.21 17:00:00 | 000,924,632 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe
[2011.12.21 17:00:00 | 000,814,040 | ---- | C] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.21 17:00:00 | 000,646,104 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll
[2011.12.21 17:00:00 | 000,626,688 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll
[2011.12.21 17:00:00 | 000,548,864 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll
[2011.12.21 17:00:00 | 000,486,360 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll
[2011.12.21 17:00:00 | 000,479,232 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll
[2011.12.21 17:00:00 | 000,371,672 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll
[2011.12.21 17:00:00 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll
[2011.12.21 17:00:00 | 000,187,352 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll
[2011.12.21 17:00:00 | 000,125,912 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe
[2011.12.21 17:00:00 | 000,109,528 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll
[2011.12.21 17:00:00 | 000,097,240 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll
[2011.12.21 17:00:00 | 000,043,992 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll
[2011.12.21 17:00:00 | 000,019,416 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll
[2011.12.21 17:00:00 | 000,015,832 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\uninstall
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\hyphenation
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\extensions
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\defaults
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\components
[2011.12.21 16:51:47 | 000,917,504 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\System32\athr.sys
[2011.12.21 16:51:47 | 000,376,832 | ---- | C] (Atheros) -- C:\Windows\System32\S64CPA.exe
[2011.12.21 16:51:47 | 000,053,248 | ---- | C] (Atheros) -- C:\Windows\System32\athihvui.dll
[2011.12.21 16:51:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\nn-NO
[2011.12.21 16:51:45 | 000,393,216 | ---- | C] (Atheros) -- C:\Windows\System32\athihvs.dll
[2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco
[2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Atheros
[2011.12.21 16:50:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Atheros
[2011.12.21 16:31:07 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\Ulead Burn.Now
[2011.12.21 16:31:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Ulead Systems
[2011.12.21 16:10:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Toshiba
[2011.12.21 16:10:34 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Symantec
[2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Adobe
[2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Adobe
[2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\Searches
[2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.21 16:10:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Identities
[2011.12.21 16:09:58 | 000,000,000 | R--D | C] -- C:\Users\Dani\Contacts
[2011.12.21 16:09:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead Burn.Now 4.5 SE
[2011.12.21 16:08:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ulead Systems
[2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Ulead Systems
[2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\Ulead Systems
[2011.12.21 16:07:32 | 005,632,000 | ---- | C] (Reallusion Inc.) -- C:\Windows\System32\RLVirtualCamera.ocx
[2011.12.21 16:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reallusion
[2011.12.21 16:07:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Reallusion
[2011.12.21 16:07:15 | 000,000,000 | ---D | C] -- C:\Program Files\Reallusion
[2011.12.21 16:06:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield
[2011.12.21 16:04:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\VirtualStore
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Videos
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Saved Games
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Pictures
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Music
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Links
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Favorites
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Downloads
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Documents
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Desktop
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Vorlagen
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Verlauf
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Temporary Internet Files
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Startmenü
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\SendTo
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Recent
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Netzwerkumgebung
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Lokale Einstellungen
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Videos
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Musik
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Eigene Dateien
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Bilder
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Druckumgebung
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Cookies
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Anwendungsdaten
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Anwendungsdaten
[2011.12.21 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Dani\AppData
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Temp
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Media Center Programs
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.10 13:26:15 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
[2012.01.10 13:03:10 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.10 13:03:10 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.10 13:03:10 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.10 13:03:10 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.10 12:57:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.10 12:57:15 | 2951,798,784 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.09 20:10:01 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.01.09 14:54:07 | 000,648,194 | ---- | M] () -- C:\Users\Dani\Documents\weber006.jpg
