| |
| |||||||
Log-Analyse und Auswertung: Werbeseite öffnet sich wiederholt beim Start von Firefox automatischWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
28.01.2012, 00:35
| #1 |
| |  Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Hallo, also der Titel sagt eigentlich alles. Habe schon gegoogelt und Malwarebyt sowie CC Cleaner runtergeladen, aber selbst konnte ich das Problem nicht bereinigen. Die Seite bietet mir übrigens an ein Iphone zu kaufen... Daher poste ich mal die Logfiles und hoffe, dass ihr mir helfen könnt. Bin für jede Hilfe dankbar und verzeiht mir bitte, dass ich wenig Erfahrung mit Antiviren Maßnahmen habe... LOG: Malwarebytes Anti-Malware (Test) 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.27.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 [Administrator] Schutz: Aktiviert 27.01.2012 23:31:25 mbam-log-2012-01-27 (23-31-25).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 327814 Laufzeit: 42 Minute(n), Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Windows\assembly\temp\kwrd.dll (PUP.BitMiner) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Also die Datei sollte eigentlich mit MalwareByte gelöscht sein, aber das Problem tritt immer noch auf. |
|
28.01.2012, 11:50
| #2 |
| /// Malware-holic   | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch hi,
__________________na da gucken wir doch mal. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
28.01.2012, 13:28
| #3 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch OTL.Txt
__________________Textbox.[/list] Code:
ATTFilter OTL logfile created on: 1/28/2012 12:47:16 PM - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Name\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.91 Gb Total Physical Memory | 2.57 Gb Available Physical Memory | 65.68% Memory free 7.82 Gb Paging File | 6.24 Gb Available in Paging File | 79.80% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 434.66 Gb Total Space | 339.79 Gb Free Space | 78.17% Space Free | Partition Type: NTFS Drive D: | 30.00 Gb Total Space | 3.55 Gb Free Space | 11.83% Space Free | Partition Type: NTFS Unable to calculate disk information. Computer Name: ComputerName | User Name: Name | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/01/28 12:44:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe PRC - [2012/01/03 05:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011/12/24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011/12/15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011/12/15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011/12/15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011/03/04 12:45:08 | 001,529,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe PRC - [2011/02/24 02:04:54 | 003,402,760 | ---- | M] (Pegatron Corporation) -- C:\Program Files (x86)\PHotkey\POSD.exe PRC - [2011/02/24 02:04:50 | 000,819,720 | ---- | M] (Pegatron Corporation) -- C:\Program Files (x86)\PHotkey\PHotkey.exe PRC - [2011/02/17 12:52:09 | 001,997,416 | R--- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011/02/11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe PRC - [2011/02/11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe PRC - [2011/02/11 20:39:54 | 000,985,424 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe PRC - [2011/02/11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe PRC - [2011/01/17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2011/01/17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2010/11/29 10:49:34 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe PRC - [2010/11/17 09:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010/11/05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010/10/29 04:07:26 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe PRC - [2010/09/14 05:45:56 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2010/09/14 05:45:44 | 000,508,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2010/02/03 09:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe PRC - [2010/01/13 01:36:00 | 000,117,256 | R--- | M] () -- C:\Program Files (x86)\PHotkey\MsgTranAgt.exe PRC - [2009/12/18 23:40:48 | 000,104,968 | R--- | M] () -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe PRC - [2009/11/02 22:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe ========== Modules (No Company Name) ========== MOD - [2012/01/11 15:47:18 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\b41e38edbd6dfe20997f6ea7c080aceb\System.Web.ni.dll MOD - [2012/01/11 15:47:10 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b559a471eef00081f0b5c2719d1d9623\System.Runtime.Remoting.ni.dll MOD - [2012/01/08 16:54:27 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll MOD - [2011/11/14 20:32:27 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\6aef03034d33721bfbd588d9d7fffe60\IAStorCommon.ni.dll MOD - [2011/11/14 20:32:26 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll MOD - [2011/11/14 20:32:24 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4ffea70edf9aa81cba6a5be8070d3dd9\IAStorUtil.ni.dll MOD - [2011/11/14 20:32:21 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll MOD - [2011/11/14 20:32:13 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll MOD - [2011/11/14 20:32:04 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll MOD - [2011/11/14 20:31:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll MOD - [2011/11/14 20:31:57 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll MOD - [2011/11/14 20:31:47 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll MOD - [2011/02/10 20:24:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2010/11/13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009/11/02 22:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2009/11/02 22:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011/02/17 04:08:56 | 001,133,568 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:64bit: - [2011/02/09 12:49:18 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:64bit: - [2011/02/05 00:34:20 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2011/02/05 00:24:24 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV:64bit: - [2011/02/05 00:19:50 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2010/12/17 15:46:34 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV:64bit: - [2010/09/23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2012/01/05 11:10:27 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012/01/03 05:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011/12/15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011/12/15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/03/04 12:45:08 | 001,529,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2011/02/17 12:52:09 | 001,997,416 | R--- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011/02/11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service) SRV - [2011/02/11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service) SRV - [2011/02/11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor) SRV - [2010/12/06 12:52:40 | 000,062,464 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi) SRV - [2010/11/29 19:49:36 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56) SRV - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010/10/07 01:46:42 | 000,159,752 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\PHotkey\GFNEXSrv.exe -- (GFNEXSrv) SRV - [2010/09/14 05:45:56 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2010/09/14 05:45:44 | 000,508,264 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010/03/18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/12/18 23:40:48 | 000,104,968 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011/12/15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011/12/15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011/12/15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011/12/10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011/03/06 20:52:22 | 012,264,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011/03/04 12:51:50 | 000,306,536 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV:64bit: - [2011/02/24 19:40:20 | 008,591,872 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R) DRV:64bit: - [2011/02/17 12:52:11 | 001,577,600 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011/02/16 22:45:48 | 000,261,632 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) Intel(R) Centrino(R) DRV:64bit: - [2011/02/16 22:45:48 | 000,261,632 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) Intel(R) Centrino(R) DRV:64bit: - [2011/02/10 14:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011/02/10 14:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011/01/24 10:24:52 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux) DRV:64bit: - [2011/01/24 10:22:48 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex) DRV:64bit: - [2011/01/24 09:56:06 | 000,274,944 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf) DRV:64bit: - [2010/12/24 08:26:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010/11/08 14:52:14 | 000,068,608 | ---- | M] (Sentelic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fspad_xp64.sys -- (fspad_xp64) DRV:64bit: - [2010/11/08 14:52:14 | 000,068,608 | ---- | M] (Sentelic Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fspad_wlh64.sys -- (fspad_wlh64) DRV:64bit: - [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010/10/29 04:07:44 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd) DRV:64bit: - [2010/10/15 00:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R) DRV:64bit: - [2010/09/23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2010/09/14 05:45:52 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2010/09/14 05:45:50 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2010/09/14 05:45:48 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2010/09/14 05:45:44 | 000,760,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2010/08/24 17:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010/02/08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA) DRV:64bit: - [2009/10/23 16:26:14 | 000,046,592 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009/08/13 22:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/14 01:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc) DRV:64bit: - [2009/06/10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008/11/16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE) DRV:64bit: - [2008/03/13 08:46:00 | 000,027,136 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ManyCam_x64.sys -- (ManyCam) DRV - [2009/09/11 22:11:46 | 000,014,344 | R--- | M] (PEGATRON) [Kernel | Auto | Running] -- C:\Program Files (x86)\PHotkey\PEGAGFN.sys -- (PEGAGFN) DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/08 15:58:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/13 23:25:37 | 000,000,000 | ---D | M] [2011/10/15 13:48:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Extensions [2012/01/27 12:23:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\zcvh1v1u.default\extensions [2012/01/08 16:48:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/01/08 16:48:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} () (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZCVH1V1U.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI [2012/01/08 15:58:48 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/03/14 23:20:01 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011/09/29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011/09/29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011/09/29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011/09/29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011/09/29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011/09/29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml Hosts file not found O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.) O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation) O4:64bit: - HKLM..\Run: [fspuip] C:\Program Files\FSP\fspuip.exe (Sentelic Corporation) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink) O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe (CyberLink Corp.) O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4 - Startup: C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 134.102.20.20 134.102.200.14 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08A69B5D-D8A6-445B-ADFE-7E205712D1A7}: DhcpNameServer = 134.102.20.20 134.102.200.14 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012/01/28 12:44:40 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe [2012/01/28 12:25:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F37384EF-94DE-41C3-A6DB-70303AA7A894} [2012/01/28 12:25:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{76148F61-4269-4822-AB82-2FFB6B3E0BF9} [2012/01/28 00:19:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{562517D7-ABE5-43A3-B01B-1EAD99AC6739} [2012/01/28 00:19:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6F85C4C0-0C6D-4905-A87A-FE33ECDBECA1} [2012/01/27 21:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2012/01/27 21:55:42 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012/01/27 21:12:12 | 000,000,000 | ---D | C] -- C:\Windows\de [2012/01/27 21:11:19 | 000,000,000 | ---D | C] -- C:\Windows\da [2012/01/27 21:11:13 | 000,000,000 | ---D | C] -- C:\Windows\el [2012/01/27 21:11:08 | 000,000,000 | ---D | C] -- C:\Windows\en [2012/01/27 21:11:03 | 000,000,000 | ---D | C] -- C:\Windows\es [2012/01/27 21:10:58 | 000,000,000 | ---D | C] -- C:\Windows\fr [2012/01/27 21:10:52 | 000,000,000 | ---D | C] -- C:\Windows\hu [2012/01/27 21:10:46 | 000,000,000 | ---D | C] -- C:\Windows\it [2012/01/27 21:10:41 | 000,000,000 | ---D | C] -- C:\Windows\nl [2012/01/27 21:10:37 | 000,000,000 | ---D | C] -- C:\Windows\pl [2012/01/27 21:10:32 | 000,000,000 | ---D | C] -- C:\Windows\sl [2012/01/27 21:10:26 | 000,000,000 | ---D | C] -- C:\Windows\tr [2012/01/27 21:01:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C83509EF-EEB2-425D-B45C-35E35041C2CC} [2012/01/27 21:01:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5DF17BBD-F7D6-4146-A09E-3FB9AB41DDF1} [2012/01/27 17:01:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{59E925D5-2C77-4D84-A46A-0238AD4219E5} [2012/01/27 17:01:06 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FE42A2F9-4827-43B7-9D38-FF7B00AA0F64} [2012/01/27 14:45:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BC5A62B2-E73D-448D-B809-B93533A29EA1} [2012/01/27 14:44:55 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1CE72B76-3BCC-445D-AB16-586AFA594A89} [2012/01/27 12:13:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{713D0F20-DBA2-4DF8-A9B3-260C1155D87B} [2012/01/27 12:12:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3D6F7B15-3BF4-4957-B0A6-4AF9771827A2} [2012/01/26 19:49:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{79EBF8D7-A99A-4EF8-91A9-5860C5FD8D6A} [2012/01/26 19:49:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CBE189A0-018F-48FD-8D1F-CFEE034B55CD} [2012/01/26 18:52:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012/01/26 15:41:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{58A2E041-F89D-47AD-ABD0-B64825D5C32E} [2012/01/26 15:41:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9F68E7AA-5B57-4A15-9F8C-95BF4E8B826C} [2012/01/26 11:10:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0B065473-D183-40A9-BF51-D7AF5FE42764} [2012/01/26 11:10:46 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D47F5E29-69A4-4D2C-BFED-D764588D6BA2} [2012/01/26 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1B3F01B6-E011-492C-AEE9-E3635988433F} [2012/01/26 00:46:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{06048322-3C53-446D-9690-BED9DFE5910B} [2012/01/26 00:35:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Malwarebytes [2012/01/26 00:35:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/01/26 00:35:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012/01/26 00:35:45 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012/01/26 00:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012/01/26 00:33:43 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Avira [2012/01/26 00:21:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012/01/26 00:21:06 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012/01/26 00:21:06 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012/01/26 00:21:06 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2012/01/26 00:21:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012/01/26 00:21:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2012/01/26 00:20:20 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012/01/25 23:57:40 | 000,000,000 | ---D | C] -- C:\Windows\system64 [2012/01/25 16:53:59 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{55997E05-8748-4BBE-A61E-101EC672A13E} [2012/01/25 16:53:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4580B02E-046F-4F00-8B60-2E966EBE9204} [2012/01/25 12:32:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4A2FC7A5-3F1C-47A3-9B81-23EE650B22C2} [2012/01/25 12:31:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9A113D39-BF6B-462A-9CE8-838AD95F5C2E} [2012/01/25 08:49:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5BA694F6-FE25-4CFC-926F-61B0E1007DF4} [2012/01/25 08:49:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0DA424CC-4772-40D0-A7D8-CBC67C2DB753} [2012/01/24 18:14:18 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{075297A6-52EC-4869-BC2A-F235DACD7166} [2012/01/24 18:12:59 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CF3020A4-E6E7-4E77-9841-E69D31D1F2F4} [2012/01/24 14:00:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D3741F08-4468-47D9-951D-517A4F3BB7B9} [2012/01/24 14:00:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{78728ECE-CCE3-4824-9BFA-3FB7B4D21A83} [2012/01/23 19:41:01 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{53AA79A9-2FBC-42FF-91BB-9775CC4DF73A} [2012/01/23 19:40:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{681217EE-C521-471D-9108-B1656CD36FF1} [2012/01/23 19:17:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E10C5C07-2404-4281-A88E-90B0BDF38B40} [2012/01/23 