[2012.01.09 14:53:33 | 000,527,575 | ---- | M] () -- C:\Users\Dani\Documents\niermann005.jpg
[2012.01.09 14:52:56 | 000,467,510 | ---- | M] () -- C:\Users\Dani\Documents\kreuzer004.jpg
[2012.01.09 14:52:16 | 000,570,189 | ---- | M] () -- C:\Users\Dani\Documents\avitea003.jpg
[2012.01.09 14:50:28 | 000,730,926 | ---- | M] () -- C:\Users\Dani\Documents\berufsberatung002.jpg
[2012.01.09 14:49:46 | 000,601,006 | ---- | M] () -- C:\Users\Dani\Documents\harz4001.jpg
[2012.01.09 14:48:31 | 000,449,126 | ---- | M] () -- C:\Users\Dani\Documents\schulabsage002.jpg
[2012.01.04 17:54:37 | 000,494,619 | ---- | M] () -- C:\Users\Dani\Documents\Zeugnis.jpg
[2012.01.04 17:26:34 | 000,000,775 | ---- | M] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.01.01 04:38:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.12.30 22:06:51 | 000,284,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml
[2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini
[2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk
[2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar
[2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll
[2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete
[2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk
[2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini
[2011.12.22 00:55:54 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
[2011.12.21 17:37:29 | 000,000,616 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini
[2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale
[2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini
[2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml
[2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list
[2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files
[2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.14 12:23:40 | 000,031,552 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2011.12.14 12:23:22 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.09 14:54:07 | 000,648,194 | ---- | C] () -- C:\Users\Dani\Documents\weber006.jpg
[2012.01.09 14:53:32 | 000,527,575 | ---- | C] () -- C:\Users\Dani\Documents\niermann005.jpg
[2012.01.09 14:52:56 | 000,467,510 | ---- | C] () -- C:\Users\Dani\Documents\kreuzer004.jpg
[2012.01.09 14:52:15 | 000,570,189 | ---- | C] () -- C:\Users\Dani\Documents\avitea003.jpg
[2012.01.09 14:50:28 | 000,730,926 | ---- | C] () -- C:\Users\Dani\Documents\berufsberatung002.jpg
[2012.01.09 14:49:45 | 000,601,006 | ---- | C] () -- C:\Users\Dani\Documents\harz4001.jpg
[2012.01.09 14:48:31 | 000,449,126 | ---- | C] () -- C:\Users\Dani\Documents\schulabsage002.jpg
[2012.01.04 17:54:37 | 000,494,619 | ---- | C] () -- C:\Users\Dani\Documents\Zeugnis.jpg
[2012.01.04 17:26:34 | 000,000,775 | ---- | C] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.01.01 04:38:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.12.27 14:48:27 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2011.12.23 14:24:17 | 000,001,457 | ---- | C] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:17 | 000,000,057 | ---- | C] () -- C:\Users\Dani\active-update.xml
[2011.12.22 00:47:59 | 2951,798,784 | -HS- | C] () -- C:\hiberfil.sys
[2011.12.22 00:10:22 | 000,001,047 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2011.12.21 23:08:40 | 000,000,925 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011.12.21 22:16:05 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2011.12.21 22:16:01 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2011.12.21 22:15:47 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2011.12.21 22:15:43 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.12.21 22:15:43 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.12.21 22:15:39 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2011.12.21 22:15:33 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2011.12.21 22:15:10 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2011.12.21 22:15:05 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2011.12.21 22:14:04 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2011.12.21 21:02:56 | 000,000,959 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.21 20:31:51 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.12.21 17:46:12 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2011.12.21 17:37:29 | 000,000,616 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2011.12.21 17:37:28 | 000,000,608 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2011.12.21 17:00:01 | 005,642,801 | ---- | C] () -- C:\Users\Dani\omni.jar
[2011.12.21 17:00:01 | 000,034,427 | ---- | C] () -- C:\Users\Dani\removed-files
[2011.12.21 17:00:01 | 000,002,723 | ---- | C] () -- C:\Users\Dani\precomplete
[2011.12.21 17:00:01 | 000,000,701 | ---- | C] () -- C:\Users\Dani\updater.ini
[2011.12.21 17:00:01 | 000,000,478 | ---- | C] () -- C:\Users\Dani\softokn3.chk
[2011.12.21 17:00:01 | 000,000,141 | ---- | C] () -- C:\Users\Dani\platform.ini
[2011.12.21 17:00:01 | 000,000,003 | ---- | C] () -- C:\Users\Dani\update.locale
[2011.12.21 17:00:00 | 002,124,760 | ---- | C] () -- C:\Users\Dani\mozjs.dll
[2011.12.21 17:00:00 | 000,011,263 | ---- | C] () -- C:\Users\Dani\blocklist.xml
[2011.12.21 17:00:00 | 000,004,284 | ---- | C] () -- C:\Users\Dani\crashreporter.ini
[2011.12.21 17:00:00 | 000,002,153 | ---- | C] () -- C:\Users\Dani\application.ini
[2011.12.21 17:00:00 | 000,000,706 | ---- | C] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\freebl3.chk
[2011.12.21 17:00:00 | 000,000,130 | ---- | C] () -- C:\Users\Dani\dependentlibs.list
[2011.12.21 16:51:47 | 000,116,863 | ---- | C] () -- C:\Windows\System32\netathr.inf
[2011.12.21 16:51:47 | 000,038,711 | ---- | C] () -- C:\Windows\System32\athrext.cat
[2011.12.21 16:10:08 | 000,000,954 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.12.21 16:07:31 | 000,031,616 | ---- | C] () -- C:\Windows\System32\drivers\RLVrtAuCbl.sys