19:17:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2FE1BBBF-1127-49BD-A67E-EE93B1F22DD4} [2012/01/23 12:57:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C4E2A4D-C1AC-4F68-AF4B-70AB731C2C56} [2012/01/23 12:56:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{05B4F51C-1AF2-4987-BD6A-6BACD2CA8BCE} [2012/01/23 12:38:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{82B55834-90D0-4FC7-8857-A27B01EFF66A} [2012/01/23 12:38:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C1F4AF55-98A3-4D48-BDDF-D3631E855252} [2012/01/23 10:21:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{55FD0A3D-F4CB-4DEB-A219-0FE56863EC08} [2012/01/23 07:38:50 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\InfoManagement [2012/01/23 07:15:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DC564A1A-0724-4DE4-9DF9-9AD7AEC4B81F} [2012/01/23 07:15:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5E3A1586-A524-4419-BFB3-9DC126442A14} [2012/01/22 21:16:10 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\Windows\SysWow64\devil.dll [2012/01/22 21:16:10 | 000,369,152 | ---- | C] (The Public) -- C:\Windows\SysWow64\avisynth.dll [2012/01/22 21:16:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2012/01/22 21:16:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\i420vfw.dll [2012/01/22 21:16:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5 [2012/01/22 16:46:44 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4FC3DE91-FFD5-4953-89E0-5466FC838C24} [2012/01/22 11:48:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{01FBE301-6BB0-4DF8-8D52-23D7AA93DA9F} [2012/01/22 11:48:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{963486C6-53F7-46AF-8A7A-4156C12FB6E3} [2012/01/21 20:54:41 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\INFO [2012/01/21 18:20:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{93F2CA55-93A9-4CCF-B9D9-DF6735DD88BA} [2012/01/21 18:20:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{106EC069-7742-447C-A7AD-03DD96723E8A} [2012/01/21 11:14:54 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{25B0AE42-E9BF-4925-B6CA-FBB8A49519CA} [2012/01/21 11:14:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{07F74A73-B078-4A7E-9B55-E25798E0709C} [2012/01/20 18:34:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{73CDAE95-0805-46A0-8D80-87314BCB3570} [2012/01/20 18:34:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{552AB41C-93A1-46E0-A8FC-07C0F4543573} [2012/01/20 13:21:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E1ECC40A-18AC-44E9-A63B-3556D8394113} [2012/01/20 13:21:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C28D815-1F6A-4BB2-ADF5-D94E91174058} [2012/01/20 06:38:53 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DCF4C6F0-5B05-430B-AAA4-447B7D8CA0D7} [2012/01/20 06:37:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{985D0795-93C8-4371-99AB-16B3808E41AE} [2012/01/19 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D10D66F7-0080-4DD1-A08D-23E7DE6B756E} [2012/01/19 18:42:34 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{151D36EB-552C-491C-B25E-B15D0910B7DE} [2012/01/19 11:20:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1EEC3C88-AC13-444E-AE5D-35CB769A95C2} [2012/01/19 11:20:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7724DAE4-D818-458B-AF77-361918FA1F56} [2012/01/19 07:13:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{087200FC-0534-46AF-B066-ACA1D34261A3} [2012/01/19 07:12:55 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{787AA54A-D91D-4D19-AA5E-2646760A815E} [2012/01/18 17:52:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{90844F29-1B1E-461E-A7D9-B3DEBA8B5DE9} [2012/01/18 17:51:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{012B8C24-9FD5-416C-B479-93801C1D41B1} [2012/01/18 11:40:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2F6557BE-E42E-478D-BF25-5085C2FEBE1B} [2012/01/18 06:39:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A36A6840-A6FD-4222-A252-83C40C282E61} [2012/01/18 06:39:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F47CC142-D76B-49BF-897F-65434E5E0398} [2012/01/17 19:05:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8F1FDDE2-3EE9-4A8C-8C49-89FAE37F32D8} [2012/01/17 19:04:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{38467C79-E699-43BD-A221-CB8EA7E3AE23} [2012/01/17 12:32:06 | 000,000,000 | ---D | C] -- C:\Users\Name\Documents\HausArbeit [2012/01/17 09:57:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7E91D8B-7BA5-4A63-840D-6EDAFAE2D777} [2012/01/17 09:57:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{077167FB-1FA7-4B72-96E0-EC8421BE2E9C} [2012/01/16 12:08:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C0BED1E-76E3-44B0-9709-51182CC3A83E} [2012/01/16 12:08:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8BE1B165-CD4E-43B2-9DF7-0C8C4C2F159D} [2012/01/15 21:42:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7916DC16-26DB-4438-9CB2-CD8247C289AF} [2012/01/15 14:35:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9DC42DD4-87DC-4428-B4E5-9E940B0289C9} [2012/01/15 14:34:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A4C128AE-19D2-4504-83DF-F87897698949} [2012/01/15 10:36:34 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0EB8C83D-640C-4C1B-9A0B-FDF26359D0FA} [2012/01/15 10:36:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E634D95B-5F7B-41BD-AD93-99E8C2322812} [2012/01/14 21:26:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FB188AA2-5DE6-44CB-A967-84A3FBC6F242} [2012/01/14 21:25:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0AC8FFD8-E122-4702-B7ED-DD3113D4A488} [2012/01/14 20:52:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FB40D128-33A4-49AB-B554-340D437A41A0} [2012/01/14 20:52:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D258351A-67B6-44E3-9354-3287858EF0EC} [2012/01/14 19:09:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8DAE6BB2-B5CE-420B-B782-F777CC1D3CF2} [2012/01/14 19:09:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FDF56268-E58E-456E-BDFB-1C15D137090B} [2012/01/14 11:55:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{20E4F515-ED4A-440D-AB16-F7F94E23A76E} [2012/01/14 11:55:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3EBDC3D0-2AAC-4256-8A8F-35F96D11BED0} [2012/01/14 05:49:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EBA2A271-5F55-4DDE-91EB-8C2FE6450321} [2012/01/14 05:49:25 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9E581844-CA8B-492E-AB2B-76432B1DA5AD} [2012/01/13 23:23:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FF48B2B2-7C53-4E9A-B1BE-E4B5E1930C02} [2012/01/13 23:23:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6372E713-5B9E-4123-839F-7E0A93656335} [2012/01/13 19:48:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{88520896-BCCE-4423-AC61-AD0BF5625CC1} [2012/01/13 19:47:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{02F8AF4E-3C55-4562-A1ED-89E37D6684F9} [2012/01/13 07:10:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{734F8B23-D070-41CB-940B-552872630EEF} [2012/01/13 07:10:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2EC39BD4-ADC1-4B6E-A45C-06F5D60B2630} [2012/01/12 22:40:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2E7B8048-6900-41C5-81D6-2CB52BE0A027} [2012/01/12 22:38:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{025C6F73-9BE7-4A90-AC5B-5181525774FB} [2012/01/12 18:22:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F18A4136-6B86-4534-AB94-2D9ED110D150} [2012/01/12 18:22:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{65C3F495-58CC-44F7-9F18-8EDC79474148} [2012/01/12 17:42:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{18362CA8-4972-4734-87B1-2CF56C8581A3} [2012/01/12 17:41:54 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6DC73EFB-AA91-4924-9EB7-D43EBAEE1E2F} [2012/01/12 10:23:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7949A92-3568-4DC0-8F7B-480D315A7A7B} [2012/01/12 10:22:37 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{20B65AFA-15EC-4281-B65B-0200C43DC49D} [2012/01/11 23:45:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{ABC33DA1-0654-4FC8-A6D9-4199507EF7E3} [2012/01/11 23:45:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B51AA868-5E49-4BD6-A62E-591E54D16388} [2012/01/11 17:06:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F8F34AA7-16A5-4367-A097-F9FC8BAF88CB} [2012/01/11 17:06:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C455BA2E-DAF2-4259-B104-F35F51C31FD0} [2012/01/11 10:45:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{08DF7322-17C9-4598-BFD1-0C9472116F32} [2012/01/11 07:39:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{54E378EF-5C9A-4C2F-94BC-DFCEE0261E19} [2012/01/11 07:39:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7441AA74-3BD9-4A70-A0A7-60C63FACE73D} [2012/01/10 18:27:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B509991A-CC11-4C56-A5B7-593233674755} [2012/01/10 18:26:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{ECD75FA7-024B-42F5-AE83-ACB9AE40097F} [2012/01/10 12:24:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0B15927F-1C5A-483E-8BCD-01830B084F8A} [2012/01/10 12:23:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6C47875C-1691-49EF-8236-68BA4E80FF44} [2012/01/10 07:15:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B077F6A3-BD59-4648-9527-C91E3918B795} [2012/01/10 07:14:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{86EF6E6C-A99A-4EBD-B3F6-47857F0D146D} [2012/01/09 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\MOLERAT [2012/01/09 20:04:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{870B9006-C093-44EE-A58B-4B58E87D5669} [2012/01/09 20:03:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0F4EE3DC-8152-45CF-87A5-50C469C0F0F5} [2012/01/09 18:08:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1F58D9AF-0B8B-4EBA-80AA-2E54006B34C6} [2012/01/09 18:05:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{00FD1B36-3362-4021-9E75-688EDA8EF7A6} [2012/01/09 13:15:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\Babylon [2012/01/09 13:15:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Babylon [2012/01/09 13:15:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2012/01/09 13:15:02 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\SysWow64\pncrt.dll [2012/01/09 13:15:02 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\Windows\SysWow64\nbDX.dll [2012/01/09 13:15:02 | 000,163,328 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\flvDX.dll [2012/01/09 13:15:02 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\Windows\SysWow64\msfDX.dll [2012/01/09 13:15:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPER © - by eRightSoft [2012/01/09 13:15:01 | 000,186,880 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLOgg.ax [2012/01/09 13:15:01 | 000,179,200 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\DiracSplitter.ax [2012/01/09 13:15:01 | 000,169,472 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\MatroskaDX.ax [2012/01/09 13:15:01 | 000,161,792 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\RealMediaDX.ax [2012/01/09 13:15:01 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\Windows\SysWow64\AVCDX.ax [2012/01/09 13:15:01 | 000,092,672 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLVorbisDec.ax [2012/01/09 13:15:01 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSSplitter.ax [2012/01/09 13:15:01 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSDecoder.ax [2012/01/09 13:15:01 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\Windows\SysWow64\RLTheoraDec.ax [2012/01/09 13:14:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft [2012/01/09 12:43:31 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\DeepSea [2012/01/09 10:26:48 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BF9F75C5-A321-4C64-BBCE-8DDF0B22BCD9} [2012/01/09 10:26:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0738CD8A-9C2E-4B68-99C9-D7AD7D76C36F} [2012/01/08 22:03:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{28D95278-B083-4544-9B56-E0F6577C35E3} [2012/01/08 22:03:08 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E3D496DB-F530-4D2B-BDF6-B561AB2F4A8C} [2012/01/08 17:31:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\OpenOffice.org [2012/01/08 16:53:49 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3 [2012/01/08 16:50:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3 [2012/01/08 16:42:00 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\OpenOffice.org 3.3 (de) Installation Files [2012/01/08 15:58:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{50807FF6-A982-4ADD-8AA9-E6E4EBFEEA40} [2012/01/08 15:58:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CC7AAC37-5676-4628-A585-5897DFFFA4DF} [2012/01/08 15:50:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{23231AD8-AA06-47CC-BE53-ED23C814AEB5} [2012/01/08 14:07:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4A0F40AA-CAC1-4AA1-A06E-BB4152371BCB} [2012/01/08 14:07:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EEB54F66-665A-40EF-A24E-6996A42BE3EA} [2012/01/08 12:54:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CBE01173-C368-4928-92FB-F447DD190107} [2012/01/08 12:54:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{79B64606-FEF6-4247-8B3A-BD5B3BBA7677} [2012/01/08 12:00:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2D17425E-C97F-492F-BE4D-A5AB1533EC16} [2012/01/08 12:00:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DEC83360-8E55-4DC7-8296-571C18F07E38} [2012/01/08 09:54:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EB8CDC76-6033-487A-9AB1-4AD81FE8504F} [2012/01/08 09:54:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{86A40474-EA77-4206-81EC-27A085E1E19F} [2012/01/07 23:16:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7695C191-B112-4AED-9156-833505461784} [2012/01/07 23:16:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{AC2D6E26-AB5F-4C98-AA84-1F9162C8404B} [2012/01/07 20:20:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B220AC42-0E44-44D5-AE64-528A155EE4CF} [2012/01/07 20:19:50 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3C393523-F8BD-4FC8-B089-BAD47F208A38} [2012/01/07 18:20:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7D3B3BA3-C278-43EA-873A-B06196658B09} [2012/01/07 18:20:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2D969B14-6987-4C69-AE6D-413E8C74341B} [2012/01/07 14:42:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9680E7A0-2C21-4913-B523-120A8276F1CD} [2012/01/07 14:42:46 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A897B21E-13CA-455E-9110-8D1170184875} [2012/01/07 12:46:23 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C02B0335-69D9-41CF-A78E-43B58882C9E8} [2012/01/07 12:46:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0A67A1C5-2918-4EFA-9524-8DB018F5BE8D} [2012/01/07 12:34:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{76DF5757-B733-4B81-B188-D6445D696C67} [2012/01/07 12:33:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{53F89AF4-ADCB-4351-890B-059110DE501C} [2012/01/07 05:02:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A60EA959-597A-497B-8046-D17E2AC4D30A} [2012/01/07 05:02:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DB12A308-6709-49B2-B37A-275B12F02FE5} [2012/01/06 19:36:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B02977AA-6CA4-4148-AC3B-0141D334F9E8} [2012/01/06 19:36:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{57C234F0-FEAC-4614-8F94-D10F9E189B41} [2012/01/06 19:10:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8585443B-1AEB-45A0-AACA-1CFEAD9361B7} [2012/01/06 19:10:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7640988-F523-4DEB-910B-48E545D5A004} [2012/01/06 16:14:30 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{36951613-4487-4014-9E9A-809444EF4FFB} [2012/01/06 16:14:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4FF8C3C7-C451-4CB3-97C6-C0CDCBDDF974} [2012/01/06 06:35:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6A5102AD-C5E7-4B5E-836B-669C3F661325} [2012/01/06 06:35:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7B5240BF-C7A4-4171-AF86-0826AAB3D71D} [2012/01/05 21:10:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DC952AC6-1294-424E-AF05-1FB0BA1D04BE} [2012/01/05 21:09:53 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A3CA567C-D758-4570-B622-72EAD11A61E7} [2012/01/05 16:01:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BBE989D0-0DC4-40FD-8177-D54683ABA40D} [2012/01/05 16:01:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1AD9FDC5-6BF8-4668-BB23-6F9E62EA8432} [2012/01/05 11:28:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C5ECFBCE-2832-4BE4-BC18-412E96478ECC} [2012/01/05 11:28:30 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C04E954C-9BB5-4B0E-9067-672F5AB38C94} [2012/01/05 11:14:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1C94CD95-965A-4962-958A-799D6CA4AED8} [2012/01/05 11:13:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9E9B1FB6-5491-4C13-924E-CC7EC5264FF6} [2012/01/05 11:10:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E23CE3F3-DFD8-40FD-AAC3-5E81372926C4} [2012/01/05 11:10:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D967B8A8-5E1F-4DF8-89A5-340AAAD07D2E} [2012/01/05 07:07:33 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3CDA94B8-1C8E-47D5-9610-071251A181D6} [2012/01/05 07:07:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FCF430D8-E194-4A1F-B826-C0608C24D85A} [2012/01/04 18:24:48 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DF591C72-05FC-448A-ABC2-5313797A9276} [2012/01/04 18:24:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3044DD32-66B1-4279-9759-507A944B50A3} [2012/01/04 17:43:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{083CAB9B-3BA5-4838-A6C6-55C04E423C18} [2012/01/04 17:43:06 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9AE649B0-AC78-4DC1-804A-F53ED7019065} [2012/01/04 16:26:14 | 000,000,000 | ---D | C] -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7-Dateien [2012/01/04 16:24:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CD2D7ED4-746E-45F2-B42A-03473368C15F} [2012/01/04 16:24:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{72702D23-559C-4E09-A75E-FC325F4FBEF9} [2012/01/04 