[2011.12.21 16:03:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.03 09:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.02.24 10:57:02 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2009.02.23 20:08:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.02.23 18:20:20 | 000,618,442 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.02.23 18:20:20 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.02.23 18:20:20 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.02.23 18:20:20 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.01.05 08:31:24 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2009.01.05 08:31:24 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.12.31 11:06:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.12.31 10:38:39 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,284,520 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.12.27 14:48:34 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon
[2012.01.04 17:53:55 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\EPSON
[2012.01.06 12:46:29 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\ICQ
[2011.12.30 13:46:47 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org
[2011.12.24 23:42:37 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\TuneUp Software
[2011.12.21 16:31:06 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Ulead Systems
[2012.01.02 10:40:09 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer
[2012.01.10 12:56:25 | 000,026,208 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.12.21 16:10:14 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.12.21 23:07:50 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.01.02 10:57:06 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.04 17:20:37 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.01.10 13:33:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.12.21 16:04:02 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.10 12:55:14 | 000,000,000 | ---D | M] -- C:\Windows
[2009.02.24 11:25:44 | 000,000,000 | ---D | M] -- C:\works8.5_dutch
[2009.02.24 11:31:15 | 000,000,000 | ---D | M] -- C:\works8.5_english
[2009.02.24 11:39:00 | 000,000,000 | ---D | M] -- C:\works8.5_french
[2009.02.24 11:47:28 | 000,000,000 | ---D | M] -- C:\works8.5_german
[2009.02.24 11:19:35 | 000,000,000 | ---D | M] -- C:\works8.5_polish
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\drivers\nvstor32.sys
[2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_2ced8b81\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2011.12.23 14:24:12 | 000,019,416 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll
[2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml
[2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini
[2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml
[2011.12.17 02:33:26 | 000,000,036 | ---- | M] () -- C:\Users\Dani\chrome.manifest
[2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.23 14:24:12 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe
[2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini
[2011.12.17 02:19:09 | 002,106,216 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll
[2011.12.17 02:19:09 | 001,998,168 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll
[2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list
[2011.12.23 14:24:12 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe
[2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk
[2011.12.23 14:24:12 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll
[2011.12.21 17:00:02 | 000,022,338 | ---- | M] () -- C:\Users\Dani\install.log
[2011.12.23 14:24:12 | 000,097,240 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll
[2011.12.23 14:24:12 | 000,486,360 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll
[2011.12.17 02:19:03 | 000,001,869 | ---- | M] () -- C:\Users\Dani\Microsoft.VC80.CRT.manifest
[2011.12.23 14:24:11 | 000,015,832 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll
[2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll
[2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.23 14:24:11 | 000,043,992 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll
[2011.12.17 02:19:03 | 000,479,232 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll
[2011.12.17 02:19:03 | 000,548,864 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll
[2011.12.17 02:19:03 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll
[2011.12.23 14:24:11 | 000,187,352 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll
[2011.12.23 14:24:11 | 000,646,104 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll
[2011.12.23 14:24:11 | 000,371,672 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll
[2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.23 14:24:11 | 000,109,528 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll
[2011.12.23 14:24:11 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll
[2012.01.10 13:45:40 | 001,310,720 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT
[2012.01.10 13:45:40 | 000,262,144 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG1
[2011.12.21 16:04:02 | 000,000,000 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG2
[2012.01.10 12:56:29 | 000,065,536 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2012.01.10 12:56:29 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2011.12.21 16:11:09 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2011.12.21 16:04:02 | 000,000,020 | -HS- | M] () -- C:\Users\Dani\ntuser.ini
[2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar
[2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini
[2011.12.23 14:24:10 | 000,021,976 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll
[2011.12.23 14:24:10 | 000,020,440 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll
[2011.12.23 14:24:10 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe
[2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete
[2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files
[2011.12.23 14:24:10 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll
[2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk
[2011.12.23 14:24:10 | 000,170,968 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll
[2011.12.23 14:24:10 | 000,154,584 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll
[2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale
[2011.12.23 14:24:10 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\updater.exe
[2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini
[2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:10 | 000,019,928 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll
[2011.12.23 14:24:10 | 016,096,216 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xul.dll
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         