15:13:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9499312A-9CA8-49C3-8FF7-7064CF93E7DD} [2012/01/04 12:56:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{AAD8515D-C7E8-4F8F-AC4A-1FA426C2DC7F} [2012/01/04 12:56:37 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DB85D1A8-16F6-4C9F-8784-9E2D6FDFE55C} [2012/01/03 22:01:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{780C4619-0864-44E5-B091-B1D8634F562F} [2012/01/03 22:01:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FAF94904-E5C3-4B83-BFCD-03859AFA6BD7} [12 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/01/28 12:44:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe [2012/01/28 12:31:18 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/01/28 12:31:17 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/01/28 12:23:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/01/28 12:23:29 | 3151,269,888 | -HS- | M] () -- C:\hiberfil.sys [2012/01/28 04:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At9.job [2012/01/28 03:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At7.job [2012/01/28 02:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At5.job [2012/01/28 01:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At3.job [2012/01/28 00:17:36 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At35.job [2012/01/28 00:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At1.job [2012/01/27 23:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At47.job [2012/01/27 22:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At45.job [2012/01/27 21:59:20 | 000,084,884 | ---- | M] () -- C:\Users\Name\Documents\26.01.2011REG.reg [2012/01/27 21:55:44 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012/01/27 21:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At43.job [2012/01/27 20:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At41.job [2012/01/27 19:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At39.job [2012/01/27 18:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At37.job [2012/01/27 16:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At33.job [2012/01/27 15:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At31.job [2012/01/27 13:03:01 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At27.job [2012/01/26 19:57:19 | 001,008,141 | ---- | M] () -- C:\Users\Name\Desktop\rkill.com [2012/01/26 11:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At23.job [2012/01/26 05:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At11.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At29.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At25.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At21.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At19.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At17.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At15.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At13.job [2012/01/26 00:35:47 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/01/26 00:27:38 | 000,008,213 | ---- | M] () -- C:\ProgramData\22cd857d [2012/01/26 00:27:38 | 000,008,205 | ---- | M] () -- C:\Users\Name\AppData\Roaming\b9f80375 [2012/01/26 00:27:37 | 000,008,203 | ---- | M] () -- C:\Users\Name\AppData\Local\1f1918cc [2012/01/26 00:23:26 | 000,000,112 | ---- | M] () -- C:\ProgramData\3buCjUq.dat [2012/01/26 00:21:12 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012/01/23 01:08:42 | 000,000,017 | ---- | M] () -- C:\Windows\SysWow64\shortcut_ex.dat [2012/01/13 23:25:38 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2012/01/11 16:07:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012/01/11 10:50:43 | 001,591,890 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012/01/11 10:50:43 | 000,697,314 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012/01/11 10:50:43 | 000,652,592 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/01/11 10:50:43 | 000,148,320 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012/01/11 10:50:43 | 000,121,266 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/01/11 10:50:32 | 001,591,890 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/01/09 21:39:44 | 000,071,792 | ---- | M] () -- C:\Users\Name\Desktop\DeformierbareKoerperPhysik.pdf [2012/01/09 17:13:00 | 001,468,127 | ---- | M] () -- C:\Users\Name\Desktop\Presentation.odp [2012/01/09 13:15:20 | 000,000,237 | ---- | M] () -- C:\user.js [2012/01/09 10:25:01 | 000,318,144 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/01/08 21:28:06 | 000,011,897 | ---- | M] () -- C:\Users\Name\Documents\TestHA.odt [2012/01/08 21:27:51 | 000,021,076 | ---- | M] () -- C:\Users\Name\Documents\HAUSARBEIT.odt [2012/01/08 17:32:01 | 000,001,239 | ---- | M] () -- C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2012/01/08 16:53:50 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk [2012/01/05 23:51:26 | 002,332,609 | ---- | M] () -- C:\Users\Name\Desktop\SAILFISHBRAINLOLOLOL.pdf [2012/01/05 18:15:23 | 000,764,475 | ---- | M] () -- C:\Users\Name\Desktop\Kurs10_Craniota-Auge_vorl.pdf [2012/01/04 16:26:17 | 000,028,098 | ---- | M] () -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7.htm [12 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/01/27 21:59:13 | 000,084,884 | ---- | C] () -- C:\Users\Name\Documents\26.01.2011REG.reg [2012/01/27 21:55:44 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012/01/26 19:56:55 | 001,008,141 | ---- | C] () -- C:\Users\Name\Desktop\rkill.com [2012/01/26 00:35:47 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/01/26 00:21:12 | 000,002,070 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012/01/26 00:09:00 | 000,000,112 | ---- | C] () -- C:\ProgramData\3buCjUq.dat [2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At47.job [2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At45.job [2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At43.job [2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At41.job [2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At39.job [2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At37.job [2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At35.job [2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At33.job [2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At31.job [2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At29.job [2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At27.job [2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At25.job [2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At23.job [2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At21.job [2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At19.job [2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At17.job [2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At15.job [2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At9.job [2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At7.job [2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At13.job [2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At11.job [2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At5.job [2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At3.job [2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At1.job [2012/01/25 23:55:09 | 000,008,213 | ---- | C] () -- C:\ProgramData\22cd857d [2012/01/25 23:55:09 | 000,008,205 | ---- | C] () -- C:\Users\Name\AppData\Roaming\b9f80375 [2012/01/25 23:55:09 | 000,008,203 | ---- | C] () -- C:\Users\Name\AppData\Local\1f1918cc [2012/01/23 01:08:42 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat [2012/01/22 21:16:10 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2012/01/13 22:54:17 | 000,002,023 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2012/01/09 21:39:44 | 000,071,792 | ---- | C] () -- C:\Users\Name\Desktop\DeformierbareKoerperPhysik.pdf [2012/01/09 14:04:53 | 001,468,127 | ---- | C] () -- C:\Users\Name\Desktop\Presentation.odp [2012/01/09 13:15:20 | 000,000,237 | ---- | C] () -- C:\user.js [2012/01/09 13:15:02 | 000,121,344 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.ax [2012/01/09 13:15:02 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll [2012/01/09 13:15:01 | 000,227,328 | RHS- | C] () -- C:\Windows\SysWow64\ac3DX.ax [2012/01/09 13:15:01 | 000,175,104 | RHS- | C] () -- C:\Windows\SysWow64\CoreAAC.ax [2012/01/09 13:15:01 | 000,120,832 | RHS- | C] () -- C:\Windows\SysWow64\MPCDx.ax [2012/01/09 13:15:01 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\RLMPCDec.ax [2012/01/09 13:15:01 | 000,097,280 | RHS- | C] () -- C:\Windows\SysWow64\FLACDX.ax [2012/01/09 13:15:01 | 000,081,920 | RHS- | C] () -- C:\Windows\SysWow64\aac_parser.ax [2012/01/09 13:15:01 | 000,070,656 | RHS- | C] () -- C:\Windows\SysWow64\RLAPEDec.ax [2012/01/09 13:15:01 | 000,051,712 | RHS- | C] () -- C:\Windows\SysWow64\RLSpeexDec.ax [2012/01/08 20:37:16 | 000,021,076 | ---- | C] () -- C:\Users\Name\Documents\HAUSARBEIT.odt [2012/01/08 18:19:28 | 000,011,897 | ---- | C] () -- C:\Users\Name\Documents\TestHA.odt [2012/01/08 17:32:01 | 000,001,239 | ---- | C] () -- C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2012/01/08 16:53:50 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk [2012/01/05 23:51:26 | 002,332,609 | ---- | C] () -- C:\Users\Name\Desktop\SAILFISHBRAINLOLOLOL.pdf [2012/01/05 18:15:23 | 000,764,475 | ---- | C] () -- C:\Users\Name\Desktop\Kurs10_Craniota-Auge_vorl.pdf [2012/01/04 16:26:13 | 000,028,098 | ---- | C] () -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7.htm [2011/10/24 16:44:43 | 001,591,890 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011/10/15 14:27:57 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe [2011/03/29 13:09:39 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011/03/29 13:09:38 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011/03/29 13:09:36 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2012/01/09 13:15:03 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Babylon [2011/10/17 20:33:41 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ManyCam [2012/01/08 17:31:26 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org [2012/01/26 05:07:21 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\SoftGrid Client [2011/10/24 16:45:48 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TP [2012/01/28 00:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At1.job [2012/01/26 05:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At11.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At13.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At15.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At17.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At19.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At21.job [2012/01/26 11:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At23.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At25.job [2012/01/27 13:03:01 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At27.job [2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At29.job [2012/01/28 01:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At3.job [2012/01/27 15:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At31.job [2012/01/27 16:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At33.job [2012/01/28 00:17:36 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At35.job [2012/01/27 18:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At37.job [2012/01/27 19:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At39.job [2012/01/27 20:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At41.job [2012/01/27 21:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At43.job [2012/01/27 22:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At45.job [2012/01/27 23:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At47.job [2012/01/28 02:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At5.job [2012/01/28 03:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At7.job [2012/01/28 04:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At9.job [2012/01/26 19:47:01 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012/01/11 00:39:47 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2012/01/28 00:17:21 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2011/10/15 13:09:28 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011/03/29 13:22:47 | 000,000,000 | ---D | M] -- C:\Intel [2011/12/18 00:09:50 | 000,000,000 | ---D | M] -- C:\LOSTVIKING [2011/11/25 19:03:07 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011/10/15 14:45:15 | 000,000,000 | ---D | M] -- C:\Musica [2012/01/27 21:55:42 | 000,000,000 | R--D | M] -- C:\Program Files [2012/01/27 22:01:33 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2012/01/26 00:35:46 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011/10/15 13:09:29 | 000,000,000 | -HSD | M] -- C:\Recovery [2012/01/28 12:49:09 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012/01/11 00:39:38 | 000,000,000 | R--D | M] -- C:\Users [2012/01/28 00:17:35 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\system64\drivers\AGP440.sys [2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\system64\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\system64\drivers\atapi.sys [2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\system64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\system64\cngaudit.dll [2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011/02/26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2011/01/16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Name\AppData\Local\Temp\RarSFX0\procs\explorer.exe [2010/11/21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2005/08/16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Name\AppData\Local\Temp\RarSFX0\h\explorer.exe [2010/11/21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe < MD5 for: IASTOR.SYS > [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\system64\drivers\iaStor.sys [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\system64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys < MD5 for: IASTORV.SYS > [2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\system64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011/03/11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\system64\drivers\iaStorV.sys [2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\system64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\system64\netlogon.dll [2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010/11/21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010/11/21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll < MD5 for: NVSTOR.SYS > [2011/03/11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\system64\drivers\nvstor.sys [2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\system64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\system64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2010/11/21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010/11/21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\system64\scecli.dll [2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010/11/21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010/11/21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\system64\user32.dll [2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009/05/26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Name\AppData\Local\Temp\RarSFX0\userinit.exe [2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\system64\userinit.exe [2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WINLOGON.EXE > [2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\system64\winlogon.exe [2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009/05/26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Name\AppData\Local\Temp\RarSFX0\winlogon.exe [2011/12/24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\system64\drivers\ws2ifsl.sys [2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > [2009/07/14 02:14:57 | 000,070,144 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\atl.dll [2011/10/24 04:30:22 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll [2011/10/24 04:30:22 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll [2011/10/24 04:30:22 | 000,118,784 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\iepeers.dll [12 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < %USERPROFILE%\*.* > [2012/01/28 12:48:49 | 001,572,864 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT [2012/01/28 12:48:49 | 000,262,144 | -HS- | M] () -- C:\Users\Name\ntuser.dat.LOG1 [2011/10/15 13:16:29 | 000,000,000 | -HS- | M] () -- C:\Users\Name\ntuser.dat.LOG2 [2011/10/15 14:31:38 | 000,065,536 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2011/10/15 14:31:38 | 000,524,288 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2011/10/15 14:31:38 | 000,524,288 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2011/10/15 13:16:29 | 000,000,020 | -HS- | M] () -- C:\Users\Name\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ========== Hard Links - Junction Points - Mount Points - Symbolic Links ========== [C:\Windows\system64] -> \systemroot\system32 -> Mount Point < End of report > |
|
28.01.2012, 13:31
| #4 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Extras.Txt Code:
ATTFilter OTL Extras logfile created on: 1/28/2012 12:47:16 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Name\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.91 Gb Total Physical Memory | 2.57 Gb Available Physical Memory | 65.68% Memory free
7.82 Gb Paging File | 6.24 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 434.66 Gb Total Space | 339.79 Gb Free Space | 78.17% Space Free | Partition Type: NTFS
Drive D: | 30.00 Gb Total Space | 3.55 Gb Free Space | 11.83% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: ELKARAJO | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java(TM) 6 Update 24 (64-bit)
"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources
"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}" = Cisco Systems VPN Client 5.0.07.0440
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{794E5C90-96E5-4413-B3F5-C803205AE30C}" = Intel(R) PROSet/Wireless WiFi Software
"{821B4CA1-D404-4CCA-AEA4-C7D3F40841B1}" = Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.39