und die Extras.txt datei.




Code:
ATTFilter
OTL Extras logfile created on: 10.01.2012 13:32:17 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Dani\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free
5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS
Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS
 
Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Users\Dani\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E555093-4A6A-486C-99F7-EE088F62E15E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{28AFFCC5-50B4-468B-9576-44B0CE78BAB2}" = rport=137 | protocol=17 | dir=out | app=system | 
"{31C47179-2452-4111-AF2F-26B32701D3D3}" = rport=139 | protocol=6 | dir=out | app=system | 
"{4E8054E0-1813-4488-BC12-EC8769096DDD}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{536A78E0-F512-45B8-A4C0-80A4D41F9CF9}" = lport=138 | protocol=17 | dir=in | app=system | 
"{9C54A3AF-B4E3-4625-9F81-8E05E46E366F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{AF7B4B2D-91F1-4F32-954A-D19BABC785B2}" = lport=137 | protocol=17 | dir=in | app=system | 
"{B3D93FBB-ACAA-416C-90C0-3F4B2AFC2785}" = rport=445 | protocol=6 | dir=out | app=system | 
"{D7135758-6D82-47D2-82CF-E91651C2C4B4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{E177A86B-BE9A-4901-A9EB-D7E40C04FBF5}" = lport=445 | protocol=6 | dir=in | app=system | 
"{E3D44108-8F0B-41A8-97E7-366CA48513BA}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{F79AEBFD-0BC8-44D3-A8BC-296E8E78B4AE}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0352013A-D4D4-4477-8B6A-8E174C624B43}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{06346BB0-1067-4DDC-8238-2EA398C0536F}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{1671EF7E-F980-4F87-87BF-6A23E455994F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1914A68E-4B00-4BEB-B1B4-B3D2CA4533CE}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{1C7111FC-37E0-4D11-9389-52D95048FDCD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{64DB1840-E22A-44DD-9905-E575F563EE9C}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{8172F516-4DFB-4770-B928-95120A9A961E}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{8EFA82F5-64A1-4FBA-9249-962E345B7212}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{AF643D27-7E94-46DA-B44A-80BC81784B07}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{B8335073-989A-498F-A3A8-D0AE8FAB7F54}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{E00204C6-C11A-43D4-82AE-4BD835339E44}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{E7FDC54A-A88B-4652-A031-80268216450B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.6 Build #5618 Banner Remover 1.0
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1" = GutscheinRausch.de - AddOn für Firefox
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB 2.0 Camera
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1504C77-1B19-4AF0-8DEC-946666123B55}" = CrazyTalk Cam Suite
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump 1.0.1.8
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"DesktopIconAmazon" = Desktop Icon für Amazon
"EPSON Scanner" = EPSON Scan
"EPSON SX218 Series" = Druckerdeinstallation für EPSON SX218 Series
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Guard.Mail.ru" = Guard.ICQ
"ICQToolbar" = ICQ Toolbar
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 9.0 (x86 de)" = Mozilla Firefox 9.0 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.12.2011 14:40:40 | Computer Name = Dani-Laptop | Source = Avira Antivirus | ID = 4122
Description = Die Datei avreg.dll konnte nicht geladen werden.  Fehlercode: 0x2
 
Error - 23.12.2011 14:41:38 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.12.2011 15:35:45 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.12.2011 16:49:33 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.12.2011 09:03:23 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 29.12.2011 08:46:46 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.12.2011 06:35:48 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.12.2011 17:07:17 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 31.12.2011 05:48:40 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
Error - 31.12.2011 08:04:35 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 07.01.2012 13:21:47 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 07.01.2012 19:26:24 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 07.01.2012 20:19:21 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 08.01.2012 07:20:01 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 08.01.2012 13:52:03 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 09.01.2012 08:35:45 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 09.01.2012 11:20:06 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 09.01.2012 11:22:07 | Computer Name = Dani-Laptop | Source = DCOM | ID = 10010
Description = 
 
Error - 10.01.2012 07:55:18 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 10.01.2012 07:58:33 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
 
< End of report >
         


ich hoffe ihr könnt mir weiterhelfen

Geändert von Willow1989 (10.01.2012 um 13:06 Uhr)