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.39
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C7B40C35-85AE-4303-9EEA-1A1EA779664D}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources
"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}" = Finger Sensing Pad Driver
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail
"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Medion Home Cinema
"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2F54E453-8C93-4B3B-936A-233C909E6CAC}" = Windows Live Messenger
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery
"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = CyberLink PowerRecover
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48106FE4-B1AF-4941-BF3D-83E6C4B7CAF3}" = Alcor Micro USB Card Reader
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger
"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack
"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{57220148-3B2B-412A-A2E0-82B9DF423696}" = Windows Live Mesh ActiveX-objekt til fjernforbindelser
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{58D335B6-B3C6-4465-AEC3-6442BC323723}" = SharpKeys
"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail
"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh
"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}" = Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer
"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh
"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources
"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common
"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D3D8C60-A55F-4fed-B2B9-173F09590E16}" = REALTEK Wireless LAN Driver
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA4D1C5E-116A-4FF4-AA91-28F526868203}" = watchmi
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AC76BA86-7AD7-5464-3428-A00000000004}" = Spelling Dictionaries Support For Adobe Reader X
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.2) MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}" = Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CA227A9D-09BE-4BFB-9764-48FED2DA5454}" = Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}" = PHotkey
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger
"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AmUStor" = Alcor Micro USB Card Reader
"Avira AntiVir Desktop" = Avira Free Antivirus
"ESET Online Scanner" = ESET Online Scanner v3
"GOM Player" = GOM Player
"GomTVStreamer" = GOMTV Streamer
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Medion Home Cinema
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = CyberLink PowerRecover
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"ManyCam" = ManyCam 2.6.60 (remove only)
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"muCommander" = muCommander (remove only)
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"StarCraft II" = StarCraft II
"Steam App 72850" = The Elder Scrolls V: Skyrim
"WinLiveSuite" = Windows Live Essentials
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 1/26/2012 1:51:57 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In
Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 1/26/2012 2:47:11 PM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description =
Error - 1/26/2012 2:50:13 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In
Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 1/26/2012 2:57:53 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In
Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 1/26/2012 2:57:53 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In
Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 1/26/2012 2:57:56 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
Fehler in Manifest- oder Richtliniendatei "" in Zeile . Eine für die Anwendung erforderliche
Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In
Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 1/27/2012 7:09:36 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
nicht initialisiert werden. Details: Could not query the status of the EventSystem
service. System Error: Der Computer wird heruntergefahren. .
Error - 1/27/2012 7:10:35 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description =
Error - 1/27/2012 9:43:27 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description =
Error - 1/27/2012 11:59:29 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 1/27/2012 11:19:43 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 1/27/2012 11:44:48 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 1/27/2012 11:57:54 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 1/27/2012 11:58:02 AM | Computer Name = ElKarajo | Source = DCOM | ID = 10010
Description =
Error - 1/27/2012 11:59:18 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 1/27/2012 11:59:18 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060
Error - 1/27/2012 11:59:20 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 1/27/2012 11:59:20 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
BFE. Dieser Dienst ist eventuell nicht installiert.
Error - 1/27/2012 11:59:34 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
Error - 1/27/2012 12:00:10 PM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
< End of report >
|
|
28.01.2012, 15:33
| #5 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatischCombofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.01.2012, 17:26
| #6 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatischCode:
ATTFilter ComboFix 12-01-28.01 - Name 28.01.2012 16:49:00.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4007.2514 [GMT 1:00]
ausgeführt von:: c:\users\Name\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Outdated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\programdata\Roaming
c:\windows\assembly\temp\@
c:\windows\assembly\temp\bckfg.tmp
c:\windows\assembly\temp\cfg.ini
c:\windows\security\Database\tmp.edb
c:\windows\system32\java.exe
c:\windows\System64
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-12-28 bis 2012-01-28 ))))))))))))))))))))))))))))))
.
.
2012-01-28 15:54 . 2012-01-28 15:54 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-01-28 15:54 . 2012-01-28 15:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-27 20:55 . 2012-01-27 20:55 -------- d-----w- c:\program files\CCleaner
2012-01-27 20:12 . 2012-01-27 20:12 -------- d-----w- c:\windows\de
2012-01-27 20:11 . 2012-01-27 20:11 -------- d-----w- c:\windows\da
2012-01-27 20:11 . 2012-01-27 20:11 -------- d-----w- c:\windows\el
2012-01-27 20:11 . 2012-01-27 20:11 -------- d-----w- c:\windows\en
2012-01-27 20:11 . 2012-01-27 20:11 -------- d-----w- c:\windows\es
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\fr
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\hu
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\it
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\nl
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\pl
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\sl
2012-01-27 20:10 . 2012-01-27 20:10 -------- d-----w- c:\windows\tr
2012-01-27 20:07 . 2012-01-27 20:07 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-01-27 20:04 . 2012-01-27 20:04 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\d667ecb91ccdd2e01\MeshBetaRemover.exe
2012-01-26 17:52 . 2012-01-26 17:52 -------- d-----w- c:\program files (x86)\ESET
2012-01-25 23:35 . 2012-01-25 23:35 -------- d-----w- c:\users\Name\AppData\Roaming\Malwarebytes
2012-01-25 23:35 . 2012-01-25 23:35 -------- d-----w- c:\programdata\Malwarebytes
2012-01-25 23:35 . 2012-01-25 23:35 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-25 23:35 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-25 23:33 . 2012-01-25 23:33 -------- d-----w- c:\users\Name\AppData\Roaming\Avira
2012-01-25 23:21 . 2011-12-15 14:00 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-01-25 23:21 . 2011-12-15 13:59 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-01-25 23:21 . 2011-12-15 13:59 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-01-25 23:21 . 2012-01-25 23:21 -------- d-----w- c:\programdata\Avira
2012-01-25 23:21 . 2012-01-25 23:21 -------- d-----w- c:\program files (x86)\Avira
2012-01-24 13:04 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D77F066C-8EBF-4B68-9581-0F0B0884E8EC}\mpengine.dll
2012-01-22 20:16 . 2009-09-27 08:39 369152 ----a-w- c:\windows\SysWow64\avisynth.dll
2012-01-22 20:16 . 2005-07-14 11:31 32256 ----a-w- c:\windows\SysWow64\AVSredirect.dll
2012-01-22 20:16 . 2004-02-22 09:11 719872 ----a-w- c:\windows\SysWow64\devil.dll
2012-01-22 20:16 . 2004-01-24 23:00 70656 ----a-w- c:\windows\SysWow64\yv12vfw.dll
2012-01-22 20:16 . 2004-01-24 23:00 70656 ----a-w- c:\windows\SysWow64\i420vfw.dll
2012-01-22 20:16 . 2012-01-22 20:16 -------- d-----w- c:\program files (x86)\AviSynth 2.5
2012-01-11 19:02 . 2012-01-11 19:02 0 ----a-w- c:\windows\SysWow64\sho17C8.tmp
2012-01-11 06:46 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 06:46 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-01-11 06:46 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-01-11 06:46 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-01-11 06:46 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 06:46 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-01-11 06:46 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-11 06:46 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-01-10 23:46 . 2012-01-10 23:46 0 ----a-w- c:\windows\SysWow64\sho43E9.tmp
2012-01-10 23:39 . 2012-01-10 23:39 -------- d-----w- c:\users\Hallo
2012-01-09 12:14 . 2012-01-09 12:14 -------- d-----w- c:\program files (x86)\eRightSoft
2012-01-08 16:31 . 2012-01-08 16:31 -------- d-----w- c:\users\Name\AppData\Roaming\OpenOffice.org
2012-01-08 15:50 . 2012-01-08 15:51 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2012-01-08 15:48 . 2011-03-14 22:20 472808 ----a-w- c:\program files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll
2012-01-08 14:58 . 2012-01-08 14:58 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-08 14:58 . 2012-01-08 14:58 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-08 14:58 . 2012-01-08 14:58 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-08 14:58 . 2012-01-08 14:58 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll
2012-01-03 13:10 . 2012-01-03 13:10 182672 ----a-w- c:\program files (x86)\Mozilla Firefox\Plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-25 22:57 . 2011-11-29 11:17 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-20 13:41 . 2011-12-20 13:41 0 ----a-w- c:\windows\SysWow64\sho1B4F.tmp
2011-12-07 19:06 . 2011-12-07 19:06 0 ----a-w- c:\windows\SysWow64\sho2B0D.tmp
2011-11-29 00:10 . 2011-11-29 00:10 0 ----a-w- c:\windows\SysWow64\sho4330.tmp
2011-11-28 01:08 . 2011-11-28 01:08 0 ----a-w- c:\windows\SysWow64\sho9FEB.tmp
2011-11-27 20:01 . 2011-11-27 20:01 0 ----a-w- c:\windows\SysWow64\sho4300.tmp
2011-11-24 04:52 . 2011-12-14 17:24 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-20 04:29 . 2011-11-20 04:29 0 ----a-w- c:\windows\SysWow64\sho3630.tmp
2011-11-16 19:03 . 2011-11-16 19:03 0 ----a-w- c:\windows\SysWow64\sho56D8.tmp
2011-11-15 13:29 . 2010-11-21 03:27 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-11-14 00:44 . 2011-11-14 00:44 0 ----a-w- c:\windows\SysWow64\shoE6D8.tmp
2011-11-05 05:32 . 2011-12-14 17:24 2048 ----a-w- c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-14 17:24 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-14 19:02 2309120 ----a-w- c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-14 19:02 1390080 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-14 19:02 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-14 19:02 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-14 19:02 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-14 19:02 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-14 19:02 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-14 19:02 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-11-03 01:30 . 2011-11-03 01:30 0 ----a-w- c:\windows\SysWow64\sho8B9F.tmp
2006-05-03 11:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 12:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 14:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-06 23:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-11-11 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"YouCam Tray"="c:\program files (x86)\CyberLink\YouCam\YouCam.exe" [2010-10-29 224352]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-11-29 75048]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-01-03 35736]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
c:\users\Hallo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
watchmi tray.lnk - c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe [2011-10-15 300416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2011/02/22 13:10;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2010-11-29 241648]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AMPPALP;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-02-11 1304912]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]
R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\drivers\fspad_xp64.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-02-04 340240]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-02-17 1133568]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-02-11 907600]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-02-11 997712]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-02-09 134928]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [x]
S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe [2010-10-07 159752]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-02-17 1997416]
S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys [2009-09-11 14344]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
S3 AMPPAL;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - CLKMDRV10_38F51D56
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-10 418840]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-02-04 1933584]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-02-11 10361616]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-02-17 316032]
"combofix"="c:\combofix\CF29404.3XE" [2010-11-21 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 134.102.20.20 134.102.200.14
FF - ProfilePath - c:\users\Name\AppData\Roaming\Mozilla\Firefox\Profiles\zcvh1v1u.default\
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101641
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - fa252e12000000000000dca971048b17
FF - user.js: extensions.BabylonToolbar_i.hardId - fa252e12000000000000dca971048b17
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15348
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:15
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
HKLM-Run-fspuip - c:\program files (x86)\FSP\fspuip.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\PHotkey\ASLDRSrv.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe
c:\program files (x86)\PHotkey\PHotkey.exe
c:\program files (x86)\PHotkey\MsgTranAgt.exe
c:\program files (x86)\PHotkey\POSD.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-28 17:01:46 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-01-28 16:01
.
Vor Suchlauf: 8 Verzeichnis(se), 364.905.734.144 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 364.337.516.544 Bytes frei
.
- - End Of File - - A0679081370C63F0B448A92F5E29CA64
War es das erstmal? Was war denn das überhaupt für ein Werbungsvirus/Trojaner, kann man das sagen? |
|
28.01.2012, 17:34
| #7 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch hi, machst du mit dem pc onlinebanking, einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.01.2012, 17:38
| #8 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Ja an sich schon, aber seit dem Virenbefall hab ich es nicht mehr gemacht. Was gibt es zu beachten? |
|
28.01.2012, 17:51
| #9 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch hi, 1. bank anrufen, die notfall nummer für das wochenende sollte 116 116 sein. lasse das banking wegen zero access rootkit sperren. der pc muss neu aufgesetzt und dann abgesichert werden 1. Datenrettung:
4. alle Passwörter ändern! 5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen. 6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.01.2012, 18:10
| #10 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Ok, hab das mit der Bank erledigt. Pc kann ich leider erst ab Montag formatieren, weil ich dummerweise die Recovery CD nicht bei mir habe... Kann ich in der Zeit den PC für Recherche verwenden? Bzw. die Passwörter auch hier ändern, oder nur wenn das System formatiert ist? |
|
28.01.2012, 18:15
| #11 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch ne, was sollte es bringen von einem infiziertem pc aus die passwörter zu endern? die müssen nach formatierung geendert werden, der pc sollte nur ans netz wenn es unbedingt nötig ist, passwörter sollte man am besten keine mehr eingeben.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.01.2012, 18:17
| #12 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Ok, verdammt hätte nicht gedacht, dass dies so schwerwiegend ist. Danke für die schnelle Hilfe, melde mich sobald ich das System formatiert habe. |
|
28.01.2012, 18:19
| #13 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch naja, wir haben es rechtzeitig festgestellt und dir ist kein schaden entstanden, das ist doch positiv
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.01.2012, 18:24
| #14 |
| | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch Stimmt. Also vielen Dank nochmal! Wirklich sehr kompetente Hilfe! |
|
28.01.2012, 18:26
| #15 |
| /// Malware-holic | Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch kein problem, und trotz alle dem, nen schönes wochenende
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch |
| administrator, anti-malware, antiviren, automatisch, autostart, bietet, cc cleaner, cleaner, dateien, dateisystem, explorer, firefox, gelöscht, heuristiks/extra, heuristiks/shuriken, logfiles, maßnahme, problem, quarantäne, seite, service, speicher, start, temp, test, version, werbeseite, wiederholt, öffnet |
Linear-Darstellung