Alt 10.01.2012, 14:51   #2
Willow1989
 
System musste blockiert werden. 50€ Trjoaner/Virus - Standard

System musste blockiert werden. 50€ Trjoaner/Virus



Kann mir den keiner Helfen?
__________________


Alt 10.01.2012, 15:17   #3
markusg
/// Malware-holic
 
System musste blockiert werden. 50€ Trjoaner/Virus - Standard

System musste blockiert werden. 50€ Trjoaner/Virus



hi
bist du der einzige hier?
sieht nicht so aus oder...
wir machen das hier alles komplett kostenlos für euch, also sollte man sich evtl. auch mal gedulden, oder du musst in ein geschäft gehen und geld für schnellere hilfe zahlen.
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
ATTFilter
:OTL
O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org)
 :Files
C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html
__________________
__________________

Alt 16.01.2012, 09:28   #4
Willow1989
 
System musste blockiert werden. 50€ Trjoaner/Virus - Standard

System musste blockiert werden. 50€ Trjoaner/Virus



vielen dank aber da ich so verzweifelt war da ich den Laptop auch für die Arbeit brauchte hab ich alle themen durch gelesen bezüglich dieses virus und hab das nun so gelöst.

Antwort

Themen zu System musste blockiert werden. 50€ Trjoaner/Virus
antivir, autorun, avira, bho, blockiert, defender, error, explorer, firefox, flash player, format, google, grand theft auto, helper, home, install.exe, installation, logfile, nvstor.sys, realtek, registry, required, rundll, scan, software, system, usb, usb 2.0, vice city, vista, winlogon.exe, wlan.



Ähnliche Themen: System musste blockiert werden. 50€ Trjoaner/Virus


  1. Das musste mal gesagt werden .....
    Lob, Kritik und Wünsche - 02.03.2015 (0)
  2. 50€ Virus blockiert System
    Log-Analyse und Auswertung - 09.03.2012 (1)
  3. (2x) Bundespolizeit-Virus - System blockiert!
    Mülltonne - 06.03.2012 (2)
  4. abnow trjoaner/virus, wie gefährlich und wie weiter vorgehen?
    Plagegeister aller Art und deren Bekämpfung - 27.02.2012 (1)
  5. Windows System ist Blockiert,BKA 50€ Virus
    Plagegeister aller Art und deren Bekämpfung - 18.02.2012 (7)
  6. Musste audiodg.exe wegen Virus entfernen, was nun?
    Plagegeister aller Art und deren Bekämpfung - 23.01.2012 (1)
  7. "Windows wird aus Sicherheitsgründen blockiert"Virus blockiert System
    Log-Analyse und Auswertung - 22.12.2011 (4)
  8. OTL.EXE musste beendet werden
    Plagegeister aller Art und deren Bekämpfung - 30.07.2011 (11)
  9. Internet ports werden blockiert - Virus?
    Plagegeister aller Art und deren Bekämpfung - 01.02.2009 (0)
  10. Virus, Trjoaner oder sonst was?
    Plagegeister aller Art und deren Bekämpfung - 18.09.2008 (3)
  11. Virus legt Rechner lahm musste formatieren Noch eine Gefahr?
    Plagegeister aller Art und deren Bekämpfung - 22.07.2008 (2)
  12. Generic host for win 32 hat ein problem festgestellt und musste beendet werden
    Log-Analyse und Auswertung - 27.03.2008 (15)
  13. Ich glaub ich hab nen wurm! LSA-Shell (lsass.exe musste beendet werden)
    Plagegeister aller Art und deren Bekämpfung - 20.06.2007 (10)
  14. explorer.exe musste beendet werden wegen ModName: unknown
    Plagegeister aller Art und deren Bekämpfung - 24.04.2007 (1)
  15. ports werden blockiert - virus/trojaner?
    Plagegeister aller Art und deren Bekämpfung - 28.02.2006 (6)
  16. Trjoaner im Win 2000 System ?
    Plagegeister aller Art und deren Bekämpfung - 15.03.2003 (19)
  17. Trjoaner im Win 2000 System ?
    Plagegeister aller Art und deren Bekämpfung - 10.03.2003 (1)

Zum Thema System musste blockiert werden. 50€ Trjoaner/Virus - Hallo meine lieben Helfer , so nun habe ich mir OTL runtergeladen und nun hier die OTL. txt datei Code: Alles auswählen Aufklappen ATTFilter OTL logfile created on: 10.01.2012 13:32:17 - System musste blockiert werden. 50€ Trjoaner/Virus...
Archiv
Du betrachtest: System musste blockiert werden. 50€ Trjoaner/Virus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.